Техническая информация
Для обеспечения автозапуска и распространения
Создает или изменяет следующие файлы
- %APPDATA%\microsoft\windows\start menu\programs\startup\microsoft update.lnk
Вредоносные функции
Завершает или пытается завершить
следующие пользовательские процессы:
- firefox.exe
- iexplore.exe
Читает файлы, отвечающие за хранение паролей сторонними программами
- %HOMEPATH%\desktop\508softwareandos.doc
- %HOMEPATH%\desktop\toolbar.bmp
- %HOMEPATH%\desktop\thlps_keeper_mayer_1965.docx
- %HOMEPATH%\desktop\testee.cer
- %HOMEPATH%\desktop\testcertificate.cer
- %HOMEPATH%\desktop\nwfieldnotes1966.docx
- %HOMEPATH%\desktop\ituneshelpunavailable.htm
- %HOMEPATH%\desktop\holycrosschurchinstructions.docx
- %HOMEPATH%\desktop\hanni_umami_chapter.doc
- %HOMEPATH%\desktop\dial.bmp
- %HOMEPATH%\desktop\default.bmp
- %HOMEPATH%\desktop\dashborder_96.bmp
- %HOMEPATH%\desktop\dashborder_120.bmp
- %HOMEPATH%\desktop\contoso.cer
- %HOMEPATH%\desktop\browse.html
- %HOMEPATH%\desktop\browse.htm
- %HOMEPATH%\desktop\archer.avi
- %HOMEPATH%\desktop\api-hashmap.html
- %HOMEPATH%\desktop\alert.html
- %HOMEPATH%\desktop\alert.htm
- %HOMEPATH%\desktop\adhd_and_obesity.docx
- %HOMEPATH%\desktop\about.htm
- %HOMEPATH%\desktop\uep_form_786_bulletin_1726i602.doc
- %HOMEPATH%\desktop\weeklysheet1215.doc
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\aut2413.tmp
- D:\lock.system volume information
- D:\lock.$recycle.bin
- %LOCALAPPDATA%\lock.thunderbird
- %LOCALAPPDATA%\lock.temporary internet files
- %LOCALAPPDATA%\lock.temp
- %LOCALAPPDATA%\lock.programs
- %APPDATA%\lock.mozilla
- %LOCALAPPDATA%\lock.mozilla
- %LOCALAPPDATA%\lock.microsoft
- %LOCALAPPDATA%\lock.iconcache.db
- %LOCALAPPDATA%\lock.history
- %LOCALAPPDATA%\lock.google
- %LOCALAPPDATA%\lock.application data
- %APPDATA%\lock.thunderbird
- %LOCALAPPDATA%\lock.microsoft help
- %APPDATA%\lock.telegram desktop
- %HOMEPATH%\music\lock.desktop.ini
- C:\users\public\documents\lock.my pictures
- %TEMP%\aut673b.tmp
- %TEMP%\8x8x8
- C:\users\public\videos\lock.sample videos
- C:\users\public\videos\lock.desktop.ini
- C:\users\public\pictures\lock.sample pictures
- C:\users\public\pictures\lock.desktop.ini
- %HOMEPATH%\videos\lock.desktop.ini
- %HOMEPATH%\pictures\lock.desktop.ini
- C:\users\public\documents\lock.my music
- C:\users\public\documents\lock.desktop.ini
- %HOMEPATH%\documents\lock.my videos
- %HOMEPATH%\documents\lock.my pictures
- %HOMEPATH%\documents\lock.my music
- %HOMEPATH%\documents\lock.desktop.ini
- C:\users\public\documents\lock.my videos
- %APPDATA%\lock.microsoft
- %APPDATA%\lock.media center programs
- %APPDATA%\lock.identities
- %HOMEPATH%\desktop\lock.contoso.cer
- %HOMEPATH%\desktop\lock.chromesetup.exe
- %HOMEPATH%\desktop\lock.calc.exe
- %HOMEPATH%\desktop\lock.browse.html
- %HOMEPATH%\desktop\lock.browse.htm
- %HOMEPATH%\desktop\lock.dashborder_96.bmp
- %HOMEPATH%\desktop\lock.archer.avi
- %HOMEPATH%\desktop\lock.alert.html
- %HOMEPATH%\desktop\lock.alert.htm
- %HOMEPATH%\desktop\lock.adhd_and_obesity.docx
- %HOMEPATH%\desktop\lock.about.htm
- %HOMEPATH%\desktop\lock.508softwareandos.doc
- %TEMP%\wkxewio
- %HOMEPATH%\desktop\lock.api-hashmap.html
- %HOMEPATH%\desktop\lock.default.bmp
- %HOMEPATH%\desktop\lock.dashborder_120.bmp
- %HOMEPATH%\desktop\lock.desktop.ini
- %HOMEPATH%\desktop\lock.wrar520.exe
- %HOMEPATH%\desktop\lock.testee.cer
- %HOMEPATH%\desktop\lock.winmine.exe
- %HOMEPATH%\desktop\lock.weeklysheet1215.doc
- %HOMEPATH%\desktop\lock.utorrent.exe
- %HOMEPATH%\desktop\lock.uep_form_786_bulletin_1726i602.doc
- %HOMEPATH%\desktop\lock.toolbar.bmp
- %HOMEPATH%\desktop\lock.thlps_keeper_mayer_1965.docx
- %HOMEPATH%\desktop\lock.testcertificate.cer
- %HOMEPATH%\desktop\lock.dial.bmp
- %HOMEPATH%\desktop\lock.telegram.lnk
- %HOMEPATH%\desktop\lock.nwfieldnotes1966.docx
- %HOMEPATH%\desktop\lock.ituneshelpunavailable.htm
- %HOMEPATH%\desktop\lock.holycrosschurchinstructions.docx
- %HOMEPATH%\desktop\lock.hanni_umami_chapter.doc
- %HOMEPATH%\desktop\lock.google chrome.lnk
- %TEMP%\wl.jpg
- %TEMP%\x.exe
Удаляет следующие файлы
- %TEMP%\aut2413.tmp
- %TEMP%\wkxewio
- %TEMP%\aut673b.tmp
Другое
Ищет следующие окна
- ClassName: 'SystemTray_Main' WindowName: ''
