Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Classes\VncViewer.Config\shell\open\command] '' = '"%PROGRAM_FILES%\UltraVNC\vncviewer.exe" -config "%1"'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\vnccom] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\vncdrv] 'Start' = '00000001'
Вредоносные функции:
Создает и запускает на исполнение:
- '%TEMP%\is-KT9B4.tmp\winvnc.exe' -kill
- '%PROGRAM_FILES%\UltraVNC\driver\setupdrv.exe' installs
- 'C:\Archivos de programa\UltraVNC\SetupVnc.exe' /NORESTART /VERYSILENT /loadinf=C:\Archivos de programa\UltraVNC\inst_vnc.inf
- '%TEMP%\is-T1FCV.tmp\is-IL8M7.tmp' /SL4 $60036 "C:\Archivos de programa\ULTRAVNC\SETUPVNC.EXE" 1455639 71680 /NORESTART /VERYSILENT /loadinf=C:\Archivos de programa\UltraVNC\inst_vnc.inf
Запускает на исполнение:
- '<SYSTEM32>\runonce.exe' -r
- '<SYSTEM32>\net1.exe' stop winvnc
- '<SYSTEM32>\net.exe' stop winvnc
Изменения в файловой системе:
Создает следующие файлы:
- %ALLUSERSPROFILE%\Start Menu\Programs\UltraVNC\UltraVNC Viewer.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\UltraVNC\UltraVNC Server.lnk
- %HOMEPATH%\Desktop\UltraVNC Viewer.lnk
- %PROGRAM_FILES%\UltraVNC\translation\is-LO2E7.tmp
- %HOMEPATH%\Desktop\UltraVNC Server.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\UltraVNC\UltraVNC Server\Install WinVNC Service silent.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\UltraVNC\UltraVNC Server\Remove WinVNC Service.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\UltraVNC\UltraVNC Server\Install WinVNC Service.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\UltraVNC\UltraVNC Viewer\Run UltraVNC Viewer (Listen Mode).lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\UltraVNC\UltraVNC Viewer\Show UltraVNC Viewer Help.lnk
- %PROGRAM_FILES%\UltraVNC\driver\is-10UJJ.tmp
- %PROGRAM_FILES%\UltraVNC\driver\is-2PGEF.tmp
- %PROGRAM_FILES%\UltraVNC\driver\is-96C2F.tmp
- %PROGRAM_FILES%\UltraVNC\driver\is-BC2TL.tmp
- %PROGRAM_FILES%\UltraVNC\driver\is-2G2FT.tmp
- %PROGRAM_FILES%\UltraVNC\translation\is-JU5T0.tmp
- %PROGRAM_FILES%\UltraVNC\translation\is-T82IL.tmp
- %PROGRAM_FILES%\UltraVNC\is-9LQ3G.tmp
- %PROGRAM_FILES%\UltraVNC\driver\is-F3RF1.tmp
- %PROGRAM_FILES%\UltraVNC\driver\is-E7JL2.tmp
- %WINDIR%\inf\oem3.inf
- %WINDIR%\inf\oem3.PNF
- %PROGRAM_FILES%\UltraVNC\unins000.dat
- %ALLUSERSPROFILE%\Start Menu\Programs\UltraVNC\UltraVNC Driver\Install Driver.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\UltraVNC\UltraVNC Driver\Remove Driver.lnk
- <DRIVERS>\vnccom.SYS
- <SYSTEM32>\'
- <SYSTEM32>\SET5.tmp
- <DRIVERS>\SET3.tmp
- <SYSTEM32>\SET4.tmp
- %ALLUSERSPROFILE%\Start Menu\Programs\UltraVNC\UltraVNC Server\Show Default Settings.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\UltraVNC\UltraVNC Server\Show User Settings.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\UltraVNC\UltraVNC Server\Show WinVNC Server Help.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\UltraVNC\UltraVNC Server\Reinstall WinVNC Service (Silent).lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\UltraVNC\UltraVNC Server\Run Service Helper.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\UltraVNC\Doc\Whatsnew.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\UltraVNC\Doc\Licence.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\UltraVNC\Doc\Readme.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\UltraVNC\UltraVNC Server\Show About Box.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\UltraVNC\UltraVNC Server\Install Default Registry Settings.lnk
- C:\Archivos de programa\UltraVNC\Mantenimiento.lnk
- %TEMP%\is-T1FCV.tmp\is-IL8M7.tmp
- %ALLUSERSPROFILE%\Escritorio\Mantenimiento.lnk
- C:\Archivos de programa\UltraVNC\IP.ini
- %WINDIR%\Escritorio\Mantenimiento.lnk
- %PROGRAM_FILES%\UltraVNC\is-403SS.tmp
- %PROGRAM_FILES%\UltraVNC\is-CI9IQ.tmp
- %TEMP%\is-KT9B4.tmp\_isetup\_isdecmp.dll
- %TEMP%\is-KT9B4.tmp\_isetup\_RegDLL.tmp
- %TEMP%\is-KT9B4.tmp\_isetup\_shfoldr.dll
- C:\Archivos de programa\UltraVNC\inst_vnc.inf
- C:\Archivos de programa\UltraVNC\instala.bat
- C:\Archivos de programa\UltraVNC\mto.ico
- C:\Archivos de programa\UltraVNC\Mto.lnk
- C:\Archivos de programa\UltraVNC\vnc.bat
- C:\Archivos de programa\UltraVNC\AMto.lnk
- C:\Archivos de programa\UltraVNC\Mantenimiento.exe
- C:\Archivos de programa\UltraVNC\Acceso Mantenimiento.lnk
- C:\Archivos de programa\UltraVNC\SetupVnc.exe
- C:\Archivos de programa\UltraVNC\Acceso Mto.lnk
- %PROGRAM_FILES%\UltraVNC\is-DH9C7.tmp
- %PROGRAM_FILES%\UltraVNC\is-GJQI2.tmp
- %PROGRAM_FILES%\UltraVNC\is-M08U3.tmp
- %PROGRAM_FILES%\UltraVNC\is-N9B6N.tmp
- %PROGRAM_FILES%\UltraVNC\is-AEOFN.tmp
- %PROGRAM_FILES%\UltraVNC\driver\is-MDU1N.tmp
- %PROGRAM_FILES%\UltraVNC\driver\is-SCDCR.tmp
- %PROGRAM_FILES%\UltraVNC\driver\is-IFPNI.tmp
- %PROGRAM_FILES%\UltraVNC\driver\is-5B3BF.tmp
- %PROGRAM_FILES%\UltraVNC\driver\is-QOLNP.tmp
- %PROGRAM_FILES%\UltraVNC\is-NVJU6.tmp
- %PROGRAM_FILES%\UltraVNC\is-IQIOC.tmp
- %TEMP%\is-KT9B4.tmp\winvnc.exe
- %PROGRAM_FILES%\UltraVNC\is-R6IIQ.tmp
- %PROGRAM_FILES%\UltraVNC\is-Q56E0.tmp
- %PROGRAM_FILES%\UltraVNC\is-LQE5T.tmp
- %PROGRAM_FILES%\UltraVNC\is-A7HO5.tmp
- %PROGRAM_FILES%\UltraVNC\is-U01TT.tmp
- %PROGRAM_FILES%\UltraVNC\is-E4T9J.tmp
- %PROGRAM_FILES%\UltraVNC\is-30C6U.tmp
Удаляет следующие файлы:
- %TEMP%\is-KT9B4.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-T1FCV.tmp\is-IL8M7.tmp
- %TEMP%\is-KT9B4.tmp\_isetup\_RegDLL.tmp
- %TEMP%\is-KT9B4.tmp\winvnc.exe
- %TEMP%\is-KT9B4.tmp\_isetup\_isdecmp.dll
Перемещает следующие файлы:
- %PROGRAM_FILES%\UltraVNC\driver\is-96C2F.tmp в %PROGRAM_FILES%\UltraVNC\driver\vnccom.sys
- %PROGRAM_FILES%\UltraVNC\driver\is-2G2FT.tmp в %PROGRAM_FILES%\UltraVNC\driver\uninstall_silent.bat
- %PROGRAM_FILES%\UltraVNC\driver\is-2PGEF.tmp в %PROGRAM_FILES%\UltraVNC\driver\vncdrv.inf
- %PROGRAM_FILES%\UltraVNC\driver\is-10UJJ.tmp в %PROGRAM_FILES%\UltraVNC\driver\vncdrv.dll
- %PROGRAM_FILES%\UltraVNC\driver\is-MDU1N.tmp в %PROGRAM_FILES%\UltraVNC\driver\license.txt
- %PROGRAM_FILES%\UltraVNC\driver\is-IFPNI.tmp в %PROGRAM_FILES%\UltraVNC\driver\install_silent.bat
- %PROGRAM_FILES%\UltraVNC\driver\is-BC2TL.tmp в %PROGRAM_FILES%\UltraVNC\driver\uninstall.bat
- %PROGRAM_FILES%\UltraVNC\driver\is-SCDCR.tmp в %PROGRAM_FILES%\UltraVNC\driver\setupdrv.exe
- %PROGRAM_FILES%\UltraVNC\driver\is-F3RF1.tmp в %PROGRAM_FILES%\UltraVNC\driver\vncdrv.sys
- <DRIVERS>\SET3.tmp в <DRIVERS>\vncdrv.sys
- %PROGRAM_FILES%\UltraVNC\translation\is-LO2E7.tmp в %PROGRAM_FILES%\UltraVNC\translation\readme.txt
- <SYSTEM32>\SET5.tmp в <SYSTEM32>\vnchelp.dll
- <SYSTEM32>\SET4.tmp в <SYSTEM32>\vncdrv.dll
- %PROGRAM_FILES%\UltraVNC\is-9LQ3G.tmp в %PROGRAM_FILES%\UltraVNC\vncviewer.exe
- %PROGRAM_FILES%\UltraVNC\driver\is-E7JL2.tmp в %PROGRAM_FILES%\UltraVNC\driver\vnchelp.dll
- %PROGRAM_FILES%\UltraVNC\translation\is-T82IL.tmp в %PROGRAM_FILES%\UltraVNC\translation\german.dll
- %PROGRAM_FILES%\UltraVNC\translation\is-JU5T0.tmp в %PROGRAM_FILES%\UltraVNC\translation\french.dll
- %PROGRAM_FILES%\UltraVNC\driver\is-QOLNP.tmp в %PROGRAM_FILES%\UltraVNC\driver\install.bat
- %PROGRAM_FILES%\UltraVNC\is-IQIOC.tmp в %PROGRAM_FILES%\UltraVNC\vnchooks.dll
- %PROGRAM_FILES%\UltraVNC\is-NVJU6.tmp в %PROGRAM_FILES%\UltraVNC\winvnc.exe
- %PROGRAM_FILES%\UltraVNC\is-30C6U.tmp в %PROGRAM_FILES%\UltraVNC\logmessages.dll
- %PROGRAM_FILES%\UltraVNC\is-E4T9J.tmp в %PROGRAM_FILES%\UltraVNC\VNCHooks_Settings.reg
- %PROGRAM_FILES%\UltraVNC\is-CI9IQ.tmp в %PROGRAM_FILES%\UltraVNC\Licence.txt
- %PROGRAM_FILES%\UltraVNC\is-403SS.tmp в %PROGRAM_FILES%\UltraVNC\unins000.exe
- %PROGRAM_FILES%\UltraVNC\is-Q56E0.tmp в %PROGRAM_FILES%\UltraVNC\Readme.txt
- %PROGRAM_FILES%\UltraVNC\is-R6IIQ.tmp в %PROGRAM_FILES%\UltraVNC\Whatsnew.txt
- %PROGRAM_FILES%\UltraVNC\is-U01TT.tmp в %PROGRAM_FILES%\UltraVNC\UnZip32.dll
- %PROGRAM_FILES%\UltraVNC\is-DH9C7.tmp в %PROGRAM_FILES%\UltraVNC\authSSP.dll
- %PROGRAM_FILES%\UltraVNC\is-M08U3.tmp в %PROGRAM_FILES%\UltraVNC\ldapauth.dll
- %PROGRAM_FILES%\UltraVNC\driver\is-5B3BF.tmp в %PROGRAM_FILES%\UltraVNC\driver\before.txt
- %PROGRAM_FILES%\UltraVNC\is-GJQI2.tmp в %PROGRAM_FILES%\UltraVNC\MSLogonACL.exe
- %PROGRAM_FILES%\UltraVNC\is-A7HO5.tmp в %PROGRAM_FILES%\UltraVNC\logging.dll
- %PROGRAM_FILES%\UltraVNC\is-LQE5T.tmp в %PROGRAM_FILES%\UltraVNC\Zip32.dll
- %PROGRAM_FILES%\UltraVNC\is-AEOFN.tmp в %PROGRAM_FILES%\UltraVNC\workgrpdomnt4.dll
- %PROGRAM_FILES%\UltraVNC\is-N9B6N.tmp в %PROGRAM_FILES%\UltraVNC\authadmin.dll
Другое:
Ищет следующие окна:
- ClassName: '(null)' WindowName: 'Hardware Installation'
- ClassName: '(null)' WindowName: 'Software Installation'
- ClassName: 'WinVNC Tray Icon' WindowName: '(null)'
- ClassName: 'EDIT' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
