Техническая информация
Вредоносные функции:
Изменяет следующие настройки браузера Windows Internet Explorer:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1400' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1803' = '00000003'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] 'currentlevel' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1601' = '00000000'
Изменения в файловой системе:
Создает следующие файлы:
- C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\L3KUA2D0\desktop.ini
- C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\8HIJKLMN\desktop.ini
- C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B4ABXWI2\desktop.ini
- %TEMP%\1.tmp
- C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\TCD6S46X\desktop.ini
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\8HIJKLMN\desktop.ini
- C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\B4ABXWI2\desktop.ini
- C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\TCD6S46X\desktop.ini
- C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\L3KUA2D0\desktop.ini
Удаляет следующие файлы:
- %TEMP%\1.tmp
Самоперемещается:
- из <Полный путь к вирусу> в %TEMP%\2.tmp
Сетевая активность:
Подключается к:
- 'an####ongibson.net':80
TCP:
Запросы HTTP GET:
- an####ongibson.net/f/25
- an####ongibson.net/d/UJTaXGfZO8gTsDl3zXfKUGdL8IywL3xqcQTVMnA27Vg2Are2ikgFKrPmmNnHxwm9dBA%3d/
- an####ongibson.net/c/W9OJVCjbMchGsWglwWufWTFH5ICyLS0iJlbRMDkztlg2WrCyxEpVNLOpndWNplLgIU9EMgAGMD8frCESaDVpKdhD9%2birab%2bSYa6ruQeiQasg%2bKjIKP9USBpOyAMhvI4UlBIzsxnUfVoej%2fAio9kIY%2fS4B8jLXeDz48KHevtM6ehI9xGIOTDl/
- an####ongibson.net/k/25
UDP:
- DNS ASK an####ongibson.net
Другое:
Ищет следующие окна:
- ClassName: '(null)' WindowName: 'tKFx '
- ClassName: '(null)' WindowName: 'YNadQkK'
- ClassName: '(null)' WindowName: 'yOh'
- ClassName: '(null)' WindowName: 'MsLvoo HXnzZa'
- ClassName: '(null)' WindowName: 'gCe kn'
- ClassName: '(null)' WindowName: 'unccpkinb IBBJsEw'
- ClassName: '(null)' WindowName: 'zn FnGYqpU '
- ClassName: '(null)' WindowName: 'wzHa'
- ClassName: '(null)' WindowName: 'emgvslvd k'
- ClassName: '(null)' WindowName: 'zjsaovqp '
- ClassName: '(null)' WindowName: 'iytzkCtfnamX y ioooJ'
- ClassName: '(null)' WindowName: 'vrs'
- ClassName: '(null)' WindowName: 'wxtzktgkOzNqe ceXNi n'
- ClassName: '(null)' WindowName: 'qdLVjmDRmr'
- ClassName: '(null)' WindowName: ' X qekssu'
- ClassName: '(null)' WindowName: 'sq qlr '
- ClassName: '(null)' WindowName: 'bsWosto '
- ClassName: '(null)' WindowName: 'pfvE lhS'
- ClassName: '(null)' WindowName: 'dQbgjDbKv'
- ClassName: '(null)' WindowName: 'h Mhusy'
- ClassName: '(null)' WindowName: 'tAJuEENv'
- ClassName: '(null)' WindowName: 'gbfJ kjp'
- ClassName: '(null)' WindowName: 'vdkmdbvhq mwRDs'
- ClassName: '(null)' WindowName: 'n pCJ '
- ClassName: '(null)' WindowName: 'FyrWgWvq QpFqqd'
- ClassName: '(null)' WindowName: 'rxlxubldk'
- ClassName: '(null)' WindowName: 'Zq IWs'
- ClassName: '(null)' WindowName: 'Ig kbu a'
- ClassName: '(null)' WindowName: 'bXhorl ePT '
- ClassName: '(null)' WindowName: 'fuixBg fuxa'
- ClassName: '(null)' WindowName: 'PQUv'
- ClassName: '(null)' WindowName: 'qd Psp '
- ClassName: '(null)' WindowName: 'Da buT'
- ClassName: '(null)' WindowName: 'saxfr lvNolFzItRde VWk t'
- ClassName: '(null)' WindowName: 'byjgwwqc'
- ClassName: '(null)' WindowName: 's dYPmp T'
- ClassName: '(null)' WindowName: 'wgg'
- ClassName: '(null)' WindowName: ' wSchlWjn'
- ClassName: '(null)' WindowName: 'Funm'
- ClassName: '(null)' WindowName: 'ufP'
- ClassName: '(null)' WindowName: 'fIohnnyo'
- ClassName: '(null)' WindowName: 'H paC'
- ClassName: '(null)' WindowName: 'nmjspD ah'
- ClassName: '(null)' WindowName: 'u acd oneRw'
- ClassName: '(null)' WindowName: 'mDgqNqMzfl'
- ClassName: '(null)' WindowName: 'gdGdtdcnD xCcDafr'
- ClassName: '(null)' WindowName: 'aotWM'
- ClassName: '(null)' WindowName: 'BoDjWBo'
- ClassName: '(null)' WindowName: 'JT'
- ClassName: '(null)' WindowName: 'YyuZpdRKraFlnut'
- ClassName: '(null)' WindowName: ' E ogJGuv'
- ClassName: '(null)' WindowName: 'DLieKT '
- ClassName: '(null)' WindowName: 'wT EsdSc'
- ClassName: '(null)' WindowName: 'vcTEnpi jG'
- ClassName: '(null)' WindowName: 'P LbT'
- ClassName: '(null)' WindowName: 'jnp x PkluugiEzG Ch '
- ClassName: '(null)' WindowName: 'xGhedB'
