Техническая информация
Для обеспечения автозапуска и распространения:
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Distributvq] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- '<SYSTEM32>\wwqiwy.exe'
Запускает на исполнение:
- '<SYSTEM32>\svchost.exe'
Внедряет код в
следующие системные процессы:
- <SYSTEM32>\svchost.exe
Изменения в файловой системе:
Создает следующие файлы:
- %WINDIR%\inf\lpk.dll
- %WINDIR%\Help\Tours\mmTour\lpk.dll
- %WINDIR%\lpk.dll
- %WINDIR%\Installer\$PatchCache$\Managed\62287FAB00234BD4EB33D429A2978904\3.0.6920\lpk.dll
- %WINDIR%\Microsoft.NET\Framework\lpk.dll
- %WINDIR%\WinSxS\MSIL_Microsoft.Workflow.Compiler_31bf3856ad364e35_4.0.0.0_x-ww_97359ba5\lpk.dll
- %WINDIR%\Installer\{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}\lpk.dll
- %WINDIR%\assembly\NativeImages_v4.0.30319_32\dfsvc\b9b6069e6da06eb57e89cc544397f735\lpk.dll
- %WINDIR%\assembly\NativeImages_v2.0.50727_32\PresentationFontCac#\9469981a17c01dd154c540127e678b35\lpk.dll
- %WINDIR%\assembly\NativeImages_v2.0.50727_32\MSBuild\87c84ffaaad81d8d106a9aa9d68b5926\lpk.dll
- %WINDIR%\assembly\NativeImages_v2.0.50727_32\dfsvc\a2865dcec9c5d3cc9c55f026cbad6fcc\lpk.dll
- %WINDIR%\assembly\NativeImages_v2.0.50727_32\ServiceModelReg\6781b87c8d3b55e6120b1e86bea6e040\lpk.dll
- %WINDIR%\assembly\NativeImages_v4.0.30319_32\ComSvcConfig\51819c709096229ee187a7feee395d9f\lpk.dll
- %WINDIR%\assembly\NativeImages_v2.0.50727_32\WsatConfig\7d2a3adbdcb675f872eb2dbf21f73596\lpk.dll
- %WINDIR%\assembly\NativeImages_v2.0.50727_32\SMSvcHost\b9c1a29e684bc02e49226ff1e9eec253\lpk.dll
- %WINDIR%\Microsoft.NET\Framework\v1.1.4322\lpk.dll
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\WPF\lpk.dll
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\lpk.dll
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\lpk.dll
- %WINDIR%\Microsoft.NET\lpk.dll
- %WINDIR%\pchealth\helpctr\binaries\lpk.dll
- %WINDIR%\mui\lpk.dll
- %WINDIR%\msagent\lpk.dll
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\lpk.dll
- %WINDIR%\Microsoft.NET\Framework\v3.0\Windows Workflow Foundation\lpk.dll
- %WINDIR%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\lpk.dll
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\lpk.dll
- %WINDIR%\Microsoft.NET\Framework\v3.0\WPF\lpk.dll
- %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\lpk.dll
- %WINDIR%\Microsoft.NET\Framework\v3.5\lpk.dll
- %WINDIR%\Microsoft.NET\Framework\v3.0\WPF\XamlViewer\lpk.dll
- %WINDIR%\assembly\NativeImages_v2.0.50727_32\ComSvcConfig\19b50dd470540911fc5cc65331a769e4\lpk.dll
- %PROGRAM_FILES%\Internet Explorer\Connection Wizard\lpk.dll
- %PROGRAM_FILES%\FireFox\uninstall\lpk.dll
- %PROGRAM_FILES%\FireFox\lpk.dll
- %PROGRAM_FILES%\Internet Explorer\lpk.dll
- %PROGRAM_FILES%\MSN\MSNCoreFiles\Install\MSN9Components\lpk.dll
- %PROGRAM_FILES%\Movie Maker\lpk.dll
- %PROGRAM_FILES%\Messenger\lpk.dll
- %CommonProgramFiles%\Microsoft Shared\Speech\lpk.dll
- C:\RCX1.tmp
- <SYSTEM32>\hra33.dll
- <SYSTEM32>\wwqiwy.exe
- %CommonProgramFiles%\Microsoft Shared\MSInfo\lpk.dll
- %CommonProgramFiles%\Microsoft Shared\DW\lpk.dll
- C:\Far2\lpk.dll
- %PROGRAM_FILES%\MSN\MSNCoreFiles\Install\lpk.dll
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP15\lpk.dll
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\lpk.dll
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\lpk.dll
- %WINDIR%\$NtUninstallKB942288-v3$\lpk.dll
- %WINDIR%\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\lpk.dll
- %WINDIR%\$NtUninstallWIC$\spuninst\lpk.dll
- %WINDIR%\$NtUninstallKB942288-v3$\spuninst\lpk.dll
- <Служебный элемент>
- %PROGRAM_FILES%\Outlook Express\lpk.dll
- %PROGRAM_FILES%\NetMeeting\lpk.dll
- %PROGRAM_FILES%\MSN Gaming Zone\Windows\lpk.dll
- %PROGRAM_FILES%\Windows Media Player\lpk.dll
- %PROGRAM_FILES%\Windows NT\Pinball\lpk.dll
- %PROGRAM_FILES%\Windows NT\lpk.dll
- %PROGRAM_FILES%\Windows NT\Accessories\lpk.dll
Присваивает атрибут 'скрытый' для следующих файлов:
- %WINDIR%\Installer\$PatchCache$\Managed\62287FAB00234BD4EB33D429A2978904\3.0.6920\lpk.dll
- %WINDIR%\inf\lpk.dll
- %WINDIR%\Help\Tours\mmTour\lpk.dll
- %WINDIR%\Installer\{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}\lpk.dll
- %WINDIR%\Microsoft.NET\Framework\v1.1.4322\lpk.dll
- %WINDIR%\Microsoft.NET\Framework\lpk.dll
- %WINDIR%\WinSxS\MSIL_Microsoft.Workflow.Compiler_31bf3856ad364e35_4.0.0.0_x-ww_97359ba5\lpk.dll
- %WINDIR%\assembly\NativeImages_v2.0.50727_32\SMSvcHost\b9c1a29e684bc02e49226ff1e9eec253\lpk.dll
- %WINDIR%\assembly\NativeImages_v2.0.50727_32\ServiceModelReg\6781b87c8d3b55e6120b1e86bea6e040\lpk.dll
- %WINDIR%\assembly\NativeImages_v2.0.50727_32\PresentationFontCac#\9469981a17c01dd154c540127e678b35\lpk.dll
- %WINDIR%\assembly\NativeImages_v2.0.50727_32\WsatConfig\7d2a3adbdcb675f872eb2dbf21f73596\lpk.dll
- %WINDIR%\lpk.dll
- %WINDIR%\assembly\NativeImages_v4.0.30319_32\dfsvc\b9b6069e6da06eb57e89cc544397f735\lpk.dll
- %WINDIR%\assembly\NativeImages_v4.0.30319_32\ComSvcConfig\51819c709096229ee187a7feee395d9f\lpk.dll
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\lpk.dll
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\WPF\lpk.dll
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\lpk.dll
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\lpk.dll
- %WINDIR%\Microsoft.NET\lpk.dll
- %WINDIR%\pchealth\helpctr\binaries\lpk.dll
- %WINDIR%\mui\lpk.dll
- %WINDIR%\msagent\lpk.dll
- %WINDIR%\Microsoft.NET\Framework\v3.0\WPF\lpk.dll
- %WINDIR%\Microsoft.NET\Framework\v3.0\Windows Workflow Foundation\lpk.dll
- %WINDIR%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\lpk.dll
- %WINDIR%\Microsoft.NET\Framework\v3.0\WPF\XamlViewer\lpk.dll
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\lpk.dll
- %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\lpk.dll
- %WINDIR%\Microsoft.NET\Framework\v3.5\lpk.dll
- %WINDIR%\assembly\NativeImages_v2.0.50727_32\MSBuild\87c84ffaaad81d8d106a9aa9d68b5926\lpk.dll
- %PROGRAM_FILES%\Movie Maker\lpk.dll
- %PROGRAM_FILES%\Messenger\lpk.dll
- %PROGRAM_FILES%\Internet Explorer\lpk.dll
- %PROGRAM_FILES%\MSN\MSNCoreFiles\Install\MSN9Components\lpk.dll
- %PROGRAM_FILES%\NetMeeting\lpk.dll
- %PROGRAM_FILES%\MSN Gaming Zone\Windows\lpk.dll
- %PROGRAM_FILES%\MSN\MSNCoreFiles\Install\lpk.dll
- %CommonProgramFiles%\Microsoft Shared\MSInfo\lpk.dll
- %CommonProgramFiles%\Microsoft Shared\DW\lpk.dll
- C:\Far2\lpk.dll
- %CommonProgramFiles%\Microsoft Shared\Speech\lpk.dll
- %PROGRAM_FILES%\Internet Explorer\Connection Wizard\lpk.dll
- %PROGRAM_FILES%\FireFox\uninstall\lpk.dll
- %PROGRAM_FILES%\FireFox\lpk.dll
- %PROGRAM_FILES%\Outlook Express\lpk.dll
- %WINDIR%\$NtUninstallKB942288-v3$\spuninst\lpk.dll
- %WINDIR%\$NtUninstallKB942288-v3$\lpk.dll
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP15\lpk.dll
- %WINDIR%\$NtUninstallWIC$\spuninst\lpk.dll
- %WINDIR%\assembly\NativeImages_v2.0.50727_32\dfsvc\a2865dcec9c5d3cc9c55f026cbad6fcc\lpk.dll
- %WINDIR%\assembly\NativeImages_v2.0.50727_32\ComSvcConfig\19b50dd470540911fc5cc65331a769e4\lpk.dll
- %WINDIR%\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\lpk.dll
- %PROGRAM_FILES%\Windows NT\lpk.dll
- %PROGRAM_FILES%\Windows NT\Accessories\lpk.dll
- %PROGRAM_FILES%\Windows Media Player\lpk.dll
- %PROGRAM_FILES%\Windows NT\Pinball\lpk.dll
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP14\lpk.dll
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP12\lpk.dll
- <Служебный элемент>
Удаляет следующие файлы:
- <SYSTEM32>\hra33.dll
Перемещает следующие файлы:
- C:\RCX1.tmp в <SYSTEM32>\hra33.dll
Самоперемещается:
- из <Полный путь к вирусу> в %TEMP%\SOFTWARE.LOG
Сетевая активность:
Подключается к:
- 'im###s.my03.com':6688
UDP:
- DNS ASK im###s.my03.com
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
