Program.CCProxy.107

Техническая информация

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\net1.exe' stop "Ibmasn.exe" /y
'<SYSTEM32>\net.exe' stop "Ibmasn.exe" /y
'<SYSTEM32>\net1.exe' stop "Ibmavsp.exe" /y
'<SYSTEM32>\net1.exe' /pid=3636
'<SYSTEM32>\net.exe' stop "Ibmavsp.exe" /y
'<SYSTEM32>\net1.exe' stop "Iamserv.exe" /y
'<SYSTEM32>\net1.exe' stop "IAMAPP" /y
'<SYSTEM32>\net.exe' stop "IAMAPP" /y
'<SYSTEM32>\net.exe' stop "Iamapp.exe" /y
'<SYSTEM32>\net.exe' stop "Iamserv.exe" /y
'<SYSTEM32>\net1.exe' stop "Iamapp.exe" /y
'<SYSTEM32>\net1.exe' stop "ICMON" /y
'<SYSTEM32>\net.exe' stop "ICMON" /y
'<SYSTEM32>\net.exe' stop "Icmon.exe" /y
'<SYSTEM32>\net.exe' stop "Icsupp95.exe" /y
'<SYSTEM32>\net1.exe' stop "Icmon.exe" /y
'<SYSTEM32>\net1.exe' /pid=3764
'<SYSTEM32>\net.exe' stop "Icload95.exe" /y
'<SYSTEM32>\net1.exe' stop "Icload95.exe" /y
'<SYSTEM32>\net1.exe' /pid=3700
'<SYSTEM32>\net.exe' stop "Icloadnt.exe" /y
'<SYSTEM32>\net1.exe' stop "Icloadnt.exe" /y
'<SYSTEM32>\net1.exe' stop "GNAT Box Lite" /y
'<SYSTEM32>\net1.exe' /pid=2924
'<SYSTEM32>\net1.exe' /pid=2844
'<SYSTEM32>\net.exe' stop "Fprot.exe" /y
'<SYSTEM32>\net1.exe' /pid=3064
'<SYSTEM32>\net1.exe' stop "Fprot.exe" /y
'<SYSTEM32>\net1.exe' stop "PCCIOMON" /y
'<SYSTEM32>\net1.exe' stop "Pc firewall" /y
'<SYSTEM32>\net.exe' stop "Pc firewall" /y
'<SYSTEM32>\net.exe' stop "PC Viper" /y
'<SYSTEM32>\net.exe' stop "PCCIOMON" /y
'<SYSTEM32>\net1.exe' stop "PC Viper" /y
'<SYSTEM32>\net1.exe' stop "FP-WIN" /y
'<SYSTEM32>\net.exe' stop "FP-WIN" /y
'<SYSTEM32>\net.exe' stop "F-Stopw.exe" /y
'<SYSTEM32>\net.exe' stop "GNAT Box Lite" /y
'<SYSTEM32>\net1.exe' stop "F-Stopw.exe" /y
'<SYSTEM32>\net1.exe' stop "F-Prot95.exe" /y
'<SYSTEM32>\net1.exe' stop "F-Prot.exe" /y
'<SYSTEM32>\net.exe' stop "F-Prot.exe" /y
'<SYSTEM32>\net.exe' stop "F-PROT95" /y
'<SYSTEM32>\net.exe' stop "F-Prot95.exe" /y
'<SYSTEM32>\net1.exe' stop "F-PROT95" /y
'<SYSTEM32>\net1.exe' /pid=2644
'<SYSTEM32>\net.exe' stop "PCCMAIN" /y
'<SYSTEM32>\net1.exe' stop "PCCWIN98" /y
'<SYSTEM32>\net1.exe' /pid=2480
'<SYSTEM32>\net.exe' stop "PCCWIN98" /y
'<SYSTEM32>\net1.exe' stop "PCCMAIN" /y
'<SYSTEM32>\net.exe' stop "Pavsched.exe" /y
'<SYSTEM32>\net1.exe' /pid=3996
'<SYSTEM32>\net1.exe' stop "Pavsched.exe" /y
'<SYSTEM32>\net1.exe' /pid=1484
'<SYSTEM32>\net1.exe' stop "Pavw.exe" /y
'<SYSTEM32>\net1.exe' stop "PGP Gauntlet" /y
'<SYSTEM32>\net.exe' stop "PGP Gauntlet" /y
'<SYSTEM32>\net1.exe' /pid=3128
'<SYSTEM32>\net.exe' stop "POP3TRAP" /y
'<SYSTEM32>\net1.exe' stop "POP3TRAP" /y
'<SYSTEM32>\net1.exe' /pid=2992
'<SYSTEM32>\net.exe' stop "Pccwin98.exe" /y
'<SYSTEM32>\net1.exe' stop "Pccwin98.exe" /y
'<SYSTEM32>\net.exe' stop "Pcfwallicon.exe" /y
'<SYSTEM32>\net1.exe' stop "Persfw.exe" /y
'<SYSTEM32>\net1.exe' stop "Pcfwallicon.exe" /y
'<SYSTEM32>\net.exe' stop "Pavcl.exe" /y
'<SYSTEM32>\net1.exe' stop "Internet Alert 99" /y
'<SYSTEM32>\net.exe' stop "Internet Alert 99" /y
'<SYSTEM32>\net.exe' stop "IOMON98" /y
'<SYSTEM32>\net.exe' stop "Iomon98.exe" /y
'<SYSTEM32>\net1.exe' stop "IOMON98" /y
'<SYSTEM32>\net1.exe' stop "Iface.exe" /y
'<SYSTEM32>\net1.exe' /pid=3976
'<SYSTEM32>\net1.exe' stop "Icsupp95.exe" /y
'<SYSTEM32>\net.exe' stop "Icsuppnt.exe" /y
'<SYSTEM32>\net.exe' stop "Iface.exe" /y
'<SYSTEM32>\net1.exe' stop "Icsuppnt.exe" /y
'<SYSTEM32>\net1.exe' stop "Padmin.exe" /y
'<SYSTEM32>\net1.exe' stop "Outpost.exe" /y
'<SYSTEM32>\net.exe' stop "Padmin.exe" /y
'<SYSTEM32>\net1.exe' stop "Pavcl.exe" /y
'<SYSTEM32>\net1.exe' /pid=3912
'<SYSTEM32>\net.exe' stop "Outpost.exe" /y
'<SYSTEM32>\net.exe' stop "Jedi.exe" /y
'<SYSTEM32>\net1.exe' stop "Iomon98.exe" /y
'<SYSTEM32>\net1.exe' stop "Jedi.exe" /y
'<SYSTEM32>\net1.exe' stop "Nvc95.exe" /y
'<SYSTEM32>\net.exe' stop "NVC95" /y
'<SYSTEM32>\net1.exe' stop "Nupgrade.exe" /y
'<SYSTEM32>\net1.exe' stop "LUCOMSERVER" /y
'<SYSTEM32>\net.exe' stop "LUCOMSERVER" /y
'<SYSTEM32>\net.exe' stop "MCAFEE" /y
'<SYSTEM32>\net.exe' stop "McAfee Firewall" /y
'<SYSTEM32>\net1.exe' stop "MCAFEE" /y
'<SYSTEM32>\net1.exe' stop "Luall.exe" /y
'<SYSTEM32>\net1.exe' stop "Lookout.exe" /y
'<SYSTEM32>\net.exe' stop "Lookout.exe" /y
'<SYSTEM32>\net.exe' stop "LUALL" /y
'<SYSTEM32>\net.exe' stop "Luall.exe" /y
'<SYSTEM32>\net1.exe' stop "LUALL" /y
'<SYSTEM32>\net.exe' stop "N32scanw.exe" /y
'<SYSTEM32>\net1.exe' stop "Mpftray.exe" /y
'<SYSTEM32>\net1.exe' stop "N32scanw.exe" /y
'<SYSTEM32>\net1.exe' stop "NAVAPSVC" /y
'<SYSTEM32>\net.exe' stop "NAVAPSVC" /y
'<SYSTEM32>\net.exe' stop "Mpftray.exe" /y
'<SYSTEM32>\net.exe' stop "McAfee Internet Guard Dog Pro" /y
'<SYSTEM32>\net1.exe' stop "McAfee Firewall" /y
'<SYSTEM32>\net1.exe' stop "McAfee Internet Guard Dog Pro" /y
'<SYSTEM32>\net1.exe' stop "Moolive.exe" /y
'<SYSTEM32>\net.exe' stop "Moolive.exe" /y
'<SYSTEM32>\net1.exe' stop "Look'n'Stop Lite" /y
'<SYSTEM32>\net.exe' stop "Esafe.exe" /y
'<SYSTEM32>\net1.exe' stop "eSafe Protect Desktop" /y
'<SYSTEM32>\net1.exe' stop "Esafe.exe" /y
'<SYSTEM32>\net1.exe' stop "Espwatch.exe" /y
'<SYSTEM32>\net.exe' stop "Espwatch.exe" /y
'<SYSTEM32>\net.exe' stop "eSafe Protect Desktop" /y
'<SYSTEM32>\net.exe' stop "Alerter" /y
'<SYSTEM32>\cmd.exe' /c ""<SYSTEM32>\spool\eb.bat" "
'<SYSTEM32>\net1.exe' stop "Alerter" /y
'<SYSTEM32>\net1.exe' stop "Ecengine.exe" /y
'<SYSTEM32>\net.exe' stop "Ecengine.exe" /y
'<SYSTEM32>\net1.exe' stop "Rav.exe" /y
'<SYSTEM32>\net.exe' stop "Rav.exe" /y
'<SYSTEM32>\net.exe' stop "F-STOPW" /y
'<SYSTEM32>\net.exe' stop "Look'n'Stop Lite" /y
'<SYSTEM32>\net1.exe' stop "F-STOPW" /y
'<SYSTEM32>\net1.exe' stop "Findviru.exe" /y
'<SYSTEM32>\net1.exe' stop "eTrust EZ Firewall" /y
'<SYSTEM32>\net.exe' stop "eTrust EZ Firewall" /y
'<SYSTEM32>\net.exe' stop "F-Agnt95.exe" /y
'<SYSTEM32>\net.exe' stop "Findviru.exe" /y
'<SYSTEM32>\net1.exe' stop "F-Agnt95.exe" /y
'<SYSTEM32>\net.exe' stop "Nmain.exe" /y
'<SYSTEM32>\net1.exe' stop "NMAIN" /y
'<SYSTEM32>\net1.exe' stop "Nmain.exe" /y
'<SYSTEM32>\net1.exe' stop "Norman Personal Firewall" /y
'<SYSTEM32>\net.exe' stop "Norman Personal Firewall" /y
'<SYSTEM32>\net.exe' stop "NMAIN" /y
'<SYSTEM32>\net.exe' stop "NISUM" /y
'<SYSTEM32>\net1.exe' stop "NISSERV" /y
'<SYSTEM32>\net1.exe' stop "NISUM" /y
'<SYSTEM32>\net1.exe' stop "Nisum.exe" /y
'<SYSTEM32>\net.exe' stop "Nisum.exe" /y
'<SYSTEM32>\net1.exe' stop "Norton Internet Security" /y
'<SYSTEM32>\net.exe' stop "Norton Internet Security" /y
'<SYSTEM32>\net.exe' stop "Norton Personal Firewall 2001" /y
'<SYSTEM32>\net.exe' stop "Nupgrade.exe" /y
'<SYSTEM32>\net1.exe' stop "Norton Personal Firewall 2001" /y
'<SYSTEM32>\net1.exe' stop "Norton AntiVirus Server" /y
'<SYSTEM32>\net1.exe' stop "Normist.exe" /y
'<SYSTEM32>\net.exe' stop "Normist.exe" /y
'<SYSTEM32>\net.exe' stop "NORTON" /y
'<SYSTEM32>\net.exe' stop "Norton AntiVirus Server" /y
'<SYSTEM32>\net1.exe' stop "NORTON" /y
'<SYSTEM32>\net.exe' stop "NISSERV" /y
'<SYSTEM32>\net1.exe' stop "Navlu32.exe" /y
'<SYSTEM32>\net.exe' stop "Navlu32.exe" /y
'<SYSTEM32>\net.exe' stop "Navnt.exe" /y
'<SYSTEM32>\net.exe' stop "NAVRUNR" /y
'<SYSTEM32>\net1.exe' stop "Navnt.exe" /y
'<SYSTEM32>\net1.exe' stop "NAVLU32" /y
'<SYSTEM32>\net1.exe' stop "NAVAPW32" /y
'<SYSTEM32>\net.exe' stop "NAVAPW32" /y
'<SYSTEM32>\net.exe' stop "Navapw32.exe" /y
'<SYSTEM32>\net.exe' stop "NAVLU32" /y
'<SYSTEM32>\net1.exe' stop "Navapw32.exe" /y
'<SYSTEM32>\net.exe' stop "Navwnt.exe" /y
'<SYSTEM32>\net1.exe' stop "NAVWNT" /y
'<SYSTEM32>\net1.exe' stop "Navwnt.exe" /y
'<SYSTEM32>\net1.exe' stop "NeoWatch" /y
'<SYSTEM32>\net.exe' stop "NeoWatch" /y
'<SYSTEM32>\net.exe' stop "NAVWNT" /y
'<SYSTEM32>\net.exe' stop "NAVW32" /y
'<SYSTEM32>\net1.exe' stop "NAVRUNR" /y
'<SYSTEM32>\net1.exe' stop "NAVW32" /y
'<SYSTEM32>\net1.exe' stop "Navw32.exe" /y
'<SYSTEM32>\net.exe' stop "Navw32.exe" /y

Внедряет код в

следующие системные процессы:

<SYSTEM32>\net1.exe

Изменения в файловой системе:

Создает следующие файлы:

<SYSTEM32>\spool\ACPIFAN.DLL
<SYSTEM32>\spool\web\_acclist2.htm
<SYSTEM32>\spool\web\settings.htm
<SYSTEM32>\spool\ACPILid.DLL
<SYSTEM32>\spool\sc.exe
<SYSTEM32>\spool\inetsrv.exe
<SYSTEM32>\spool\eb.bat
<SYSTEM32>\spool\web\log.htm
<SYSTEM32>\spool\web\acclist.htm
<SYSTEM32>\spool\web\accheader.htm
<SYSTEM32>\spool\web\accadd.htm
<SYSTEM32>\spool\web\acclist2.htm
<SYSTEM32>\spool\web\list.htm
<SYSTEM32>\spool\web\index.html
<SYSTEM32>\spool\web\account.htm

Присваивает атрибут 'скрытый' для следующих файлов:

<SYSTEM32>\spool\ACPIFAN.DLL
<SYSTEM32>\spool\web\_acclist2.htm
<SYSTEM32>\spool\web\settings.htm
<SYSTEM32>\spool\ACPILid.DLL
<SYSTEM32>\spool\sc.exe
<SYSTEM32>\spool\inetsrv.exe
<SYSTEM32>\spool\eb.bat
<SYSTEM32>\spool\web\log.htm
<SYSTEM32>\spool\web\acclist.htm
<SYSTEM32>\spool\web\accheader.htm
<SYSTEM32>\spool\web\accadd.htm
<SYSTEM32>\spool\web\acclist2.htm
<SYSTEM32>\spool\web\list.htm
<SYSTEM32>\spool\web\index.html
<SYSTEM32>\spool\web\account.htm

Другое:

Ищет следующие окна:

ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'EDIT' WindowName: '(null)'

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней