Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Vistadrv' = '%PROGRAM_FILES%\VistaDrive\vsdrv.exe'
Вредоносные функции:
Создает и запускает на исполнение:
- '%TEMP%\RarSFX2\VistaDrive.exe' /verysilent
- '%TEMP%\is-NGUR1.tmp\is-UJU6Q.tmp' /SL4 $300FC "%TEMP%\RarSFX2\VistaDrive.exe" 190131 62464 /verysilent
- '%PROGRAM_FILES%\VistaDrive\vsdrv.exe'
- '%TEMP%\RarSFX0\SoundVista.exe'
- '%TEMP%\RarSFX0\3in1.exe'
- '%TEMP%\RarSFX0\AeroVista.exe'
- '%TEMP%\RarSFX0\VistaDrive.exe'
Запускает на исполнение:
- '<SYSTEM32>\rundll32.exe' advpack.dll,LaunchINFSection Mycursor.inf, DefaultInstall,3
- '%WINDIR%\regedit.exe' /S SoundVista.reg
Изменения в файловой системе:
Создает следующие файлы:
- %PROGRAM_FILES%\VistaDrive\is-9QG08.tmp
- %PROGRAM_FILES%\VistaDrive\is-G9UK0.tmp
- %PROGRAM_FILES%\VistaDrive\is-RNU9S.tmp
- %PROGRAM_FILES%\VistaDrive\is-NMJ1Q.tmp
- %PROGRAM_FILES%\VistaDrive\is-43NO0.tmp
- %PROGRAM_FILES%\VistaDrive\is-GVLB5.tmp
- %PROGRAM_FILES%\VistaDrive\is-H7MLC.tmp
- %PROGRAM_FILES%\VistaDrive\is-SNHK0.tmp
- %PROGRAM_FILES%\VistaDrive\is-ES5QD.tmp
- %PROGRAM_FILES%\VistaDrive\is-9SLNK.tmp
- %PROGRAM_FILES%\VistaDrive\is-MMFTJ.tmp
- %PROGRAM_FILES%\VistaDrive\is-FBK1M.tmp
- %WINDIR%\Media\Windows Vista Shutdown.wav
- %WINDIR%\Media\Windows Vista Start.wav
- %WINDIR%\Media\Windows Vista Startup.wav
- %WINDIR%\Media\Windows Vista Restore.wav
- %WINDIR%\Media\Windows Vista Ringin.wav
- %WINDIR%\Media\Windows Vista Ringout.wav
- %PROGRAM_FILES%\VistaDrive\is-8EQQU.tmp
- %PROGRAM_FILES%\VistaDrive\is-FMFMR.tmp
- %PROGRAM_FILES%\VistaDrive\is-86ABK.tmp
- %PROGRAM_FILES%\VistaDrive\is-LQL6T.tmp
- %PROGRAM_FILES%\VistaDrive\is-1DOSU.tmp
- %PROGRAM_FILES%\VistaDrive\is-UPQTD.tmp
- %PROGRAM_FILES%\VistaDrive\is-JJLSL.tmp
- %WINDIR%\Cursors\Aero\SET9.tmp
- %WINDIR%\Cursors\Aero\SETA.tmp
- %WINDIR%\Cursors\Aero\SETB.tmp
- %WINDIR%\Cursors\Aero\SET6.tmp
- %WINDIR%\Cursors\Aero\SET7.tmp
- %WINDIR%\Cursors\Aero\SET8.tmp
- %WINDIR%\Cursors\Aero\SETF.tmp
- %WINDIR%\Cursors\Aero\SET10.tmp
- %WINDIR%\Cursors\Aero\SET11.tmp
- %WINDIR%\Cursors\Aero\SETC.tmp
- %WINDIR%\Cursors\Aero\SETD.tmp
- %WINDIR%\Cursors\Aero\SETE.tmp
- %PROGRAM_FILES%\VistaDrive\is-PN0QK.tmp
- %PROGRAM_FILES%\VistaDrive\is-HMIG1.tmp
- %PROGRAM_FILES%\VistaDrive\is-OD8FC.tmp
- %PROGRAM_FILES%\VistaDrive\is-EL5J5.tmp
- %PROGRAM_FILES%\VistaDrive\is-5BOS0.tmp
- %PROGRAM_FILES%\VistaDrive\is-58P1C.tmp
- %WINDIR%\Cursors\Aero\SET3.tmp
- %WINDIR%\Cursors\Aero\SET4.tmp
- %WINDIR%\Cursors\Aero\SET5.tmp
- %PROGRAM_FILES%\VistaDrive\is-PNIHB.tmp
- %PROGRAM_FILES%\VistaDrive\is-KKPLC.tmp
- %PROGRAM_FILES%\VistaDrive\unins000.dat
- %WINDIR%\Media\Windows Vista Ballon.wav
- %WINDIR%\Media\Windows Vista Battery Critical.wav
- %TEMP%\RarSFX1\aero_nwse.cur
- %TEMP%\RarSFX2\VistaDrive.exe
- %TEMP%\RarSFX1\aero_nesw.cur
- %TEMP%\RarSFX1\aero_ns.cur
- %TEMP%\RarSFX1\aero_prec.cur
- %WINDIR%\Media\Windows Vista Default.wav
- %WINDIR%\Media\Windows Vista Ding.wav
- %WINDIR%\Media\Windows Vista Battery Low.wav
- %TEMP%\RarSFX1\aero_pen.cur
- %WINDIR%\Media\Windows Vista Critical Stop.wav
- %TEMP%\RarSFX0\VistaDrive.exe
- %TEMP%\RarSFX0\VistaSound.reg
- %TEMP%\RarSFX1\aero_alt.cur
- %TEMP%\RarSFX0\3in1.exe
- %TEMP%\RarSFX0\AeroVista.exe
- %TEMP%\RarSFX0\SoundVista.exe
- %TEMP%\RarSFX1\aero_helpsel.cur
- %TEMP%\RarSFX1\aero_link.cur
- %TEMP%\RarSFX1\aero_move.cur
- %TEMP%\RarSFX1\aero_arrow.cur
- %TEMP%\RarSFX1\aero_busy.ani
- %TEMP%\RarSFX1\aero_ew.cur
- %WINDIR%\Media\Windows Vista Error.wav
- %WINDIR%\Media\Windows Vista Logon.wav
- %WINDIR%\Media\Windows Vista Menu Command.wav
- %WINDIR%\Media\Windows Vista Minimize.wav
- %TEMP%\RarSFX1\Mycursor.inf
- %WINDIR%\Media\Windows Vista Logoff.wav
- %WINDIR%\Media\Windows Vista Logon Sound.wav
- %WINDIR%\Media\Windows Vista Recycle.wav
- %TEMP%\is-EPM1U.tmp\_isetup\_RegDLL.tmp
- %TEMP%\is-EPM1U.tmp\_isetup\_shfoldr.dll
- %WINDIR%\Media\Windows Vista Notify.wav
- %WINDIR%\Media\Windows Vista Pop-up Blocked.wav
- %WINDIR%\Media\Windows Vista Print complete.wav
- %WINDIR%\Media\Windows Vista Feed Discovered.wav
- %TEMP%\RarSFX1\aero_up.cur
- %WINDIR%\Media\Windows Vista Hardware Fail.wav
- %TEMP%\RarSFX1\aero_select.cur
- %TEMP%\RarSFX1\aero_unavail.cur
- %WINDIR%\Media\Windows Vista Exclamation.wav
- %TEMP%\is-NGUR1.tmp\is-UJU6Q.tmp
- %WINDIR%\Media\Windows Vista Information Bar.wav
- %WINDIR%\Media\Windows Vista Logoff Sound.wav
- %WINDIR%\Media\Windows Vista Hardware Insert.wav
- %TEMP%\RarSFX1\aero_working.ani
- %WINDIR%\Media\Windows Vista Hardware Remove.wav
Удаляет следующие файлы:
- %TEMP%\RarSFX1\aero_nwse.cur
- %TEMP%\RarSFX1\aero_pen.cur
- %TEMP%\RarSFX1\aero_ns.cur
- %TEMP%\RarSFX1\aero_move.cur
- %TEMP%\RarSFX1\aero_nesw.cur
- %TEMP%\RarSFX1\aero_prec.cur
- %TEMP%\RarSFX1\aero_working.ani
- %TEMP%\RarSFX1\Mycursor.inf
- %TEMP%\RarSFX1\aero_up.cur
- %TEMP%\RarSFX1\aero_select.cur
- %TEMP%\RarSFX1\aero_unavail.cur
- %TEMP%\RarSFX1\aero_link.cur
- %TEMP%\is-EPM1U.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-NGUR1.tmp\is-UJU6Q.tmp
- %TEMP%\is-EPM1U.tmp\_isetup\_RegDLL.tmp
- %TEMP%\RarSFX0\3in1.exe
- %TEMP%\RarSFX0\AeroVista.exe
- %TEMP%\RarSFX2\VistaDrive.exe
- %TEMP%\RarSFX1\aero_ew.cur
- %TEMP%\RarSFX1\aero_helpsel.cur
- %TEMP%\RarSFX1\aero_busy.ani
- %TEMP%\RarSFX1\aero_alt.cur
- %TEMP%\RarSFX1\aero_arrow.cur
Перемещает следующие файлы:
- %WINDIR%\Cursors\Aero\SET3.tmp в %WINDIR%\Cursors\Aero\aero_arrow.cur
- %PROGRAM_FILES%\VistaDrive\is-KKPLC.tmp в %PROGRAM_FILES%\VistaDrive\vsdrv.exe
- %WINDIR%\Cursors\Aero\SET4.tmp в %WINDIR%\Cursors\Aero\aero_helpsel.cur
- %WINDIR%\Cursors\Aero\SET6.tmp в %WINDIR%\Cursors\Aero\aero_busy.ani
- %WINDIR%\Cursors\Aero\SET5.tmp в %WINDIR%\Cursors\Aero\aero_working.ani
- %PROGRAM_FILES%\VistaDrive\is-PN0QK.tmp в %PROGRAM_FILES%\VistaDrive\s75.ico
- %PROGRAM_FILES%\VistaDrive\is-58P1C.tmp в %PROGRAM_FILES%\VistaDrive\s67.ico
- %PROGRAM_FILES%\VistaDrive\is-HMIG1.tmp в %PROGRAM_FILES%\VistaDrive\s83.ico
- %PROGRAM_FILES%\VistaDrive\is-PNIHB.tmp в %PROGRAM_FILES%\VistaDrive\s99.ico
- %PROGRAM_FILES%\VistaDrive\is-OD8FC.tmp в %PROGRAM_FILES%\VistaDrive\s92.ico
- %WINDIR%\Cursors\Aero\SET7.tmp в %WINDIR%\Cursors\Aero\aero_select.cur
- %WINDIR%\Cursors\Aero\SETE.tmp в %WINDIR%\Cursors\Aero\aero_link.cur
- %WINDIR%\Cursors\Aero\SETD.tmp в %WINDIR%\Cursors\Aero\aero_move.cur
- %WINDIR%\Cursors\Aero\SETF.tmp в %WINDIR%\Cursors\Aero\aero_prec.cur
- %WINDIR%\Cursors\Aero\SET11.tmp в %WINDIR%\Cursors\Aero\aero_alt.cur
- %WINDIR%\Cursors\Aero\SET10.tmp в %WINDIR%\Cursors\Aero\aero_pen.cur
- %WINDIR%\Cursors\Aero\SET9.tmp в %WINDIR%\Cursors\Aero\aero_ns.cur
- %WINDIR%\Cursors\Aero\SET8.tmp в %WINDIR%\Cursors\Aero\aero_unavail.cur
- %WINDIR%\Cursors\Aero\SETA.tmp в %WINDIR%\Cursors\Aero\aero_ew.cur
- %WINDIR%\Cursors\Aero\SETC.tmp в %WINDIR%\Cursors\Aero\aero_nesw.cur
- %WINDIR%\Cursors\Aero\SETB.tmp в %WINDIR%\Cursors\Aero\aero_nwse.cur
- %PROGRAM_FILES%\VistaDrive\is-NMJ1Q.tmp в %PROGRAM_FILES%\VistaDrive\41.ico
- %PROGRAM_FILES%\VistaDrive\is-86ABK.tmp в %PROGRAM_FILES%\VistaDrive\33.ico
- %PROGRAM_FILES%\VistaDrive\is-43NO0.tmp в %PROGRAM_FILES%\VistaDrive\50.ico
- %PROGRAM_FILES%\VistaDrive\is-9QG08.tmp в %PROGRAM_FILES%\VistaDrive\67.ico
- %PROGRAM_FILES%\VistaDrive\is-GVLB5.tmp в %PROGRAM_FILES%\VistaDrive\58.ico
- %PROGRAM_FILES%\VistaDrive\is-1DOSU.tmp в %PROGRAM_FILES%\VistaDrive\00.ico
- %PROGRAM_FILES%\VistaDrive\is-LQL6T.tmp в %PROGRAM_FILES%\VistaDrive\unins000.exe
- %PROGRAM_FILES%\VistaDrive\is-UPQTD.tmp в %PROGRAM_FILES%\VistaDrive\08.ico
- %PROGRAM_FILES%\VistaDrive\is-FMFMR.tmp в %PROGRAM_FILES%\VistaDrive\25.ico
- %PROGRAM_FILES%\VistaDrive\is-8EQQU.tmp в %PROGRAM_FILES%\VistaDrive\16.ico
- %PROGRAM_FILES%\VistaDrive\is-G9UK0.tmp в %PROGRAM_FILES%\VistaDrive\75.ico
- %PROGRAM_FILES%\VistaDrive\is-ES5QD.tmp в %PROGRAM_FILES%\VistaDrive\s33.ico
- %PROGRAM_FILES%\VistaDrive\is-SNHK0.tmp в %PROGRAM_FILES%\VistaDrive\s25.ico
- %PROGRAM_FILES%\VistaDrive\is-JJLSL.tmp в %PROGRAM_FILES%\VistaDrive\s41.ico
- %PROGRAM_FILES%\VistaDrive\is-5BOS0.tmp в %PROGRAM_FILES%\VistaDrive\s58.ico
- %PROGRAM_FILES%\VistaDrive\is-EL5J5.tmp в %PROGRAM_FILES%\VistaDrive\s50.ico
- %PROGRAM_FILES%\VistaDrive\is-9SLNK.tmp в %PROGRAM_FILES%\VistaDrive\92.ico
- %PROGRAM_FILES%\VistaDrive\is-RNU9S.tmp в %PROGRAM_FILES%\VistaDrive\83.ico
- %PROGRAM_FILES%\VistaDrive\is-MMFTJ.tmp в %PROGRAM_FILES%\VistaDrive\99.ico
- %PROGRAM_FILES%\VistaDrive\is-H7MLC.tmp в %PROGRAM_FILES%\VistaDrive\s16.ico
- %PROGRAM_FILES%\VistaDrive\is-FBK1M.tmp в %PROGRAM_FILES%\VistaDrive\s08.ico
Другое:
Ищет следующие окна:
- ClassName: 'RegEdit_RegEdit' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'EDIT' WindowName: '(null)'
