Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'DNTV Remote' = '%PROGRAM_FILES%\DNTV Remote\WFWIZ.exe'
Вредоносные функции:
Создает и запускает на исполнение:
- '%PROGRAM_FILES%\DNTV Remote\WFWIZ.exe'
- '%TEMP%\pft3.tmp\setup.exe'
Запускает на исполнение:
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\pft3.tmp\ExecWebsiteDriver.bat""
Изменения в файловой системе:
Создает следующие файлы:
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\domain.txt
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\drivetable.txt
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SAM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\ComDb.Dat
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.BTR
- %APPDATA%\InstallShield Installation Information\{57F3D3A3-0D4F-43E3-9CB4-1260221EE499}\layoacb1.rra
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP15\drivetable.txt
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\$WinMgmt.CFG
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SYSTEM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SECURITY
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SOFTWARE
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_.DEFAULT
- %APPDATA%\InstallShield Installation Information\{57F3D3A3-0D4F-43E3-9CB4-1260221EE499}\setuaf12.rra
- %APPDATA%\InstallShield Installation Information\{57F3D3A3-0D4F-43E3-9CB4-1260221EE499}\setup.ini
- %APPDATA%\InstallShield Installation Information\{57F3D3A3-0D4F-43E3-9CB4-1260221EE499}\ISSeae47.rra
- %APPDATA%\InstallShield Installation Information\{57F3D3A3-0D4F-43E3-9CB4-1260221EE499}\setuaed4.rra
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\RestorePointSize
- %PROGRAM_FILES%\DNTV Remote\RTL2af9f.rra
- %PROGRAM_FILES%\DNTV Remote\WFWIafdd.rra
- %APPDATA%\InstallShield Installation Information\{57F3D3A3-0D4F-43E3-9CB4-1260221EE499}\_Setae09.rra
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING.VER
- %APPDATA%\InstallShield Installation Information\{57F3D3A3-0D4F-43E3-9CB4-1260221EE499}\dataace0.rra
- %APPDATA%\InstallShield Installation Information\{57F3D3A3-0D4F-43E3-9CB4-1260221EE499}\dataad0f.rra
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING2.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.DATA
- %APPDATA%\InstallShield Installation Information\{57F3D3A3-0D4F-43E3-9CB4-1260221EE499}\setuad8c.rra
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING1.MAP
- %TEMP%\pft3.tmp\setup.ini
- %TEMP%\pft3.tmp\setup.inx
- %TEMP%\pft3.tmp\RTL283XACCESS.dll
- %TEMP%\pft3.tmp\setup.exe
- %APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\c9622231-989e-452e-842a-a5f36d39ef2c
- %TEMP%\pft3.tmp\WFWIZ.exe
- %TEMP%\pft3.tmp\_setup.dll
- %TEMP%\pft3.tmp\layout.bin
- %TEMP%\pft3.tmp\pftw1.pkg
- %TEMP%\pft3.tmp\data1.cab
- %TEMP%\ext2.tmp
- %TEMP%\plf1.tmp
- %TEMP%\pft3.tmp\ExecWebsiteDriver.bat
- %TEMP%\pft3.tmp\ISSetup.dll
- %TEMP%\pft3.tmp\data1.hdr
- %TEMP%\pft3.tmp\data2.cab
- %TEMP%\{F9AF24DB-2918-435E-B2BF-C094C2C15CF9}\{57F3D3A3-0D4F-43E3-9CB4-1260221EE499}\isrt7833.rra
- %TEMP%\{F9AF24DB-2918-435E-B2BF-C094C2C15CF9}\{57F3D3A3-0D4F-43E3-9CB4-1260221EE499}\defa7891.rra
- %TEMP%\{F9AF24DB-2918-435E-B2BF-C094C2C15CF9}\{57F3D3A3-0D4F-43E3-9CB4-1260221EE499}\DIFx77b6.rra
- %TEMP%\{F9AF24DB-2918-435E-B2BF-C094C2C15CF9}\{57F3D3A3-0D4F-43E3-9CB4-1260221EE499}\Stri77f5.rra
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19
- %TEMP%\{F9AF24DB-2918-435E-B2BF-C094C2C15CF9}\{57F3D3A3-0D4F-43E3-9CB4-1260221EE499}\_IsR78c0.rra
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\rp.log
- %TEMP%\{F9AF24DB-2918-435E-B2BF-C094C2C15CF9}\{57F3D3A3-0D4F-43E3-9CB4-1260221EE499}\Font7787.rra
- %TEMP%\{F4187A57-43EA-450E-8FE4-6286B0FEA4A6}\setup.ini
- %TEMP%\{F4187A57-43EA-450E-8FE4-6286B0FEA4A6}\_Setup.dll
- %APPDATA%\Microsoft\Protect\S-1-5-21-2052111302-484763869-725345543-1003\Preferred
- %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\dbec76d660eea704ecb2f03a901d221e_23ef5514-3059-436f-a4a7-4cefaab20eb1
- %TEMP%\{F9AF24DB-2918-435E-B2BF-C094C2C15CF9}\core76fb.rra
- %TEMP%\{F9AF24DB-2918-435E-B2BF-C094C2C15CF9}\dotn7739.rra
- %TEMP%\{F9AF24DB-2918-435E-B2BF-C094C2C15CF9}\{57F3D3A3-0D4F-43E3-9CB4-1260221EE499}\setu7630.rra
- %TEMP%\{F9AF24DB-2918-435E-B2BF-C094C2C15CF9}\{57F3D3A3-0D4F-43E3-9CB4-1260221EE499}\lice76ad.rra
Удаляет следующие файлы:
- %TEMP%\pft3.tmp\pftw1.pkg
- %TEMP%\ext2.tmp
Перемещает следующие файлы:
- %APPDATA%\InstallShield Installation Information\{57F3D3A3-0D4F-43E3-9CB4-1260221EE499}\setuad8c.rra в %APPDATA%\InstallShield Installation Information\{57F3D3A3-0D4F-43E3-9CB4-1260221EE499}\setup.exe
- %APPDATA%\InstallShield Installation Information\{57F3D3A3-0D4F-43E3-9CB4-1260221EE499}\_Setae09.rra в %APPDATA%\InstallShield Installation Information\{57F3D3A3-0D4F-43E3-9CB4-1260221EE499}\_Setup.dll
- %APPDATA%\InstallShield Installation Information\{57F3D3A3-0D4F-43E3-9CB4-1260221EE499}\dataad0f.rra в %APPDATA%\InstallShield Installation Information\{57F3D3A3-0D4F-43E3-9CB4-1260221EE499}\data1.cab
- %APPDATA%\InstallShield Installation Information\{57F3D3A3-0D4F-43E3-9CB4-1260221EE499}\layoacb1.rra в %APPDATA%\InstallShield Installation Information\{57F3D3A3-0D4F-43E3-9CB4-1260221EE499}\layout.bin
- %APPDATA%\InstallShield Installation Information\{57F3D3A3-0D4F-43E3-9CB4-1260221EE499}\dataace0.rra в %APPDATA%\InstallShield Installation Information\{57F3D3A3-0D4F-43E3-9CB4-1260221EE499}\data1.hdr
- %PROGRAM_FILES%\DNTV Remote\RTL2af9f.rra в %PROGRAM_FILES%\DNTV Remote\RTL283XACCESS.dll
- %PROGRAM_FILES%\DNTV Remote\WFWIafdd.rra в %PROGRAM_FILES%\DNTV Remote\WFWIZ.exe
- %APPDATA%\InstallShield Installation Information\{57F3D3A3-0D4F-43E3-9CB4-1260221EE499}\setuaf12.rra в %APPDATA%\InstallShield Installation Information\{57F3D3A3-0D4F-43E3-9CB4-1260221EE499}\setup.ini
- %APPDATA%\InstallShield Installation Information\{57F3D3A3-0D4F-43E3-9CB4-1260221EE499}\ISSeae47.rra в %APPDATA%\InstallShield Installation Information\{57F3D3A3-0D4F-43E3-9CB4-1260221EE499}\ISSetup.dll
- %APPDATA%\InstallShield Installation Information\{57F3D3A3-0D4F-43E3-9CB4-1260221EE499}\setuaed4.rra в %APPDATA%\InstallShield Installation Information\{57F3D3A3-0D4F-43E3-9CB4-1260221EE499}\setup.inx
- %TEMP%\{F9AF24DB-2918-435E-B2BF-C094C2C15CF9}\dotn7739.rra в %TEMP%\{F9AF24DB-2918-435E-B2BF-C094C2C15CF9}\dotnetinstaller.exe
- %TEMP%\{F9AF24DB-2918-435E-B2BF-C094C2C15CF9}\{57F3D3A3-0D4F-43E3-9CB4-1260221EE499}\Font7787.rra в %TEMP%\{F9AF24DB-2918-435E-B2BF-C094C2C15CF9}\{57F3D3A3-0D4F-43E3-9CB4-1260221EE499}\FontData.ini
- %TEMP%\{F9AF24DB-2918-435E-B2BF-C094C2C15CF9}\core76fb.rra в %TEMP%\{F9AF24DB-2918-435E-B2BF-C094C2C15CF9}\corecomp.ini
- %TEMP%\{F9AF24DB-2918-435E-B2BF-C094C2C15CF9}\{57F3D3A3-0D4F-43E3-9CB4-1260221EE499}\setu7630.rra в %TEMP%\{F9AF24DB-2918-435E-B2BF-C094C2C15CF9}\{57F3D3A3-0D4F-43E3-9CB4-1260221EE499}\setup.inx
- %TEMP%\{F9AF24DB-2918-435E-B2BF-C094C2C15CF9}\{57F3D3A3-0D4F-43E3-9CB4-1260221EE499}\lice76ad.rra в %TEMP%\{F9AF24DB-2918-435E-B2BF-C094C2C15CF9}\{57F3D3A3-0D4F-43E3-9CB4-1260221EE499}\license.rtf
- %TEMP%\{F9AF24DB-2918-435E-B2BF-C094C2C15CF9}\{57F3D3A3-0D4F-43E3-9CB4-1260221EE499}\defa7891.rra в %TEMP%\{F9AF24DB-2918-435E-B2BF-C094C2C15CF9}\{57F3D3A3-0D4F-43E3-9CB4-1260221EE499}\default.pal
- %TEMP%\{F9AF24DB-2918-435E-B2BF-C094C2C15CF9}\{57F3D3A3-0D4F-43E3-9CB4-1260221EE499}\_IsR78c0.rra в %TEMP%\{F9AF24DB-2918-435E-B2BF-C094C2C15CF9}\{57F3D3A3-0D4F-43E3-9CB4-1260221EE499}\_IsRes.dll
- %TEMP%\{F9AF24DB-2918-435E-B2BF-C094C2C15CF9}\{57F3D3A3-0D4F-43E3-9CB4-1260221EE499}\isrt7833.rra в %TEMP%\{F9AF24DB-2918-435E-B2BF-C094C2C15CF9}\{57F3D3A3-0D4F-43E3-9CB4-1260221EE499}\isrt.dll
- %TEMP%\{F9AF24DB-2918-435E-B2BF-C094C2C15CF9}\{57F3D3A3-0D4F-43E3-9CB4-1260221EE499}\DIFx77b6.rra в %TEMP%\{F9AF24DB-2918-435E-B2BF-C094C2C15CF9}\{57F3D3A3-0D4F-43E3-9CB4-1260221EE499}\DIFxData.ini
- %TEMP%\{F9AF24DB-2918-435E-B2BF-C094C2C15CF9}\{57F3D3A3-0D4F-43E3-9CB4-1260221EE499}\Stri77f5.rra в %TEMP%\{F9AF24DB-2918-435E-B2BF-C094C2C15CF9}\{57F3D3A3-0D4F-43E3-9CB4-1260221EE499}\StringTable-0009-English.ips
Другое:
Ищет следующие окна:
- ClassName: 'Alec@Video(^0^)' WindowName: '(null)'
- ClassName: 'Alec@PVRMCE(^0^)' WindowName: '(null)'
- ClassName: '(null)' WindowName: 'CyberLink PowerDVD'
- ClassName: '(null)' WindowName: 'WinFast FM'
- ClassName: '(null)' WindowName: 'ArcSoft TotalMedia'
- ClassName: 'ARCSOFT_MEDIA_CENTER_FRAMEWNDCLASS' WindowName: 'ArcSoft TotalMedia'
- ClassName: 'Alec@DVBT(^_^)' WindowName: '(null)'
- ClassName: 'ARCSOFT_MEDIA_CENTER_FRAMEWNDCLASS' WindowName: '(null)'
- ClassName: 'Indicator' WindowName: '(null)'
- ClassName: '(null)' WindowName: 'Leadtek WinFastDVD'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'OEM Schedule Reminder' WindowName: '(null)'
- ClassName: 'CyberLink Video Window Class' WindowName: '(null)'
- ClassName: '(null)' WindowName: 'Power DVD'
- ClassName: '(null)' WindowName: 'InterVideo WinDVD Platinum'
- ClassName: '(null)' WindowName: 'InterVideo WinDVD 5'
