Техническая информация
Вредоносные функции:
Создает и запускает на исполнение:
- '%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\IKernel.exe' -RegServer
- '%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\IKernel.exe' 32\IKernel.exe -Embedding
- '%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\IKernel.exe' /REGSERVER
- '%TEMP%\virus.exe'
- '%TEMP%\UGA505_full_E.exe'
- '%TEMP%\pft4.tmp\Data1\Setup.exe'
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\{8af3e926-ed59-11d4-a44b-0000e86d2305}\U32ie7cb.rra
- %TEMP%\{8af3e926-ed59-11d4-a44b-0000e86d2305}\setue75d.rra
- %TEMP%\{8af3e926-ed59-11d4-a44b-0000e86d2305}\IS32e809.rra
- %TEMP%\{8af3e926-ed59-11d4-a44b-0000e86d2305}\u32se7ea.rra
- %CommonProgramFiles%\InstallShield\IScript\iscrddd8.rra
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\ctord656.rra
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\cored617.rra
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\iused9d0.rra
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\objed925.rra
- %TEMP%\{8af3e926-ed59-11d4-a44b-0000e86d2305}\defaea7a.rra
- %TEMP%\{8af3e926-ed59-11d4-a44b-0000e86d2305}\isrtea1c.rra
- %WINDIR%\Noslip\Nbupf3e0.rra
- %TEMP%\{8af3e926-ed59-11d4-a44b-0000e86d2305}\_IsReae7.rra
- %TEMP%\{8af3e926-ed59-11d4-a44b-0000e86d2305}\value99f.rra
- %TEMP%\{8af3e926-ed59-11d4-a44b-0000e86d2305}\nbupe857.rra
- %TEMP%\{8af3e926-ed59-11d4-a44b-0000e86d2305}\Inste828.rra
- %TEMP%\{8af3e926-ed59-11d4-a44b-0000e86d2305}\Welce8a5.rra
- %TEMP%\{8af3e926-ed59-11d4-a44b-0000e86d2305}\_IsUe876.rra
- %TEMP%\pft4.tmp\Data1\data1.cab
- %TEMP%\pft4.tmp\Data1\setup.inx
- %TEMP%\pft4.tmp\Data1\data2.cab
- %TEMP%\pft4.tmp\Data1\data1.hdr
- %TEMP%\pft4.tmp\pftw1.pkg
- %TEMP%\UGA505_full_E.exe
- %TEMP%\virus.exe
- %TEMP%\plf2.tmp
- %TEMP%\ext3.tmp
- %TEMP%\pft4.tmp\Data1\Document\English\GIF Animator 5 Readme.html
- %TEMP%\pft4.tmp\Data1\Setup.ini
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\temp.000
- %TEMP%\IEC5.tmp
- %TEMP%\pft4.tmp\Data1\Setup.exe
- %TEMP%\pft4.tmp\Data1\layout.bin
- %TEMP%\pft4.tmp\Data1\ikernel.ex_
- %TEMP%\pft4.tmp\Data1\Setup.bmp
- %TEMP%\pft4.tmp\Data1\License.txt
Удаляет следующие файлы:
- %TEMP%\IEC5.tmp
- %TEMP%\pft4.tmp\pftw1.pkg
- %TEMP%\ext3.tmp
Перемещает следующие файлы:
- %TEMP%\{8af3e926-ed59-11d4-a44b-0000e86d2305}\_IsUe876.rra в %TEMP%\{8af3e926-ed59-11d4-a44b-0000e86d2305}\_IsUser.dll
- %TEMP%\{8af3e926-ed59-11d4-a44b-0000e86d2305}\Welce8a5.rra в %TEMP%\{8af3e926-ed59-11d4-a44b-0000e86d2305}\Welcome.bmp
- %TEMP%\{8af3e926-ed59-11d4-a44b-0000e86d2305}\Inste828.rra в %TEMP%\{8af3e926-ed59-11d4-a44b-0000e86d2305}\InstSvr.dll
- %TEMP%\{8af3e926-ed59-11d4-a44b-0000e86d2305}\nbupe857.rra в %TEMP%\{8af3e926-ed59-11d4-a44b-0000e86d2305}\nbupinfo.dat
- %TEMP%\{8af3e926-ed59-11d4-a44b-0000e86d2305}\value99f.rra в %TEMP%\{8af3e926-ed59-11d4-a44b-0000e86d2305}\value.shl
- %TEMP%\{8af3e926-ed59-11d4-a44b-0000e86d2305}\_IsReae7.rra в %TEMP%\{8af3e926-ed59-11d4-a44b-0000e86d2305}\_IsRes.dll
- %WINDIR%\Noslip\Nbupf3e0.rra в %WINDIR%\Noslip\Nbupinfo.dat
- %TEMP%\{8af3e926-ed59-11d4-a44b-0000e86d2305}\isrtea1c.rra в %TEMP%\{8af3e926-ed59-11d4-a44b-0000e86d2305}\isrt.dll
- %TEMP%\{8af3e926-ed59-11d4-a44b-0000e86d2305}\defaea7a.rra в %TEMP%\{8af3e926-ed59-11d4-a44b-0000e86d2305}\default.pal
- %TEMP%\{8af3e926-ed59-11d4-a44b-0000e86d2305}\IS32e809.rra в %TEMP%\{8af3e926-ed59-11d4-a44b-0000e86d2305}\IS32Util.dll
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\ctord656.rra в %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\ctor.dll
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\objed925.rra в %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\objectps.dll
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\temp.000 в %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\IKernel.exe
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\cored617.rra в %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\corecomp.ini
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\iused9d0.rra в %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\iuser.dll
- %TEMP%\{8af3e926-ed59-11d4-a44b-0000e86d2305}\U32ie7cb.rra в %TEMP%\{8af3e926-ed59-11d4-a44b-0000e86d2305}\U32inst.dll
- %TEMP%\{8af3e926-ed59-11d4-a44b-0000e86d2305}\u32se7ea.rra в %TEMP%\{8af3e926-ed59-11d4-a44b-0000e86d2305}\u32sn.dll
- %CommonProgramFiles%\InstallShield\IScript\iscrddd8.rra в %CommonProgramFiles%\InstallShield\IScript\iscript.dll
- %TEMP%\{8af3e926-ed59-11d4-a44b-0000e86d2305}\setue75d.rra в %TEMP%\{8af3e926-ed59-11d4-a44b-0000e86d2305}\setup.inx
Другое:
Ищет следующие окна:
- ClassName: '(null)' WindowName: 'Index Editor'
- ClassName: '(null)' WindowName: 'Animation Packager'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'ga_frame' WindowName: '(null)'
