Trojan.KillFiles.13781

Техническая информация

Вредоносные функции:

Создает и запускает на исполнение:

'%PROGRAM_FILES%\Inzisoft\Inzi iPrint\Install.exe'

Запускает на исполнение:

'<SYSTEM32>\net1.exe' start spooler
'<SYSTEM32>\spoolsv.exe'
'<SYSTEM32>\net.exe' stop spooler
'<SYSTEM32>\net1.exe' stop spooler

Изменения в файловой системе:

Создает следующие файлы:

C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_.DEFAULT
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SECURITY
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-2052111302-484763869-725345543-1003
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\rp.log
<SYSTEM32>\spool\drivers\w32x86\unires.dll
<SYSTEM32>\spool\drivers\w32x86\3\Inzi_iPrint.ini
<SYSTEM32>\spool\drivers\w32x86\unidrv.hlp
<SYSTEM32>\spool\drivers\w32x86\unidrvui.dll
<SYSTEM32>\spool\drivers\w32x86\3\nedip.DLL
<SYSTEM32>\spool\drivers\w32x86\3\NEDIPDRV.dll
%PROGRAM_FILES%\Inzisoft\Inzi iPrint\uninst.exe
<SYSTEM32>\spool\drivers\w32x86\3\nedres.dll
<SYSTEM32>\spool\drivers\w32x86\3\nedip.gpd
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING2.MAP
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.DATA
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING.VER
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING1.MAP
<SYSTEM32>\spool\drivers\w32x86\3\New\unidrv.hlp
<SYSTEM32>\spool\drivers\w32x86\3\New\stdnames.gpd
<SYSTEM32>\spool\drivers\w32x86\3\nedip.BUD
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.MAP
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\RestorePointSize
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.MAP
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SAM
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\ComDb.Dat
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SOFTWARE
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SYSTEM
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\domain.txt
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\$WinMgmt.CFG
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.BTR
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\drivetable.txt
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP15\drivetable.txt
<SYSTEM32>\spool\drivers\w32x86\unidrv.dll
%PROGRAM_FILES%\Inzisoft\Inzi iPrint\mfc90u.dll
%PROGRAM_FILES%\Inzisoft\Inzi iPrint\Microsoft.VC90.MFC.manifest
%PROGRAM_FILES%\Inzisoft\Inzi iPrint\Microsoft.VC90.CRT.manifest
%PROGRAM_FILES%\Inzisoft\Inzi iPrint\mfc90.dll
%PROGRAM_FILES%\Inzisoft\Inzi iPrint\iifClient.dat
%PROGRAM_FILES%\Inzisoft\Inzi iPrint\iifRes.dll
%PROGRAM_FILES%\Inzisoft\Inzi iPrint\iifResKo.dll
%PROGRAM_FILES%\Inzisoft\Inzi iPrint\HASPMS32.DLL
%PROGRAM_FILES%\Inzisoft\Inzi iPrint\iifClient.dll
%PROGRAM_FILES%\Inzisoft\Inzi iPrint\msvcp90.dll
<SYSTEM32>\MSCMCKO.DLL
<SYSTEM32>\MSPRPKO.DLL
<SYSTEM32>\CMDLGKO.DLL
<SYSTEM32>\IOBJSAFE.TLB
<SYSTEM32>\msstkprp.dll
<SYSTEM32>\mscomctl.ocx
%PROGRAM_FILES%\Inzisoft\Inzi iPrint\msvcr90.dll
<SYSTEM32>\VB6KO.DLL
<SYSTEM32>\comdlg32.ocx
%PROGRAM_FILES%\Inzisoft\Inzi iPrint\InziPrinter.ocx
<SYSTEM32>\spool\drivers\w32x86\Inzi_iPrint.ini
%PROGRAM_FILES%\Inzisoft\Inzi iPrint\exit32.dll
%PROGRAM_FILES%\Inzisoft\Inzi iPrint\InziiPrintMsgEventer.ocx
<SYSTEM32>\spool\drivers\w32x86\nedip.DLL
<SYSTEM32>\spool\drivers\w32x86\nedres.dll
<SYSTEM32>\spool\drivers\w32x86\stdnames.gpd
<SYSTEM32>\spool\drivers\w32x86\nedip.gpd
<SYSTEM32>\spool\drivers\w32x86\NEDIPDRV.dll
%TEMP%\nsp2.tmp\System.dll
%PROGRAM_FILES%\Inzisoft\Inzi iPrint\InziEncD.dll
%PROGRAM_FILES%\Inzisoft\Inzi iPrint\InziImgFm.dll
%PROGRAM_FILES%\Inzisoft\Inzi iPrint\InziClient.dll
%PROGRAM_FILES%\Inzisoft\Inzi iPrint\InziClient30.dll
%PROGRAM_FILES%\Inzisoft\Inzi iPrint\Install.exe
%PROGRAM_FILES%\Inzisoft\Inzi iPrint\iPrintVer.ocx
%PROGRAM_FILES%\Inzisoft\Inzi iPrint\InziiPrint.ini
%PROGRAM_FILES%\Inzisoft\Inzi iPrint\Uninstall.exe
%PROGRAM_FILES%\Inzisoft\Inzi iPrint\InziJpeg2K.dll

Удаляет следующие файлы:

<SYSTEM32>\spool\drivers\w32x86\unidrv.dll
<SYSTEM32>\spool\drivers\w32x86\stdnames.gpd
<SYSTEM32>\spool\drivers\w32x86\nedres.dll
<SYSTEM32>\spool\drivers\w32x86\unidrv.hlp
%TEMP%\nsp2.tmp\System.dll
<SYSTEM32>\spool\drivers\w32x86\unires.dll
<SYSTEM32>\spool\drivers\w32x86\unidrvui.dll
<SYSTEM32>\spool\drivers\w32x86\3\Old\1\unidrv.hlp
<SYSTEM32>\spool\drivers\w32x86\3\Old\1\stdnames.gpd
<SYSTEM32>\spool\drivers\w32x86\3\mxdwdui.BUD
<SYSTEM32>\spool\drivers\w32x86\Inzi_iPrint.ini
<SYSTEM32>\spool\drivers\w32x86\NEDIPDRV.dll
<SYSTEM32>\spool\drivers\w32x86\nedip.gpd
<SYSTEM32>\spool\drivers\w32x86\nedip.DLL

Перемещает следующие системные файлы:

<SYSTEM32>\spool\drivers\w32x86\3\stdnames.gpd в <SYSTEM32>\spool\drivers\w32x86\3\Old\1\stdnames.gpd
<SYSTEM32>\spool\drivers\w32x86\3\unidrv.hlp в <SYSTEM32>\spool\drivers\w32x86\3\Old\1\unidrv.hlp

Другое:

Ищет следующие окна: