Trojan.Hosts.32013

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'shell' = 'explorer.exe,%temp%\WINDOWSFILES\SYSTEM32\taskmgr.exe'

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\taskkill.exe' /IM bmufa-64.exe
'<SYSTEM32>\taskkill.exe' /IM 88F9E.exe
'<SYSTEM32>\taskkill.exe' /IM airC36.exe
'<SYSTEM32>\taskkill.exe' /IM IWantThis_ppi.exe.un.exe
'<SYSTEM32>\taskkill.exe' /IM 4D9B.tmp
'<SYSTEM32>\taskkill.exe' /IM 72F9.exe
'<SYSTEM32>\taskkill.exe' /IM flash-player.exe
'<SYSTEM32>\taskkill.exe' /IM GiantSavings_US.exe
'<SYSTEM32>\taskkill.exe' /IM A26D.exe
'<SYSTEM32>\taskkill.exe' /IM KP.exe
'<SYSTEM32>\taskkill.exe' /IM WindowsXPKeygen.exe
'<SYSTEM32>\taskkill.exe' /IM D613.exe
'<SYSTEM32>\taskkill.exe' /IM MSI6D15.tmp
'<SYSTEM32>\taskkill.exe' /IM EF8B.exe
'<SYSTEM32>\taskkill.exe' /IM GiantSavings.exe
'<SYSTEM32>\taskkill.exe' /IM PopularScreenSavers.exe
'<SYSTEM32>\taskkill.exe' /IM 100E.tmp
'<SYSTEM32>\taskkill.exe' /IM E81E.exe
'<SYSTEM32>\taskkill.exe' /IM 2183.exe
'<SYSTEM32>\taskkill.exe' /IM picasa39-setup (1).exe
'<SYSTEM32>\taskkill.exe' /IM Server-Stub-117.exe
'<SYSTEM32>\attrib.exe' /IM ExeFile.exe
'<SYSTEM32>\taskkill.exe' /IM Coupon CompanionGui.exe
'<SYSTEM32>\taskkill.exe' /IM dnu.exe
'<SYSTEM32>\taskkill.exe' /IM 10aebb03-5876.tmp
'<SYSTEM32>\taskkill.exe' /IM Bikini02.Scr
'<SYSTEM32>\attrib.exe' /pid=1488
'<SYSTEM32>\taskkill.exe' /IM FacebookUpdat.exe
'<SYSTEM32>\taskkill.exe' /IM FacebookUpdater.exe
'<SYSTEM32>\taskkill.exe' /IM svvhost.exe
'<SYSTEM32>\taskkill.exe' /IM Update.exe
'<SYSTEM32>\taskkill.exe' /IM Facebook.exe
'<SYSTEM32>\taskkill.exe' /IM FacebookUpdate.exe
'<SYSTEM32>\taskkill.exe' /IM schost.exe
'<SYSTEM32>\taskkill.exe' /IM Kbd.exe
'<SYSTEM32>\taskkill.exe' /IM x-raypc.exe
'<SYSTEM32>\taskkill.exe' /pid=2820
'<SYSTEM32>\taskkill.exe' /IM svcchost.exe
'<SYSTEM32>\taskkill.exe' /IM vcshost.exe
'<SYSTEM32>\taskkill.exe' /IM Msiexec.exe
'<SYSTEM32>\taskkill.exe' /IM Updater.exe
'<SYSTEM32>\taskkill.exe' /IM IomUpdateIcons.exe
'<SYSTEM32>\taskkill.exe' /IM soft_pcp_conduit.exe
'<SYSTEM32>\taskkill.exe' /IM vbc.exe
'<SYSTEM32>\taskkill.exe' /IM Kidlogger.exe
'<SYSTEM32>\taskkill.exe' /IM netassistant_ie.exe
'<SYSTEM32>\taskkill.exe' /IM MMUpdater.exe
'<SYSTEM32>\taskkill.exe' /IM dllhost.exe
'<SYSTEM32>\taskkill.exe' /IM WindowsKernelUpdat.exe
'<SYSTEM32>\taskkill.exe' /IM WindowsKernel.exe
'<SYSTEM32>\taskkill.exe' /IM MicroUpdate.exe
'<SYSTEM32>\taskkill.exe' /IM iexplorer.exe
'<SYSTEM32>\taskkill.exe' /IM WindowsKernelUpdater.exe
'<SYSTEM32>\taskkill.exe' /IM WindowsKernelUpdate.exe
'<SYSTEM32>\taskkill.exe' /IM SS_MAN~1.SCR
'<SYSTEM32>\taskkill.exe' /IM rootkitremover.exe
'<SYSTEM32>\taskkill.exe' /IM msdcsc.exe
'<SYSTEM32>\taskkill.exe' /IM msdscs.exe
'<SYSTEM32>\taskkill.exe' /IM aswMBR.exe
'<SYSTEM32>\taskkill.exe' /IM RogueKiller.exe
'<SYSTEM32>\taskkill.exe' /IM RogueKillerX64.exe
'<SYSTEM32>\taskkill.exe' /IM dlhost.exe
'<SYSTEM32>\taskkill.exe' /IM conhost32.exe
'<SYSTEM32>\taskkill.exe' /IM notepad.exe
'<SYSTEM32>\taskkill.exe' /IM jusched.exe
'<SYSTEM32>\taskkill.exe' /IM AppLaunch.exe
'<SYSTEM32>\taskkill.exe' /IM RegSvcs.exe
'<SYSTEM32>\taskkill.exe' /IM shell.exe
'<SYSTEM32>\taskkill.exe' /IM SVHOST.EXE
'<SYSTEM32>\attrib.exe' +a +h +s +r "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup" /S /D
'<SYSTEM32>\attrib.exe' +a +h +s +r "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\*.*" /S /D
'<SYSTEM32>\attrib.exe' +a +h +s +r "%TEMP%\WINDOWSFILES\SYSTEM32\*.*" /S /D
'<SYSTEM32>\cmd.exe' /c ""<Текущая директория>\filename.bat" "
'<SYSTEM32>\attrib.exe' +a +h +s +r "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\*.*" /S /D
'<SYSTEM32>\attrib.exe' +a +h +s +r "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup" /S /D
'<SYSTEM32>\attrib.exe' +a +h +s +r "%TEMP%\WINDOWSFILES\SYSTEM32" /S /D
'<SYSTEM32>\taskkill.exe' /IM NVCPL.EXE
'<SYSTEM32>\taskkill.exe' /IM CRSS.EXE
'<SYSTEM32>\taskkill.exe' /IM SCVHOST.EXE
'<SYSTEM32>\cacls.exe' %TEMP%\WINDOWSFILES\SYSTEM32 /E /P everyone:n
'<SYSTEM32>\cacls.exe' %TEMP%\WINDOWSFILES /E /P everyone:n
'<SYSTEM32>\taskkill.exe' /IM ISASS.EXE
'<SYSTEM32>\taskkill.exe' /IM gtbcheck.exe
'<SYSTEM32>\taskkill.exe' /IM 485E.exe
'<SYSTEM32>\taskkill.exe' /IM 105ac750-5016.tmp
'<SYSTEM32>\taskkill.exe' /IM rphelperapp.exe
'<SYSTEM32>\taskkill.exe' /IM 8ECAA.exe
'<SYSTEM32>\taskkill.exe' /IM msmsgs.exe
'<SYSTEM32>\taskkill.exe' /IM tbgqdfl.exe
'<SYSTEM32>\taskkill.exe' /IM air89.exe
'<SYSTEM32>\taskkill.exe' /IM YontooSetup-S.exe
'<SYSTEM32>\taskkill.exe' /IM QuickTimeInstaller.exe
'<SYSTEM32>\taskkill.exe' /IM B576.exe
'<SYSTEM32>\taskkill.exe' /IM 1DE1.exe
'<SYSTEM32>\taskkill.exe' /IM DSUpdate.ts3
'<SYSTEM32>\taskkill.exe' /IM spoolsv.exe
'<SYSTEM32>\taskkill.exe' /IM $hp2F63.tmp
'<SYSTEM32>\taskkill.exe' /IM SearchSettings.exe
'<SYSTEM32>\taskkill.exe' /IM csrss32.exe
'<SYSTEM32>\taskkill.exe' /IM 10aba34-5619.tmp
'<SYSTEM32>\taskkill.exe' /IM CDProxyServ.exe
'<SYSTEM32>\taskkill.exe' /IM VistaDrive.exe
'<SYSTEM32>\taskkill.exe' /IM qttask.exe
'<SYSTEM32>\taskkill.exe' /IM VVSN.exe
'<SYSTEM32>\taskkill.exe' /IM flashget.exe
'<SYSTEM32>\taskkill.exe' /IM winsys2.exe
'<SYSTEM32>\taskkill.exe' /IM services.exe
'<SYSTEM32>\taskkill.exe' /IM F0C7.exe
'<SYSTEM32>\taskkill.exe' /IM 7S1mqUnafXetef.exe