Техническая информация
Вредоносные функции:
Создает и запускает на исполнение:
- '%TEMP%\RarSFX0\Mang.exe'
- '%TEMP%\7ZipSfx.001\Mang.exe' /s
- '%TEMP%\7ZipSfx.000\idm waleed patch 5.exe' /s
- '%TEMP%\RarSFX0\Kill.exe'
Запускает на исполнение:
- '<SYSTEM32>\taskkill.exe' /f /im IEXPLORE.exe
- '<SYSTEM32>\taskkill.exe' /f /im Maxthon.exe
- '<SYSTEM32>\taskkill.exe' /f /im fire
- '%WINDIR%\regedit.exe' /S RegKey.reg
- '<SYSTEM32>\reg.exe' delete "HKEY_LOCAL_MACHINE\SOFTWARE\Internet Download Manager" /f
- '<SYSTEM32>\taskkill.exe' /f /im Opera.exe
- '<SYSTEM32>\taskkill.exe' /f /im IEMonitor.exe
- '<SYSTEM32>\cmd.exe' /c ""%PROGRAM_FILES%\Internet Download Manager\Kill.cmd" "
- '<SYSTEM32>\taskkill.exe' /f /im IDMan.exe
- '<SYSTEM32>\taskkill.exe' /f /im Opera
- '<SYSTEM32>\taskkill.exe' /f /im firefox.exe
Завершает или пытается завершить
следующие пользовательские процессы:
- iexplore.exe
- opera.exe
- firefox.exe
Изменения в файловой системе:
Создает следующие файлы:
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\Small\Small1.bmp
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\Small\Small.bmp
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\in\smallhot.bmp
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\in\smalldisabled.bmp
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\in\small.bmp
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\player_sHot.bmp
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\player_sDisabled.bmp
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\roundHot.bmp
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\round.bmp
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\Enternet\Thumbs.db
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\Small\Thumbs.db
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\Thumbs.db
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\blue\Thumbs.db
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\Blue Arrow Author\Thumbs.db
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\in\Thumbs.db
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\round\Thumbs.db
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\eyecandy\Thumbs.db
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\BlueArrow\Thumbs.db
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\Skin2\Thumbs.db
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\player_s.bmp
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\Mosi_Modern_XPHot.bmp
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\Mosi_Modern_XP.bmp
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\MosI3D_largeHot_1.bmp
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\MosI3D_large_1.bmp
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\BlueArrow\Mini-Preview.bmp
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\luckyToolbarS2.bmp
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\luckyToolbarH2.bmp
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\Blue Arrow Author\Mini-Preview.bmp
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\luckyToolbarSH2.bmp
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\MosI3D_small_1.bmp
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\player_l.bmp
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\eyecandy\normalXP.bmp
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\player_lHot.bmp
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\player_lDisabled.bmp
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\round\normalXP.bmp
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\blue\normal.bmp
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\MosI3D_smallHot_1.bmp
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\round\normal_classic.bmp
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\in\normal.bmp
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\kiti.tbi
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\inherited.tbi
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\Koushik_Halder.tbi
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\Koushik Halder.tbi
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\Globe.tbi
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\Cool.tbi
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\BlueArrow.tbi
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\eyecandy.tbi
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\Enternet.tbi
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\luckyToolbar2.tbi
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\skin2.tbi
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\round_light.tbi
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\Blue Arrow Author\I.R.Iran.gif
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\Small.tbi
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\round_dark.tbi
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\MosI3D_1.tbi
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\Mosi_Modern_XP.tbi
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\round.tbi
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\player.tbi
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\blue_orange.tbi
- %PROGRAM_FILES%\Internet Download Manager\Languages\idm_fr.lng
- %PROGRAM_FILES%\Internet Download Manager\Languages\idm_fa.lng
- %PROGRAM_FILES%\Internet Download Manager\Languages\idm_nl.lng
- %PROGRAM_FILES%\Internet Download Manager\Languages\idm_it.lng
- %PROGRAM_FILES%\Internet Download Manager\Languages\idm_es.lng
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\Cool\Thumbs.db
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\BlackFanciful\Thumbs.db
- %PROGRAM_FILES%\Internet Download Manager\Languages\idm_de.lng
- %PROGRAM_FILES%\Internet Download Manager\Languages\idm_ar.lng
- %PROGRAM_FILES%\Internet Download Manager\Languages\idm_pl.lng
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\3d_style_3.tbi
- %PROGRAM_FILES%\Internet Download Manager\RegKey.REG
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\Blue_Arrow.tbi
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\BlackFanciful.tbi
- %PROGRAM_FILES%\Internet Download Manager\Languages\template.lng
- %PROGRAM_FILES%\Internet Download Manager\Languages\idm_ru.lng
- %PROGRAM_FILES%\Internet Download Manager\Languages\idm_ptbr.lng
- %PROGRAM_FILES%\Internet Download Manager\Languages\idm_tr.lng
- %PROGRAM_FILES%\Internet Download Manager\Languages\idm_th.lng
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\luckyToolbar2.bmp
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\blue\3d_smallDisabled.bmp
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\3d_small_3.bmp
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\Skin2\3d_smallHot_3.bmp
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\blue\3d_smallHot.bmp
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\Skin2\3d_small_3.bmp
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\Skin2\3d_largeHot_3.bmp
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\3d_large_3.bmp
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\blue\3d_small.bmp
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\3d_largeHot_3.bmp
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\3d_smallHot_3.bmp
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\Blue_Arrow_Hot.bmp
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\BlueArrow\Blue_Arrow_Disable.bmp
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\Blue_Arrow_Mini_Disable.bmp
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\BlueArrow\Blue_Arrow_Hot.bmp
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\Blue_Arrow_Disable.bmp
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\BlackFanciful\BlackFanciful1.bmp
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\BlackFanciful\BlackFanciful.bmp
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\BlackFanciful\BlackFanciful3.bmp
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\BlackFanciful\BlackFanciful2.bmp
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\Skin2\3d_large_3.bmp
- %PROGRAM_FILES%\Internet Download Manager\Languages\tips_de.txt
- %PROGRAM_FILES%\Internet Download Manager\Languages\tips_ar.txt
- %PROGRAM_FILES%\Internet Download Manager\Languages\tips_fa.txt
- %PROGRAM_FILES%\Internet Download Manager\Languages\tips_es.txt
- %TEMP%\7ZipSfx.001\Mang.exe
- %TEMP%\RarSFX0\Kill.exe
- %TEMP%\7ZipSfx.000\idm waleed patch 5.exe
- %PROGRAM_FILES%\Internet Download Manager\Kill.cmd
- %TEMP%\RarSFX0\Mang.exe
- %PROGRAM_FILES%\Internet Download Manager\Languages\tips_fr.txt
- %PROGRAM_FILES%\Internet Download Manager\Languages\tips_tr.txt
- %PROGRAM_FILES%\Internet Download Manager\Languages\tips_th.txt
- %PROGRAM_FILES%\Internet Download Manager\IDMan.exe
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\Blue Arrow Author\Read-Me.htm
- %PROGRAM_FILES%\Internet Download Manager\Languages\tips_ru.txt
- %PROGRAM_FILES%\Internet Download Manager\Languages\tips_nl.txt
- %PROGRAM_FILES%\Internet Download Manager\Languages\tips_it.txt
- %PROGRAM_FILES%\Internet Download Manager\Languages\tips_ptbr.txt
- %PROGRAM_FILES%\Internet Download Manager\Languages\tips_pl.txt
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\round\hot_classic.bmp
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\in\hot.bmp
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\eyecandy\hotXP.bmp
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\round\hotXP.bmp
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\blue\hot.bmp
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\Enternet\Enternet3.bmp
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\Enternet\Enternet2.bmp
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\GlobeHot.bmp
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\Globe.bmp
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\kiti.bmp
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\Koushik_Halder_Small_Normal.bmp
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\Koushik_Halder_Small_Hot.bmp
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\BlueArrow\Larg-Preview.bmp
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\Blue Arrow Author\Larg-Preview.bmp
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\Koushik_Halder_Small_Disable.bmp
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\Koushik_Halder_Large_Disable.bmp
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\kitiHot.bmp
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\Koushik_Halder_Large_Normal.bmp
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\Koushik_Halder_Large_Hot.bmp
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\Enternet\Enternet1.bmp
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\BlueArrow\Blue_Arrow_Normal.bmp
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\Blue_Arrow_Normal.bmp
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\Cool\Cool1.bmp
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\Cool\Cool.bmp
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\BlueArrow\Blue_Arrow_Mini_Normal.bmp
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\Blue_Arrow_Mini_Hot.bmp
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\BlueArrow\Blue_Arrow_Mini_Disable.bmp
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\Blue_Arrow_Mini_Normal.bmp
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\BlueArrow\Blue_Arrow_Mini_Hot.bmp
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\Cool\Cool2.bmp
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\round\disabledXP.bmp
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\round\disabled_classic.bmp
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\Enternet\Enternet.bmp
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\eyecandy\disabledXP.bmp
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\in\disabled.bmp
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\Cool\Cool4.bmp
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\Cool\Cool3.bmp
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\blue\disabled.bmp
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\Cool\Cool5.bmp
Присваивает атрибут 'скрытый' для следующих файлов:
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\Thumbs.db
Удаляет следующие файлы:
- %TEMP%\RarSFX0\Mang.exe
- %TEMP%\7ZipSfx.000\idm waleed patch 5.exe
- %TEMP%\7ZipSfx.001\Mang.exe
- %TEMP%\RarSFX0\Kill.exe
Другое:
Ищет следующие окна:
- ClassName: '(null)' WindowName: '(null)'
- ClassName: 'RegEdit_RegEdit' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'EDIT' WindowName: '(null)'
