Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Classes\PROTOCOLS\Handler\ms-its] 'CLSID' = '{9D148291-B9C8-11D0-A4CC-0000F80149F6}'
- [<HKLM>\SOFTWARE\Classes\PROTOCOLS\Handler\its] 'CLSID' = '{9D148291-B9C8-11D0-A4CC-0000F80149F6}'
Подменяет следующие исполняемые системные файлы:
- <SYSTEM32>\msvbvm60.dll файлом <SYSTEM32>\is-HLOQM.tmp
Вредоносные функции:
Создает и запускает на исполнение:
- '%APPDATA%\doctor\dm\doctor.exe'
- '%TEMP%\is-5AKT4.tmp\DriverMagician.tmp' /SL5="$1013E,4100190,56832,%APPDATA%\doctor\dm\DriverMagician.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
- '%APPDATA%\doctor\dm\DriverMagician.exe' /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
Запускает на исполнение:
- '<SYSTEM32>\regsvr32.exe' /s "<SYSTEM32>\XCEEDZIP.DLL"
- '<SYSTEM32>\regsvr32.exe' /s "<SYSTEM32>\itss.dll"
- '<SYSTEM32>\regsvr32.exe' /s "<SYSTEM32>\itircl.dll"
- '<SYSTEM32>\regsvr32.exe' /s "<SYSTEM32>\XceedCry.dll"
- '%WINDIR%\regedit.exe' /s lisans.reg
- '<SYSTEM32>\xcopy.exe' /Y "English.ini" "%PROGRAM_FILES%\Driver Magician\Language\"
- '<SYSTEM32>\regsvr32.exe' /s "<SYSTEM32>\Codejock.Controls.v15.0.1.ocx"
- '<SYSTEM32>\regsvr32.exe' /s "<SYSTEM32>\Mscomctl.ocx"
- '<SYSTEM32>\regsvr32.exe' /s "<SYSTEM32>\oleaut32.dll"
- '<SYSTEM32>\regsvr32.exe' /s "<SYSTEM32>\msvbvm60.dll"
- '<SYSTEM32>\cmd.exe' /c ""%APPDATA%\doctor\dm\kur.cmd" "
- '<SYSTEM32>\regsvr32.exe' /s "<SYSTEM32>\olepro32.dll"
- '<SYSTEM32>\regsvr32.exe' /s "<SYSTEM32>\Msinet.ocx"
- '<SYSTEM32>\regsvr32.exe' /s "<SYSTEM32>\Comdlg32.ocx"
- '<SYSTEM32>\regsvr32.exe' /s "<SYSTEM32>\comcat.dll"
Изменения в файловой системе:
Создает следующие файлы:
- %PROGRAM_FILES%\Driver Magician\is-CPM5L.tmp
- %PROGRAM_FILES%\Driver Magician\is-THEPE.tmp
- %PROGRAM_FILES%\Driver Magician\is-5VJJ8.tmp
- <SYSTEM32>\is-772C6.tmp
- <SYSTEM32>\is-1SJCQ.tmp
- %APPDATA%\Driver Magician\is-P304V.tmp
- %PROGRAM_FILES%\Driver Magician\Language\is-5T9G1.tmp
- %PROGRAM_FILES%\Driver Magician\Language\is-SRHUQ.tmp
- %PROGRAM_FILES%\Driver Magician\Language\is-PL5C1.tmp
- %PROGRAM_FILES%\Driver Magician\Language\is-6ECH8.tmp
- %PROGRAM_FILES%\Driver Magician\Language\is-T6KN4.tmp
- %PROGRAM_FILES%\Driver Magician\Language\is-GA26B.tmp
- <SYSTEM32>\is-BFV2D.tmp
- %ALLUSERSPROFILE%\Start Menu\Programs\Driver Magician\Uninstall Driver Magician.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\Driver Magician\Homepage.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\Driver Magician\Readme.lnk
- %PROGRAM_FILES%\Driver Magician\Language\English.ini
- %PROGRAM_FILES%\Driver Magician\unins000.dat
- %HOMEPATH%\Desktop\Driver Magician.lnk
- <SYSTEM32>\is-T9FUB.tmp
- <SYSTEM32>\is-MPE9E.tmp
- <SYSTEM32>\is-G4FFM.tmp
- %ALLUSERSPROFILE%\Start Menu\Programs\Driver Magician\Help.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\Driver Magician\Driver Magician.lnk
- <SYSTEM32>\is-NQ6C3.tmp
- %TEMP%\is-OTQ25.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-5AKT4.tmp\DriverMagician.tmp
- %APPDATA%\doctor\dm\doctor.exe
- %PROGRAM_FILES%\Driver Magician\is-UQBVE.tmp
- <SYSTEM32>\is-HLOQM.tmp
- %PROGRAM_FILES%\Driver Magician\is-D1R76.tmp
- %APPDATA%\doctor\dm\kur.cmd
- %TEMP%\$inst\temp_0.tmp
- %TEMP%\$inst\2.tmp
- %APPDATA%\doctor\dm\lisans.reg
- %APPDATA%\doctor\dm\DriverMagician.exe
- %APPDATA%\doctor\dm\English.ini
- %PROGRAM_FILES%\Driver Magician\is-51F7A.tmp
- %PROGRAM_FILES%\Driver Magician\Language\is-SVUDK.tmp
- %PROGRAM_FILES%\Driver Magician\Language\is-8VLK1.tmp
- %PROGRAM_FILES%\Driver Magician\is-EN7TI.tmp
- %PROGRAM_FILES%\Driver Magician\Language\is-B7MN4.tmp
- %PROGRAM_FILES%\Driver Magician\Language\is-BTIAC.tmp
- %PROGRAM_FILES%\Driver Magician\Language\is-M17RS.tmp
- %PROGRAM_FILES%\Driver Magician\is-9MQOR.tmp
- %PROGRAM_FILES%\Driver Magician\is-RGHHJ.tmp
- %PROGRAM_FILES%\Driver Magician\is-IDOVV.tmp
- %PROGRAM_FILES%\Driver Magician\is-HBHQN.tmp
- %PROGRAM_FILES%\Driver Magician\is-18BP7.tmp
- %PROGRAM_FILES%\Driver Magician\is-67P9B.tmp
Удаляет следующие файлы:
- %APPDATA%\doctor\dm\lisans.reg
- %APPDATA%\doctor\dm\English.ini
- %APPDATA%\doctor\dm\doctor.exe
- %TEMP%\$inst\2.tmp
- %APPDATA%\doctor\dm\kur.cmd
- <SYSTEM32>\msvbvm60.dll
- %TEMP%\$inst\temp_0.tmp
- %TEMP%\is-OTQ25.tmp\_isetup\_shfoldr.dll
- %APPDATA%\doctor\dm\DriverMagician.exe
- %TEMP%\is-5AKT4.tmp\DriverMagician.tmp
Перемещает следующие файлы:
- %PROGRAM_FILES%\Driver Magician\is-5VJJ8.tmp в %PROGRAM_FILES%\Driver Magician\AutoIntall.dll
- %PROGRAM_FILES%\Driver Magician\Language\is-6ECH8.tmp в %PROGRAM_FILES%\Driver Magician\Language\Spanish.ini
- %PROGRAM_FILES%\Driver Magician\is-CPM5L.tmp в %PROGRAM_FILES%\Driver Magician\sortascending.ico
- %PROGRAM_FILES%\Driver Magician\is-THEPE.tmp в %PROGRAM_FILES%\Driver Magician\sortdescending.ico
- %PROGRAM_FILES%\Driver Magician\Language\is-5T9G1.tmp в %PROGRAM_FILES%\Driver Magician\Language\Italian.ini
- %PROGRAM_FILES%\Driver Magician\Language\is-SRHUQ.tmp в %PROGRAM_FILES%\Driver Magician\Language\Hungarian.ini
- %PROGRAM_FILES%\Driver Magician\Language\is-T6KN4.tmp в %PROGRAM_FILES%\Driver Magician\Language\Portuguese.ini
- %PROGRAM_FILES%\Driver Magician\Language\is-GA26B.tmp в %PROGRAM_FILES%\Driver Magician\Language\Polish.ini
- <SYSTEM32>\is-MPE9E.tmp в <SYSTEM32>\XceedCry.dll
- <SYSTEM32>\is-G4FFM.tmp в <SYSTEM32>\XCEEDZIP.DLL
- <SYSTEM32>\is-NQ6C3.tmp в <SYSTEM32>\Codejock.Controls.v15.0.1.ocx
- <SYSTEM32>\is-T9FUB.tmp в <SYSTEM32>\xcdsfx32.bin
- <SYSTEM32>\is-1SJCQ.tmp в <SYSTEM32>\Comdlg32.ocx
- %APPDATA%\Driver Magician\is-P304V.tmp в %APPDATA%\Driver Magician\HiddenUpdate.txt
- <SYSTEM32>\is-BFV2D.tmp в <SYSTEM32>\Mscomctl.ocx
- <SYSTEM32>\is-772C6.tmp в <SYSTEM32>\Msinet.ocx
- %PROGRAM_FILES%\Driver Magician\is-9MQOR.tmp в %PROGRAM_FILES%\Driver Magician\DutchHelp.chm
- %PROGRAM_FILES%\Driver Magician\is-RGHHJ.tmp в %PROGRAM_FILES%\Driver Magician\Help.chm
- %PROGRAM_FILES%\Driver Magician\is-18BP7.tmp в %PROGRAM_FILES%\Driver Magician\icon.ico
- %PROGRAM_FILES%\Driver Magician\is-67P9B.tmp в %PROGRAM_FILES%\Driver Magician\Homepage.url
- %PROGRAM_FILES%\Driver Magician\is-UQBVE.tmp в %PROGRAM_FILES%\Driver Magician\Driver Magician.exe
- %PROGRAM_FILES%\Driver Magician\is-D1R76.tmp в %PROGRAM_FILES%\Driver Magician\unins000.exe
- %PROGRAM_FILES%\Driver Magician\is-IDOVV.tmp в %PROGRAM_FILES%\Driver Magician\pcidevs.txt
- %PROGRAM_FILES%\Driver Magician\is-51F7A.tmp в %PROGRAM_FILES%\Driver Magician\Readme.txt
- %PROGRAM_FILES%\Driver Magician\Language\is-BTIAC.tmp в %PROGRAM_FILES%\Driver Magician\Language\French.ini
- %PROGRAM_FILES%\Driver Magician\Language\is-M17RS.tmp в %PROGRAM_FILES%\Driver Magician\Language\English.ini
- %PROGRAM_FILES%\Driver Magician\Language\is-PL5C1.tmp в %PROGRAM_FILES%\Driver Magician\Language\Hebrew.ini
- %PROGRAM_FILES%\Driver Magician\Language\is-B7MN4.tmp в %PROGRAM_FILES%\Driver Magician\Language\German.ini
- %PROGRAM_FILES%\Driver Magician\is-EN7TI.tmp в %PROGRAM_FILES%\Driver Magician\public.key
- %PROGRAM_FILES%\Driver Magician\is-HBHQN.tmp в %PROGRAM_FILES%\Driver Magician\DriverDB.dat
- %PROGRAM_FILES%\Driver Magician\Language\is-SVUDK.tmp в %PROGRAM_FILES%\Driver Magician\Language\Dutch.ini
- %PROGRAM_FILES%\Driver Magician\Language\is-8VLK1.tmp в %PROGRAM_FILES%\Driver Magician\Language\Arabic.ini
Другое:
Ищет следующие окна:
- ClassName: 'RegEdit_RegEdit' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
