Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Classes\MSProgramGroup\Shell\Open\Command] '' = '<SYSTEM32>\grpconv.exe %1'
Изменяет следующие исполняемые системные файлы:
- <SYSTEM32>\vfp9renu.dll
- <SYSTEM32>\vfp9r.dll
Вредоносные функции:
Создает и запускает на исполнение:
- '%TEMP%\IXP000.TMP\AGENTSVR.EXE' /REGSERVER
- 'C:\TutorNet\MSagent\MSagent.exe' /Q
Запускает на исполнение:
- '<SYSTEM32>\regsvr32.exe' /s "%WINDIR%\msagent\AgentPsh.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%WINDIR%\msagent\AgentSR.dll"
- '<SYSTEM32>\grpconv.exe' -o
- '%WINDIR%\msagent\agentsvr.exe' /regserver
- '<SYSTEM32>\regsvr32.exe' /s "%WINDIR%\msagent\AgentMPx.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%WINDIR%\msagent\AgentDPv.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%WINDIR%\msagent\AgentCtl.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%WINDIR%\msagent\AgentDP2.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%WINDIR%\msagent\mslwvtts.dll"
Изменения в файловой системе:
Создает следующие файлы:
- %WINDIR%\Fonts\EAN13_72.TTF
- %WINDIR%\Fonts\V200009_.ttf
- %WINDIR%\Fonts\V200010_.ttf
- %WINDIR%\Fonts\EAN13_36.TTF
- %TEMP%\nsq2D.tmp\FontName.dll
- %TEMP%\nsq2D.tmp\System.dll
- %WINDIR%\Fonts\V200011_.ttf
- C:\TutorNet\Focus.fll
- C:\TutorNet\Kernel.dll
- C:\TutorNet\TutorFTP.dll
- %WINDIR%\Fonts\V200012_.ttf
- %WINDIR%\Fonts\V200021_.ttf
- %WINDIR%\Fonts\V200022_.ttf
- C:\TutorNet\Font\V200022_.ttf
- %WINDIR%\Temp\OLD2B.tmp
- %WINDIR%\msagent\SET2C.tmp
- C:\TutorNet\MSagent\tnet.exe
- %WINDIR%\Temp\OLD28.tmp
- %WINDIR%\msagent\intl\SET29.tmp
- %WINDIR%\LastGood\TMP2A.tmp
- C:\TutorNet\Font\EAN13_36.TTF
- C:\TutorNet\Font\V200011_.ttf
- C:\TutorNet\Font\V200012_.ttf
- C:\TutorNet\Font\V200021_.ttf
- C:\TutorNet\Font\EAN13_72.TTF
- C:\TutorNet\Font\V200009_.ttf
- C:\TutorNet\Font\V200010_.ttf
- C:\TutorNet\izip.dll
- C:\TutorNet\VolaSMS.ocx
- C:\TutorNet\richtx32.ocx
- <SYSTEM32>\inetit.dll
- C:\TutorNet\msvbvm60.dll
- C:\TutorNet\riched32.dll
- C:\TutorNet\msinet.ocx
- <SYSTEM32>\msprpit.dll
- <SYSTEM32>\msinet.ocx
- <SYSTEM32>\VolaSMS.ocx
- <SYSTEM32>\richtx32.ocx
- <SYSTEM32>\msstkprp.dll
- <SYSTEM32>\vfp8r.dll
- <SYSTEM32>\vfp8renu.dll
- C:\TutorNet\msvcr71.dll
- C:\TutorNet\EZTW32.DLL
- C:\TutorNet\tnet.exe
- C:\TutorNet\vfp8renu.dll
- C:\TutorNet\unzip32.dll
- C:\TutorNet\Zip32.dll
- C:\TutorNet\TWLib.dll
- C:\TutorNet\vfp9r.dll
- C:\TutorNet\msstkprp.dll
- C:\TutorNet\gdiplus.dll
- C:\TutorNet\msvcr70.dll
- C:\TutorNet\VFP9RENU.DLL
- C:\TutorNet\inetit.dll
- C:\TutorNet\msprpit.dll
- %TEMP%\IXP000.TMP\ADVPACK.DLL
- %TEMP%\IXP000.TMP\W95INF32.DLL
- %TEMP%\IXP000.TMP\W95INF16.DLL
- %TEMP%\IXP000.TMP\AGTEULA.TXT
- %TEMP%\IXP000.TMP\AGTINST.INF
- %TEMP%\IXP000.TMP\AGT20.INF
- %WINDIR%\LastGood\TMP5.tmp
- %WINDIR%\Temp\OLD9.tmp
- %WINDIR%\msagent\SETA.tmp
- %WINDIR%\LastGood\TMPB.tmp
- %WINDIR%\Temp\OLD6.tmp
- %WINDIR%\msagent\SET7.tmp
- %WINDIR%\LastGood\TMP8.tmp
- %TEMP%\IXP000.TMP\AGTCTL15.TLB
- %TEMP%\IXP000.TMP\AGENTDP2.DLL
- %TEMP%\IXP000.TMP\AGENTDPV.DLL
- %TEMP%\IXP000.TMP\AGENTMPX.DLL
- %TEMP%\nsj2.tmp
- C:\TutorNet\MSagent\MSagent.exe
- %TEMP%\IXP000.TMP\AGENTCTL.DLL
- %TEMP%\IXP000.TMP\MSLWVTTS.DLL
- %TEMP%\IXP000.TMP\AGENTPSH.DLL
- %TEMP%\IXP000.TMP\AGENTSVR.EXE
- %TEMP%\IXP000.TMP\AGT0409.HLP
- %TEMP%\IXP000.TMP\AGENTANM.DLL
- %TEMP%\IXP000.TMP\AGENTSR.DLL
- %TEMP%\IXP000.TMP\AGT0409.DLL
- %WINDIR%\Temp\OLDC.tmp
- %WINDIR%\LastGood\TMP1E.tmp
- %WINDIR%\Temp\OLD1F.tmp
- %WINDIR%\inf\SET20.tmp
- %WINDIR%\Temp\OLD1B.tmp
- %WINDIR%\msagent\SET1C.tmp
- %WINDIR%\LastGood\TMP1D.tmp
- %WINDIR%\LastGood\TMP21.tmp
- %WINDIR%\Temp\OLD25.tmp
- %WINDIR%\Help\SET26.tmp
- %WINDIR%\LastGood\TMP27.tmp
- %WINDIR%\Temp\OLD22.tmp
- %WINDIR%\msagent\SET23.tmp
- %WINDIR%\LastGood\TMP24.tmp
- %WINDIR%\LastGood\TMP1A.tmp
- %WINDIR%\msagent\SET10.tmp
- %WINDIR%\LastGood\TMP11.tmp
- %WINDIR%\Temp\OLD12.tmp
- %WINDIR%\msagent\SETD.tmp
- %WINDIR%\LastGood\TMPE.tmp
- %WINDIR%\Temp\OLDF.tmp
- %WINDIR%\msagent\SET13.tmp
- %WINDIR%\LastGood\TMP17.tmp
- %WINDIR%\Temp\OLD18.tmp
- %WINDIR%\msagent\SET19.tmp
- %WINDIR%\LastGood\TMP14.tmp
- %WINDIR%\Temp\OLD15.tmp
- %WINDIR%\msagent\SET16.tmp
Удаляет следующие файлы:
- %TEMP%\IXP000.TMP\AGTINST.INF
- %TEMP%\IXP000.TMP\AGT20.INF
- %TEMP%\IXP000.TMP\AGTEULA.TXT
- %TEMP%\IXP000.TMP\AGT0409.HLP
- %TEMP%\IXP000.TMP\AGTCTL15.TLB
- %TEMP%\IXP000.TMP\ADVPACK.DLL
- %WINDIR%\Temp\OLD9.tmp
- %WINDIR%\Temp\OLDC.tmp
- %WINDIR%\Temp\OLD6.tmp
- %TEMP%\IXP000.TMP\W95INF32.DLL
- %TEMP%\IXP000.TMP\W95INF16.DLL
- %TEMP%\IXP000.TMP\AGENTSVR.EXE
- %TEMP%\IXP000.TMP\AGENTDP2.DLL
- %TEMP%\IXP000.TMP\AGENTDPV.DLL
- %TEMP%\IXP000.TMP\AGENTCTL.DLL
- %TEMP%\nsq2D.tmp\System.dll
- %TEMP%\nsq2D.tmp\FontName.dll
- %TEMP%\IXP000.TMP\AGENTMPX.DLL
- %TEMP%\IXP000.TMP\AGT0409.DLL
- %TEMP%\IXP000.TMP\AGENTPSH.DLL
- %TEMP%\IXP000.TMP\AGENTSR.DLL
- %TEMP%\IXP000.TMP\MSLWVTTS.DLL
- %TEMP%\IXP000.TMP\AGENTANM.DLL
- %WINDIR%\msagent\SET1C.tmp
- %WINDIR%\msagent\SET19.tmp
- %WINDIR%\inf\agtinst.inf
- %WINDIR%\Help\agt0409.hlp
- %WINDIR%\msagent\SET23.tmp
- %WINDIR%\msagent\SET16.tmp
- %WINDIR%\msagent\SETA.tmp
- %WINDIR%\msagent\SET7.tmp
- %WINDIR%\msagent\SETD.tmp
- %WINDIR%\msagent\SET13.tmp
- %WINDIR%\msagent\SET10.tmp
- %WINDIR%\msagent\intl\SET29.tmp
- %WINDIR%\Temp\OLD18.tmp
- %WINDIR%\Temp\OLD1B.tmp
- %WINDIR%\Temp\OLD15.tmp
- %WINDIR%\Temp\OLDF.tmp
- %WINDIR%\Temp\OLD12.tmp
- %WINDIR%\Temp\OLD1F.tmp
- %WINDIR%\Temp\OLD2B.tmp
- %WINDIR%\msagent\SET2C.tmp
- %WINDIR%\Temp\OLD28.tmp
- %WINDIR%\Temp\OLD22.tmp
- %WINDIR%\Temp\OLD25.tmp
Перемещает следующие файлы:
- %WINDIR%\LastGood\TMP1E.tmp в %WINDIR%\LastGood\INF\agtinst.PNF
- %WINDIR%\LastGood\TMP1D.tmp в %WINDIR%\LastGood\INF\agtinst.inf
- %WINDIR%\LastGood\TMP1A.tmp в %WINDIR%\LastGood\msagent\AgentPsh.dll
- %WINDIR%\LastGood\TMP21.tmp в %WINDIR%\LastGood\msagent\mslwvtts.dll
- %WINDIR%\LastGood\TMP2A.tmp в %WINDIR%\LastGood\msagent\AgtCtl15.tlb
- %WINDIR%\LastGood\TMP27.tmp в %WINDIR%\LastGood\msagent\intl\Agt0409.dll
- %WINDIR%\LastGood\TMP24.tmp в %WINDIR%\LastGood\help\Agt0409.hlp
- %WINDIR%\LastGood\TMPB.tmp в %WINDIR%\LastGood\msagent\AgentDp2.dll
- %WINDIR%\LastGood\TMP8.tmp в %WINDIR%\LastGood\msagent\AgentDPv.dll
- %WINDIR%\LastGood\TMP5.tmp в %WINDIR%\LastGood\msagent\AgentCtl.dll
- %WINDIR%\LastGood\TMPE.tmp в %WINDIR%\LastGood\msagent\AgentSvr.exe
- %WINDIR%\LastGood\TMP17.tmp в %WINDIR%\LastGood\msagent\AgentSR.dll
- %WINDIR%\LastGood\TMP14.tmp в %WINDIR%\LastGood\msagent\AgentAnm.dll
- %WINDIR%\LastGood\TMP11.tmp в %WINDIR%\LastGood\msagent\AgentMPx.dll
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
