Trojan.KillFiles.14245

Техническая информация

Вредоносные функции:

Создает и запускает на исполнение:

'%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\IKernel.exe' /REGSERVER
'%WINDIR%\Temp\PATCH\CheckModel.exe'
'%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\IKernel.exe' 32\IKernel.exe -Embedding
'%TEMP%\pft3.tmp\Disk1\Setup.exe'
'%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\IKernel.exe' -RegServer

Запускает на исполнение:

'<SYSTEM32>\wbem\wmiadap.exe' /R /T

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\{5D6FF529-7C01-4C07-97C5-72977C340EC0}\defad33f.rra
%TEMP%\{5D6FF529-7C01-4C07-97C5-72977C340EC0}\isrtd293.rra
%PROGRAM_FILES%\InstallShield Installation Information\{5D6FF529-7C01-4C07-97C5-72977C340EC0}\layoe03f.rra
%TEMP%\{5D6FF529-7C01-4C07-97C5-72977C340EC0}\_IsRd40a.rra
%CommonProgramFiles%\InstallShield\IScript\iscrb8e1.rra
%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\iuseb24a.rra
%TEMP%\{5D6FF529-7C01-4C07-97C5-72977C340EC0}\valud0fd.rra
%TEMP%\{5D6FF529-7C01-4C07-97C5-72977C340EC0}\setucf28.rra
%PROGRAM_FILES%\InstallShield Installation Information\{5D6FF529-7C01-4C07-97C5-72977C340EC0}\Setup.ini
%PROGRAM_FILES%\InstallShield Installation Information\{5D6FF529-7C01-4C07-97C5-72977C340EC0}\setue0fb.rra
%WINDIR%\Model.txt
%WINDIR%\Temp\PATCH\Chece178.rra
%PROGRAM_FILES%\InstallShield Installation Information\{5D6FF529-7C01-4C07-97C5-72977C340EC0}\datae05e.rra
%PROGRAM_FILES%\InstallShield Installation Information\{5D6FF529-7C01-4C07-97C5-72977C340EC0}\datae04f.rra
%PROGRAM_FILES%\InstallShield Installation Information\{5D6FF529-7C01-4C07-97C5-72977C340EC0}\Setue0bc.rra
%PROGRAM_FILES%\InstallShield Installation Information\{5D6FF529-7C01-4C07-97C5-72977C340EC0}\Setue09d.rra
%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\objeb0e2.rra
%TEMP%\pft3.tmp\Disk1\data2.cab
%TEMP%\pft3.tmp\Disk1\data1.hdr
%TEMP%\pft3.tmp\Disk1\layout.bin
%TEMP%\pft3.tmp\Disk1\ikernel.ex_
%TEMP%\plf1.tmp
%TEMP%\ext2.tmp
%TEMP%\pft3.tmp\Disk1\data1.cab
%TEMP%\pft3.tmp\pftw1.pkg
%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\temp.000
%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\ctora317.rra
%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\corea123.rra
%TEMP%\pft3.tmp\Disk1\Setup.ini
%TEMP%\pft3.tmp\Disk1\Setup.exe
%TEMP%\IEC4.tmp
%TEMP%\pft3.tmp\Disk1\setup.inx

Удаляет следующие файлы:

<SYSTEM32>\wbem\Performance\WmiApRpl.ini
<SYSTEM32>\PerfStringBackup.TMP
%TEMP%\IEC4.tmp
%TEMP%\ext2.tmp
%TEMP%\pft3.tmp\pftw1.pkg

Перемещает следующие файлы:

%PROGRAM_FILES%\InstallShield Installation Information\{5D6FF529-7C01-4C07-97C5-72977C340EC0}\layoe03f.rra в %PROGRAM_FILES%\InstallShield Installation Information\{5D6FF529-7C01-4C07-97C5-72977C340EC0}\layout.bin
%PROGRAM_FILES%\InstallShield Installation Information\{5D6FF529-7C01-4C07-97C5-72977C340EC0}\datae04f.rra в %PROGRAM_FILES%\InstallShield Installation Information\{5D6FF529-7C01-4C07-97C5-72977C340EC0}\data1.hdr
%TEMP%\{5D6FF529-7C01-4C07-97C5-72977C340EC0}\defad33f.rra в %TEMP%\{5D6FF529-7C01-4C07-97C5-72977C340EC0}\default.pal
%TEMP%\{5D6FF529-7C01-4C07-97C5-72977C340EC0}\_IsRd40a.rra в %TEMP%\{5D6FF529-7C01-4C07-97C5-72977C340EC0}\_IsRes.dll
%PROGRAM_FILES%\InstallShield Installation Information\{5D6FF529-7C01-4C07-97C5-72977C340EC0}\datae05e.rra в %PROGRAM_FILES%\InstallShield Installation Information\{5D6FF529-7C01-4C07-97C5-72977C340EC0}\data1.cab
%PROGRAM_FILES%\InstallShield Installation Information\{5D6FF529-7C01-4C07-97C5-72977C340EC0}\setue0fb.rra в %PROGRAM_FILES%\InstallShield Installation Information\{5D6FF529-7C01-4C07-97C5-72977C340EC0}\setup.inx
%WINDIR%\Temp\PATCH\Chece178.rra в %WINDIR%\Temp\PATCH\CheckModel.exe
%PROGRAM_FILES%\InstallShield Installation Information\{5D6FF529-7C01-4C07-97C5-72977C340EC0}\Setue09d.rra в %PROGRAM_FILES%\InstallShield Installation Information\{5D6FF529-7C01-4C07-97C5-72977C340EC0}\Setup.exe
%PROGRAM_FILES%\InstallShield Installation Information\{5D6FF529-7C01-4C07-97C5-72977C340EC0}\Setue0bc.rra в %PROGRAM_FILES%\InstallShield Installation Information\{5D6FF529-7C01-4C07-97C5-72977C340EC0}\Setup.ini
%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\ctora317.rra в %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\ctor.dll
%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\objeb0e2.rra в %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\objectps.dll
%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\temp.000 в %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\IKernel.exe
%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\corea123.rra в %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\corecomp.ini
%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\iuseb24a.rra в %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\iuser.dll
%TEMP%\{5D6FF529-7C01-4C07-97C5-72977C340EC0}\valud0fd.rra в %TEMP%\{5D6FF529-7C01-4C07-97C5-72977C340EC0}\value.shl
%TEMP%\{5D6FF529-7C01-4C07-97C5-72977C340EC0}\isrtd293.rra в %TEMP%\{5D6FF529-7C01-4C07-97C5-72977C340EC0}\isrt.dll
%CommonProgramFiles%\InstallShield\IScript\iscrb8e1.rra в %CommonProgramFiles%\InstallShield\IScript\iscript.dll
%TEMP%\{5D6FF529-7C01-4C07-97C5-72977C340EC0}\setucf28.rra в %TEMP%\{5D6FF529-7C01-4C07-97C5-72977C340EC0}\setup.inx