Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Classes\PROTOCOLS\Filter\application/xhtml+xml; charset=utf-8] 'CLSID' = '{32F66A26-7614-11D4-BD11-00104BD3F987}'
- [<HKLM>\SOFTWARE\Classes\PROTOCOLS\Filter\application/xhtml+xml] 'CLSID' = '{32F66A26-7614-11D4-BD11-00104BD3F987}'
- [<HKLM>\SOFTWARE\Classes\dsieqnlib\shell\open\command] '' = '%PROGRAM_FILES%\Design Science\Common\Protocol Handlers\dsieqnlib\dsieqnlib.exe "%1"'
- [<HKLM>\SOFTWARE\Classes\PROTOCOLS\Filter\application/xhtml+xml; charset=iso-8859-1] 'CLSID' = '{32F66A26-7614-11D4-BD11-00104BD3F987}'
- [<HKLM>\SOFTWARE\Classes\PROTOCOLS\Filter\text/xml] 'CLSID' = '{32F66A26-7614-11D4-BD11-00104BD3F987}'
- [<HKLM>\SOFTWARE\Classes\PDFОДјю\shell\open\command] '' = '%PROGRAM_FILES%\їЛїЛPDFФД¶БЖч\їЛїЛPDFФД¶БЖч.exe %1'
- [<HKLM>\SOFTWARE\Classes\PROTOCOLS\Filter\text/xml; charset=iso-8859-1] 'CLSID' = '{32F66A26-7614-11D4-BD11-00104BD3F987}'
- [<HKLM>\SOFTWARE\Classes\PROTOCOLS\Filter\text/xml; charset=utf-8] 'CLSID' = '{32F66A26-7614-11D4-BD11-00104BD3F987}'
Вредоносные функции:
Создает и запускает на исполнение:
- '%TEMP%\RarSFX0\MathPlayer.exe' /s
- '%TEMP%\pft5~tmp\Setup.Exe' -i
- '%TEMP%\RarSFX0\AUTO_MathPlayer.exe'
- '%TEMP%\RarSFX0\kekepdfsetup.exe' /silent
- '%TEMP%\is-3HOTO.tmp\kekepdfsetup.tmp' /SL5="$10106,2132692,51712,%TEMP%\RarSFX0\kekepdfsetup.exe" /silent
Запускает на исполнение:
- '<SYSTEM32>\regsvr32.exe' /s "%PROGRAM_FILES%\їЛїЛPDFФД¶БЖч\hmButton.ocx"
- '<SYSTEM32>\regsvr32.exe' /s "%PROGRAM_FILES%\їЛїЛPDFФД¶БЖч\NewPdfOcx_L.dll"
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\RarSFX0\setup.bat" "
- '<SYSTEM32>\regsvr32.exe' /s "%PROGRAM_FILES%\їЛїЛPDFФД¶БЖч\COMDLG32.OCX"
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %PROGRAM_FILES%\Design Science\Common\Fonts\TrueType\eucsym.ttf
- %WINDIR%\Fonts\eucsym.ttf
- %PROGRAM_FILES%\Design Science\Common\Fonts\TrueType\eucsymb.ttf
- %WINDIR%\Fonts\euclidbi.ttf
- %PROGRAM_FILES%\Design Science\Common\Fonts\TrueType\euclidi.ttf
- %WINDIR%\Fonts\euclidi.ttf
- %PROGRAM_FILES%\Design Science\Common\Fonts\TrueType\eucsymi.ttf
- %WINDIR%\Fonts\eucsymi.ttf
- %PROGRAM_FILES%\Design Science\Common\Fonts\TrueType\euextra.ttf
- %WINDIR%\Fonts\eucsymb.ttf
- %PROGRAM_FILES%\Design Science\Common\Fonts\TrueType\eucsymbi.ttf
- %WINDIR%\Fonts\eucsymbi.ttf
- %TEMP%\pft5~tmp\About.gif
- %TEMP%\pft5~tmp\dsieqnlib.exe
- %PROGRAM_FILES%\Design Science\Common\Fonts\TrueType\mtextra.ttf
- %TEMP%\pft5~tmp\VersionCheck.Exe
- %TEMP%\pft5~tmp\Setup.inf
- %TEMP%\pft5~tmp\MathPlayer.dsc
- %PROGRAM_FILES%\Design Science\Common\Fonts\TrueType\euclidb.ttf
- %WINDIR%\Fonts\euclidb.ttf
- %PROGRAM_FILES%\Design Science\Common\Fonts\TrueType\euclidbi.ttf
- %WINDIR%\Fonts\mtextra.ttf
- %PROGRAM_FILES%\Design Science\Common\Fonts\TrueType\euclid.ttf
- %WINDIR%\Fonts\euclid.ttf
- %WINDIR%\Fonts\eumat2b.ttf
- %PROGRAM_FILES%\Design Science\MathPlayer\MathPlayer.dll
- %PROGRAM_FILES%\Design Science\MathPlayer\MathMLMimer.dll
- %PROGRAM_FILES%\Design Science\Common\Fonts\TrueType\eumat2.ttf
- %WINDIR%\Fonts\eumat2.ttf
- %PROGRAM_FILES%\Design Science\Common\Fonts\TrueType\eumat2b.ttf
- %PROGRAM_FILES%\Design Science\MathPlayer\MathPlayer.dsc
- %PROGRAM_FILES%\Design Science\Common\Protocol Handlers\dsieqnlib\dsieqnlib.exe
- %PROGRAM_FILES%\Design Science\MathPlayer\MathPlayer Install 1.log
- %PROGRAM_FILES%\Design Science\MathPlayer\Setup.exe
- %PROGRAM_FILES%\Design Science\MathPlayer\VersionCheck.exe
- %PROGRAM_FILES%\Design Science\MathPlayer\About.gif
- %PROGRAM_FILES%\Design Science\Common\Fonts\TrueType\eufrak.ttf
- %WINDIR%\Fonts\eufrak.ttf
- %PROGRAM_FILES%\Design Science\Common\Fonts\TrueType\eufrakb.ttf
- %WINDIR%\Fonts\euextra.ttf
- %PROGRAM_FILES%\Design Science\Common\Fonts\TrueType\euextrab.ttf
- %WINDIR%\Fonts\euextrab.ttf
- %WINDIR%\Fonts\eumat1.ttf
- %PROGRAM_FILES%\Design Science\Common\Fonts\TrueType\eumat1b.ttf
- %WINDIR%\Fonts\eumat1b.ttf
- %TEMP%\MathPlayer Install 1.log
- %WINDIR%\Fonts\eufrakb.ttf
- %PROGRAM_FILES%\Design Science\Common\Fonts\TrueType\eumat1.ttf
- %PROGRAM_FILES%\їЛїЛPDFФД¶БЖч\is-HNFV7.tmp
- %PROGRAM_FILES%\їЛїЛPDFФД¶БЖч\is-H641I.tmp
- %PROGRAM_FILES%\їЛїЛPDFФД¶БЖч\is-37DBF.tmp
- %PROGRAM_FILES%\їЛїЛPDFФД¶БЖч\is-U7GRA.tmp
- %PROGRAM_FILES%\їЛїЛPDFФД¶БЖч\is-R2QH8.tmp
- %PROGRAM_FILES%\їЛїЛPDFФД¶БЖч\is-N10A7.tmp
- %ALLUSERSPROFILE%\Desktop\їЛїЛPDFФД¶БЖч.lnk
- %PROGRAM_FILES%\їЛїЛPDFФД¶БЖч\unins000.dat
- %TEMP%\ext2.tmp
- %ALLUSERSPROFILE%\Start Menu\Programs\їЛїЛPDFФД¶БЖч\їЛїЛPDFФД¶БЖч.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\їЛїЛPDFФД¶БЖч\їЛїЛPDFФД¶БЖч НшХѕ.url
- %ALLUSERSPROFILE%\Start Menu\Programs\їЛїЛPDFФД¶БЖч\Р¶ФШ їЛїЛPDFФД¶БЖч.lnk
- %TEMP%\RarSFX0\setup.bat
- %TEMP%\RarSFX0\AUTO_MathPlayer.exe
- %TEMP%\is-3HOTO.tmp\kekepdfsetup.tmp
- %TEMP%\RarSFX0\setup.reg
- %TEMP%\RarSFX0\MathPlayer.exe
- %TEMP%\RarSFX0\kekepdfsetup.exe
- %PROGRAM_FILES%\їЛїЛPDFФД¶БЖч\is-GP5M1.tmp
- %PROGRAM_FILES%\їЛїЛPDFФД¶БЖч\is-43AB5.tmp
- %PROGRAM_FILES%\їЛїЛPDFФД¶БЖч\is-18TGV.tmp
- %TEMP%\is-LHEAC.tmp\_isetup\_RegDLL.tmp
- %TEMP%\is-LHEAC.tmp\_isetup\_shfoldr.dll
- %PROGRAM_FILES%\їЛїЛPDFФД¶БЖч\is-80IB9.tmp
- %TEMP%\pft5~tmp\EuFrakb.ttf
- %TEMP%\pft5~tmp\EuMat1.ttf
- %TEMP%\pft5~tmp\EuMat1b.ttf
- %TEMP%\pft5~tmp\EuExtra.ttf
- %TEMP%\pft5~tmp\EuExtrab.ttf
- %TEMP%\pft5~tmp\EuFrak.ttf
- %TEMP%\pft5~tmp\MathMLMimer.dll
- %TEMP%\pft5~tmp\MTExtra.ttf
- %TEMP%\pft5~tmp\Setup.Exe
- %TEMP%\pft5~tmp\EuMat2.ttf
- %TEMP%\pft5~tmp\EuMat2b.ttf
- %TEMP%\pft5~tmp\MathPlayer.dll
- %TEMP%\pft5~tmp\pftw1.pkg
- %TEMP%\pft5~tmp\Euclid.ttf
- %TEMP%\pft5~tmp\Euclidb.ttf
- %TEMP%\wel1.tmp
- %TEMP%\ext4.tmp
- %TEMP%\plf3.tmp
- %TEMP%\pft5~tmp\EucSymb.ttf
- %TEMP%\pft5~tmp\EucSymbi.ttf
- %TEMP%\pft5~tmp\EucSymi.ttf
- %TEMP%\pft5~tmp\Euclidbi.ttf
- %TEMP%\pft5~tmp\Euclidi.ttf
- %TEMP%\pft5~tmp\EucSym.ttf
Удаляет следующие файлы:
- %TEMP%\wel1.tmp
- %TEMP%\ext4.tmp
- %TEMP%\pft5~tmp\pftw1.pkg
- %TEMP%\ext2.tmp
- %TEMP%\is-LHEAC.tmp\_isetup\_RegDLL.tmp
- %TEMP%\is-LHEAC.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-3HOTO.tmp\kekepdfsetup.tmp
Перемещает следующие файлы:
- %PROGRAM_FILES%\їЛїЛPDFФД¶БЖч\is-N10A7.tmp в %PROGRAM_FILES%\їЛїЛPDFФД¶БЖч\pdfico.ico
- %PROGRAM_FILES%\їЛїЛPDFФД¶БЖч\is-R2QH8.tmp в %PROGRAM_FILES%\їЛїЛPDFФД¶БЖч\pdf.ini
- %PROGRAM_FILES%\їЛїЛPDFФД¶БЖч\is-HNFV7.tmp в %PROGRAM_FILES%\їЛїЛPDFФД¶БЖч\їЛїЛPDFФД¶БЖч.exe
- %PROGRAM_FILES%\їЛїЛPDFФД¶БЖч\is-37DBF.tmp в %PROGRAM_FILES%\їЛїЛPDFФД¶БЖч\mypdf.ini
- %PROGRAM_FILES%\їЛїЛPDFФД¶БЖч\is-H641I.tmp в %PROGRAM_FILES%\їЛїЛPDFФД¶БЖч\їЛїЛPDFФД¶БЖч.exe.PDFOCX.lic
- %PROGRAM_FILES%\їЛїЛPDFФД¶БЖч\is-GP5M1.tmp в %PROGRAM_FILES%\їЛїЛPDFФД¶БЖч\bk.ini
- %PROGRAM_FILES%\їЛїЛPDFФД¶БЖч\is-80IB9.tmp в %PROGRAM_FILES%\їЛїЛPDFФД¶БЖч\unins000.exe
- %PROGRAM_FILES%\їЛїЛPDFФД¶БЖч\is-43AB5.tmp в %PROGRAM_FILES%\їЛїЛPDFФД¶БЖч\COMDLG32.OCX
- %PROGRAM_FILES%\їЛїЛPDFФД¶БЖч\is-U7GRA.tmp в %PROGRAM_FILES%\їЛїЛPDFФД¶БЖч\NewPdfOcx_L.dll
- %PROGRAM_FILES%\їЛїЛPDFФД¶БЖч\is-18TGV.tmp в %PROGRAM_FILES%\їЛїЛPDFФД¶БЖч\hmButton.ocx
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'EDIT' WindowName: ''
