Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'AHNSD' = '"%PROGRAM_FILES%\AhnLab\Smart Update Utility\AhnSD.exe"'
Вредоносные функции:
Создает и запускает на исполнение:
- '%PROGRAM_FILES%\AhnLab\Smart Update Utility\AhnSD.exe'
- '%TEMP%\V3IS7PE\Smart Update Utility\Setup.exe' /NoRunOnce
- '%TEMP%\V3IS7PE\APSetup.exe'
Запускает на исполнение:
- '%WINDIR%\regedit.exe' /s "%TEMP%\V3IS7PE\Smart Update Utility\SUpdate\su.reg"
- '<SYSTEM32>\wbem\wmiadap.exe' /R /T
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsl2.tmp\V3DD.dll
- %PROGRAM_FILES%\AhnLab\Smart Update Utility\Supdate.svr
- %TEMP%\nsl2.tmp\V3DE.dll
- %PROGRAM_FILES%\AhnLab\Smart Update Utility\V3DD.dll
- %TEMP%\nsl2.tmp\supdate.svr
- %PROGRAM_FILES%\AhnLab\Smart Update Utility\SUpdate.exe
- %TEMP%\nsl2.tmp\SUpdate.exe
- %PROGRAM_FILES%\AhnLab\Smart Update Utility\supdate.scd
- %TEMP%\nsl2.tmp\supdate.scd
- %PROGRAM_FILES%\AhnLab\Smart Update Utility\V3DE.dll
- %TEMP%\nsl2.tmp\suma0409.nls
- %PROGRAM_FILES%\AhnLab\Smart Update Utility\nls\AUp0409.nls
- %TEMP%\nsl2.tmp\AUp0411.nls
- %PROGRAM_FILES%\AhnLab\Smart Update Utility\nls\suma0409.nls
- %TEMP%\nsl2.tmp\AUp0409.nls
- %PROGRAM_FILES%\AhnLab\Smart Update Utility\V3HUNT.dll
- %TEMP%\nsl2.tmp\V3Hunt.dll
- %PROGRAM_FILES%\AhnLab\Smart Update Utility\V3INet.dll
- %TEMP%\nsl2.tmp\V3Inet.dll
- %PROGRAM_FILES%\AhnLab\Smart Update Utility\SUCer.exe
- %TEMP%\nsl2.tmp\SUCer.exe
- %PROGRAM_FILES%\AhnLab\Smart Update Utility\SUHP0404.chm
- %TEMP%\nsl2.tmp\SUHP0404.chm
- %PROGRAM_FILES%\AhnLab\Smart Update Utility\suc.svr
- %TEMP%\nsl2.tmp\subz32.dll
- %PROGRAM_FILES%\AhnLab\Smart Update Utility\BldInfo.ini
- %TEMP%\nsl2.tmp\suc.svr
- %PROGRAM_FILES%\AhnLab\Smart Update Utility\subz32.dll
- %TEMP%\nsl2.tmp\SUHP0409.chm
- %PROGRAM_FILES%\AhnLab\Smart Update Utility\SUHP0804.chm
- %TEMP%\nsl2.tmp\SUHP0804.chm
- %PROGRAM_FILES%\AhnLab\Smart Update Utility\supdate.dlt
- %TEMP%\nsl2.tmp\supdate.dlt
- %PROGRAM_FILES%\AhnLab\Smart Update Utility\SUHP0412.chm
- %TEMP%\nsl2.tmp\SUHP0411.chm
- %PROGRAM_FILES%\AhnLab\Smart Update Utility\SUHP0409.chm
- %TEMP%\nsl2.tmp\SUHP0412.chm
- %PROGRAM_FILES%\AhnLab\Smart Update Utility\SUHP0411.chm
- %PROGRAM_FILES%\AhnLab\Smart Update Utility\nls\AUp0411.nls
- %PROGRAM_FILES%\AhnLab\Smart Update Utility\nls\AUp0404.nls
- %TEMP%\nsl2.tmp\AUp0404.nls
- %PROGRAM_FILES%\AhnLab\Smart Update Utility\nls\suc0404.nls
- %TEMP%\nsl2.tmp\suc0404.nls
- %PROGRAM_FILES%\AhnLab\Smart Update Utility\nls\ASD0404.nls
- %TEMP%\nsl2.tmp\suma0804.nls
- %PROGRAM_FILES%\AhnLab\Smart Update Utility\nls\suma0412.nls
- %TEMP%\nsl2.tmp\ASD0404.nls
- %PROGRAM_FILES%\AhnLab\Smart Update Utility\nls\suma0804.nls
- %TEMP%\nsl2.tmp\suma0404.nls
- %PROGRAM_FILES%\AhnLab\Smart Update Utility\Uninst.exe
- %PROGRAM_FILES%\AhnLab\Smart Update Utility\supdate.log
- %ALLUSERSPROFILE%\Start Menu\Programs\AhnLab\Smart Update Utility\Smart Update Utility Uninstall.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\AhnLab\Smart Update Utility\Smart Update Utility.lnk
- %PROGRAM_FILES%\AhnLab\Smart Update Utility\Supdate.env
- %TEMP%\nsl2.tmp\acaif.exe
- %PROGRAM_FILES%\AhnLab\Smart Update Utility\nls\suma0404.nls
- %TEMP%\nsl2.tmp\SUpdate.env
- %PROGRAM_FILES%\AhnLab\Smart Update Utility\acaif.exe
- %TEMP%\nsl2.tmp\ASD0412.nls
- %PROGRAM_FILES%\AhnLab\Smart Update Utility\nls\ASD0411.nls
- %TEMP%\nsl2.tmp\ASD0804.nls
- %PROGRAM_FILES%\AhnLab\Smart Update Utility\nls\ASD0412.nls
- %TEMP%\nsl2.tmp\ASD0411.nls
- %PROGRAM_FILES%\AhnLab\Smart Update Utility\nls\AUp0412.nls
- %TEMP%\nsl2.tmp\AUp0412.nls
- %PROGRAM_FILES%\AhnLab\Smart Update Utility\nls\AUp0804.nls
- %TEMP%\nsl2.tmp\AUp0804.nls
- %PROGRAM_FILES%\AhnLab\Smart Update Utility\nls\ASD0804.nls
- %TEMP%\nsl2.tmp\suma0411.nls
- %PROGRAM_FILES%\AhnLab\Smart Update Utility\nls\suc0804.nls
- %TEMP%\nsl2.tmp\suma0412.nls
- %PROGRAM_FILES%\AhnLab\Smart Update Utility\nls\suma0411.nls
- %TEMP%\nsl2.tmp\suc0804.nls
- %PROGRAM_FILES%\AhnLab\Smart Update Utility\nls\suc0411.nls
- %TEMP%\nsl2.tmp\suc0411.nls
- %PROGRAM_FILES%\AhnLab\Smart Update Utility\nls\suc0412.nls
- %TEMP%\nsl2.tmp\suc0412.nls
- %TEMP%\nsl2.tmp\BldInfo.ini
- %TEMP%\V3IS7PE\AhnLab V3 Internet Security 7.0 Platinum Enterprise\_Setup\Common_Res_V3IS2007PE.nz
- %TEMP%\V3IS7PE\AhnLab V3 Internet Security 7.0 Platinum Enterprise\_Setup\Common_Res_Common.nz
- %TEMP%\V3IS7PE\AhnLab V3 Internet Security 7.0 Platinum Enterprise\_Setup\MSFiles_NT32.nz
- %TEMP%\V3IS7PE\Smart Update Utility\_Setup\CP_SUpdate.nz
- %TEMP%\V3IS7PE\AhnLab V3 Internet Security 7.0 Platinum Enterprise\_Setup\Common_NT32.nz
- %TEMP%\V3IS7PE\AhnLab V3 Internet Security 7.0 Platinum Enterprise\Trinity\V3SZCfg.dat
- %TEMP%\V3IS7PE\AhnLab V3 Internet Security 7.0 Platinum Enterprise\AhnSec.dat
- %TEMP%\V3IS7PE\AhnLab V3 Internet Security 7.0 Platinum Enterprise\_Setup\Common.nz
- %TEMP%\V3IS7PE\AhnLab V3 Internet Security 7.0 Platinum Enterprise\ACA\_Setup\ACA.nz
- %TEMP%\V3IS7PE\AhnLab V3 Internet Security 7.0 Platinum Enterprise\_Setup\SpyZero2007_NT32.nz
- %TEMP%\V3IS7PE\AhnLab V3 Internet Security 7.0 Platinum Enterprise\_Setup\V3IS2007PE.nz
- %TEMP%\V3IS7PE\AhnLab V3 Internet Security 7.0 Platinum Enterprise\_Setup\V3IS2007_NT32.nz
- %TEMP%\V3IS7PE\AhnLab V3 Internet Security 7.0 Platinum Enterprise\IS2007\IfPR0409.ply
- %TEMP%\V3IS7PE\AhnLab V3 Internet Security 7.0 Platinum Enterprise\_Setup\V3IS2007PE_NT32.nz
- %TEMP%\V3IS7PE\AhnLab V3 Internet Security 7.0 Platinum Enterprise\_Setup\V3IS_Common_NT32.nz
- %TEMP%\V3IS7PE\AhnLab V3 Internet Security 7.0 Platinum Enterprise\Engine\V3Engine_Common.nz
- %TEMP%\V3IS7PE\AhnLab V3 Internet Security 7.0 Platinum Enterprise\Engine\SZEngine.nz
- %TEMP%\V3IS7PE\AhnLab V3 Internet Security 7.0 Platinum Enterprise\_Setup\V3IS_Common.nz
- %TEMP%\V3IS7PE\AhnLab V3 Internet Security 7.0 Platinum Enterprise\Engine\V3Engine_NT32.nz
- %TEMP%\V3IS7PE\Smart Update Utility\BldInfo.ini
- %TEMP%\V3IS7PE\AhnLab V3 Internet Security 7.0 Platinum Enterprise\BldInfo.ini
- %TEMP%\V3IS7PE\AhnLab V3 Internet Security 7.0 Platinum Enterprise\MpSetup.ini
- %TEMP%\V3IS7PE\Smart Update Utility\MpSetup.ini
- %TEMP%\V3IS7PE\AhnLab V3 Internet Security 7.0 Platinum Enterprise\ACA\BldInfo.ini
- %TEMP%\V3IS7PE\AhnLab V3 Internet Security 7.0 Platinum Enterprise\_Setup\License_jp_JP.txt
- %TEMP%\V3IS7PE\AhnLab V3 Internet Security 7.0 Platinum Enterprise\_Setup\License_en_US.txt
- %TEMP%\V3IS7PE\APSetup.ini
- %TEMP%\V3IS7PE\AhnLab V3 Internet Security 7.0 Platinum Enterprise\_Setup\License_ko_KR.txt
- %TEMP%\V3IS7PE\APSetup.exe
- %TEMP%\V3IS7PE\AhnLab V3 Internet Security 7.0 Platinum Enterprise\Remover\RmSZ.ahn
- %TEMP%\V3IS7PE\AhnLab V3 Internet Security 7.0 Platinum Enterprise\Remover\RmACS.ahn
- %TEMP%\V3IS7PE\Smart Update Utility\AhnSec.dat
- %TEMP%\V3IS7PE\AhnLab V3 Internet Security 7.0 Platinum Enterprise\ACA\Ahnsec.dat
- %TEMP%\V3IS7PE\Smart Update Utility\SUpdate\AhnUpCtl.dll
- %TEMP%\V3IS7PE\AhnLab V3 Internet Security 7.0 Platinum Enterprise\Setup.exe
- %TEMP%\V3IS7PE\AhnLab V3 Internet Security 7.0 Platinum Enterprise\ACA\Setup.exe
- %TEMP%\V3IS7PE\Smart Update Utility\SUpdate\SUCfgure.exe
- %TEMP%\V3IS7PE\Smart Update Utility\Setup.exe
- %TEMP%\V3IS7PE\AhnLab V3 Internet Security 7.0 Platinum Enterprise\IS2007\IfPR0411.ply
- %PROGRAM_FILES%\AhnLab\Smart Update Utility\AhnUp.dll
- %TEMP%\nsl2.tmp\AhnUp.dll
- %PROGRAM_FILES%\AhnLab\Smart Update Utility\AhnUpCtl.dll
- %TEMP%\nsl2.tmp\AhnUpCtl.dll
- %PROGRAM_FILES%\AhnLab\Smart Update Utility\AhnSDsv.exe
- %TEMP%\nsl2.tmp\AhnI2.dll
- %PROGRAM_FILES%\AhnLab\Smart Update Utility\AhnI18N.dll
- %TEMP%\nsl2.tmp\AhnSDsv.exe
- %PROGRAM_FILES%\AhnLab\Smart Update Utility\AhnI2.dll
- %TEMP%\nsl2.tmp\ds.svr
- %PROGRAM_FILES%\AhnLab\Smart Update Utility\MSVCP60.DLL
- %TEMP%\nsl2.tmp\MSVCP60.DLL
- %PROGRAM_FILES%\AhnLab\Smart Update Utility\Msvcrt.dll
- %TEMP%\nsl2.tmp\Msvcrt.dll
- %PROGRAM_FILES%\AhnLab\Smart Update Utility\Mfc42.dll
- %TEMP%\nsl2.tmp\mspatcha.dll
- %PROGRAM_FILES%\AhnLab\Smart Update Utility\ds.svr
- %TEMP%\nsl2.tmp\Mfc42.dll
- %PROGRAM_FILES%\AhnLab\Smart Update Utility\mspatcha.dll
- %TEMP%\nsl2.tmp\AIS_PageUnConfirm.ini
- %TEMP%\nsl2.tmp\AI7z20.dll
- %WINDIR%\AhnInst.log
- %TEMP%\nsl2.tmp\AhnIEx.dll
- %TEMP%\nsl2.tmp\AhnInstt.dll
- %TEMP%\V3IS7PE\AhnLab V3 Internet Security 7.0 Platinum Enterprise\IS2007\IfPR0804.ply
- %TEMP%\V3IS7PE\AhnLab V3 Internet Security 7.0 Platinum Enterprise\IS2007\IfPR0412.ply
- %WINDIR%\APRBoot.ini
- %TEMP%\V3IS7PE\Smart Update Utility\SUpdate\su.reg
- %TEMP%\nsl2.tmp\System.dll
- %TEMP%\nsl2.tmp\AhnSD.exe
- %TEMP%\nsl2.tmp\Psapi.Dll
- %TEMP%\nsl2.tmp\AhnI18N.dll
- %PROGRAM_FILES%\AhnLab\Smart Update Utility\AhnSD.exe
- %TEMP%\nsl2.tmp\Comctl32.dll
- %TEMP%\nsl2.tmp\modern-wizard.bmp
- %TEMP%\nsl2.tmp\ioSpecial.ini
- %TEMP%\nsl2.tmp\AhnSDNSIS.dll
- %TEMP%\nsl2.tmp\modern-header.bmp
Удаляет следующие файлы:
- %TEMP%\nsl2.tmp\ASD0411.nls
- %TEMP%\nsl2.tmp\AUp0804.nls
- %TEMP%\nsl2.tmp\AUp0412.nls
- %TEMP%\nsl2.tmp\suc0411.nls
- %TEMP%\nsl2.tmp\ASD0804.nls
- %TEMP%\nsl2.tmp\ASD0412.nls
- %TEMP%\nsl2.tmp\V3Inet.dll
- %TEMP%\nsl2.tmp\V3Hunt.dll
- %TEMP%\nsl2.tmp\V3DE.dll
- %TEMP%\nsl2.tmp\AUp0411.nls
- %TEMP%\nsl2.tmp\suma0409.nls
- %TEMP%\nsl2.tmp\AUp0409.nls
- %TEMP%\nsl2.tmp\suc0412.nls
- %TEMP%\nsl2.tmp\acaif.exe
- %TEMP%\nsl2.tmp\suma0404.nls
- %TEMP%\nsl2.tmp\suc0404.nls
- <SYSTEM32>\PerfStringBackup.TMP
- <SYSTEM32>\wbem\Performance\WmiApRpl.ini
- %TEMP%\nsl2.tmp\SUpdate.env
- %TEMP%\nsl2.tmp\suma0412.nls
- %TEMP%\nsl2.tmp\suma0411.nls
- %TEMP%\nsl2.tmp\suc0804.nls
- %TEMP%\nsl2.tmp\AUp0404.nls
- %TEMP%\nsl2.tmp\ASD0404.nls
- %TEMP%\nsl2.tmp\suma0804.nls
- %TEMP%\nsl2.tmp\Mfc42.dll
- %TEMP%\nsl2.tmp\mspatcha.dll
- %TEMP%\nsl2.tmp\ds.svr
- %TEMP%\nsl2.tmp\BldInfo.ini
- %TEMP%\nsl2.tmp\Msvcrt.dll
- %TEMP%\nsl2.tmp\MSVCP60.DLL
- %TEMP%\nsl2.tmp\AhnI2.dll
- %TEMP%\nsl2.tmp\AhnI18N.dll
- %TEMP%\nsl2.tmp\AhnSD.exe
- %TEMP%\nsl2.tmp\AhnUpCtl.dll
- %TEMP%\nsl2.tmp\AhnUp.dll
- %TEMP%\nsl2.tmp\AhnSDsv.exe
- %TEMP%\nsl2.tmp\subz32.dll
- %TEMP%\nsl2.tmp\SUpdate.exe
- %TEMP%\nsl2.tmp\supdate.dlt
- %TEMP%\nsl2.tmp\SUHP0804.chm
- %TEMP%\nsl2.tmp\V3DD.dll
- %TEMP%\nsl2.tmp\supdate.svr
- %TEMP%\nsl2.tmp\supdate.scd
- %TEMP%\nsl2.tmp\SUHP0404.chm
- %TEMP%\nsl2.tmp\SUCer.exe
- %TEMP%\nsl2.tmp\suc.svr
- %TEMP%\nsl2.tmp\SUHP0412.chm
- %TEMP%\nsl2.tmp\SUHP0411.chm
- %TEMP%\nsl2.tmp\SUHP0409.chm
Другое:
Ищет следующие окна:
- ClassName: 'AHNSD' WindowName: ''
- ClassName: 'RegEdit_RegEdit' WindowName: ''
- ClassName: '#32770' WindowName: ''
- ClassName: 'EDIT' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
