Trojan.KillFiles.16719

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] 'LoadAppInit_DLLs' = '00000001'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '0wl' = '%PROGRAM_FILES%\WinLockPro\winlock.exe'

Вредоносные функции:

Создает и запускает на исполнение:

'%TEMP%\install\winlock.sfx.exe'
'%TEMP%\install\tryyyesesss.exe'
'%PROGRAM_FILES%\WinLockPro\elv.exe' -loadhive_2
'%TEMP%\install\wpro.exe' /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
'%TEMP%\is-ARIJ2.tmp\wpro.tmp' /SL5="$1013C,6556778,56832,%TEMP%\install\wpro.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-

Запускает на исполнение:

'<SYSTEM32>\cmd.exe' /c ""%TEMP%\install\sil_2.bat" "
'<SYSTEM32>\wbem\wmiadap.exe' /R /T

Изменения в файловой системе:

Создает следующие файлы:

%PROGRAM_FILES%\WinLockPro\Languages\is-1MQ6H.tmp
%ALLUSERSPROFILE%\Documents\WinLock\is-J7IP4.tmp
%PROGRAM_FILES%\WinLockPro\Languages\is-6FKLR.tmp
%PROGRAM_FILES%\WinLockPro\Languages\is-HL72L.tmp
%PROGRAM_FILES%\WinLockPro\Languages\is-HVBVJ.tmp
%ALLUSERSPROFILE%\Documents\WinLock\is-V7QBS.tmp
%ALLUSERSPROFILE%\Documents\WinLock\is-M42LR.tmp
%ALLUSERSPROFILE%\Documents\WinLock\is-7V0T8.tmp
%ALLUSERSPROFILE%\Documents\WinLock\is-02QPG.tmp
%ALLUSERSPROFILE%\Documents\WinLock\is-2KQ4D.tmp
%PROGRAM_FILES%\WinLockPro\Languages\is-C0ND5.tmp
%ALLUSERSPROFILE%\Start Menu\Programs\WinLock Professional.lnk
%PROGRAM_FILES%\WinLockPro\Languages\is-TIQI5.tmp
%PROGRAM_FILES%\WinLockPro\unins000.msg
%PROGRAM_FILES%\WinLockPro\winlock.exe
%PROGRAM_FILES%\WinLockPro\unins000.dat
%PROGRAM_FILES%\WinLockPro\Languages\is-DF82T.tmp
%PROGRAM_FILES%\WinLockPro\Languages\is-JKT9T.tmp
%PROGRAM_FILES%\WinLockPro\Languages\is-RF8E6.tmp
%PROGRAM_FILES%\WinLockPro\Languages\is-N9HGB.tmp
%PROGRAM_FILES%\WinLockPro\Languages\is-UJ6DR.tmp
%ALLUSERSPROFILE%\Documents\WinLock\is-1DL9S.tmp
%TEMP%\install\sil_2.bat
%TEMP%\install\tryyyesesss.exe
%TEMP%\is-ARIJ2.tmp\wpro.tmp
%PROGRAM_FILES%\WinLockPro\is-TGIQC.tmp
%TEMP%\is-7QCAG.tmp\_isetup\_shfoldr.dll
%TEMP%\$inst\temp_0.tmp
%TEMP%\$inst\2.tmp
%TEMP%\install\wpro.exe
%TEMP%\$inst\0001.tmp
%TEMP%\install\winlock.sfx.exe
%PROGRAM_FILES%\WinLockPro\is-VOCA4.tmp
%PROGRAM_FILES%\WinLockPro\is-P6KUG.tmp
%ALLUSERSPROFILE%\Application Data\Crystal Office\WL\is-FI535.tmp
%ALLUSERSPROFILE%\Documents\WinLock\is-F1LDS.tmp
%ALLUSERSPROFILE%\Documents\WinLock\is-V1O8H.tmp
%ALLUSERSPROFILE%\Documents\WinLock\is-RFUP4.tmp
%PROGRAM_FILES%\WinLockPro\is-CP8G6.tmp
%PROGRAM_FILES%\WinLockPro\is-L3GQ3.tmp
%PROGRAM_FILES%\WinLockPro\is-FACTS.tmp
%PROGRAM_FILES%\WinLockPro\is-IKIET.tmp
%PROGRAM_FILES%\WinLockPro\is-PTGUG.tmp

Удаляет следующие файлы:

%TEMP%\install\wpro.exe
%TEMP%\install\winlock.sfx.exe
<SYSTEM32>\wbem\Performance\WmiApRpl.ini
%TEMP%\$inst\2.tmp
<SYSTEM32>\PerfStringBackup.TMP
%TEMP%\$inst\0001.tmp
%TEMP%\$inst\temp_0.tmp
%TEMP%\is-7QCAG.tmp\_isetup\_shfoldr.dll
%TEMP%\install\tryyyesesss.exe
%TEMP%\is-ARIJ2.tmp\wpro.tmp

Перемещает следующие файлы:

%PROGRAM_FILES%\WinLockPro\Languages\is-1MQ6H.tmp в %PROGRAM_FILES%\WinLockPro\Languages\german.lng
%PROGRAM_FILES%\WinLockPro\Languages\is-6FKLR.tmp в %PROGRAM_FILES%\WinLockPro\Languages\french.lng
%PROGRAM_FILES%\WinLockPro\Languages\is-HVBVJ.tmp в %PROGRAM_FILES%\WinLockPro\Languages\russian.lng
%ALLUSERSPROFILE%\Documents\WinLock\is-J7IP4.tmp в %ALLUSERSPROFILE%\Documents\WinLock\websites.wlp
%ALLUSERSPROFILE%\Documents\WinLock\is-7V0T8.tmp в %ALLUSERSPROFILE%\Documents\WinLock\msg.wlp
%ALLUSERSPROFILE%\Documents\WinLock\is-2KQ4D.tmp в %ALLUSERSPROFILE%\Documents\WinLock\p2p.wlp
%ALLUSERSPROFILE%\Documents\WinLock\is-02QPG.tmp в %ALLUSERSPROFILE%\Documents\WinLock\system.wlp
%PROGRAM_FILES%\WinLockPro\Languages\is-HL72L.tmp в %PROGRAM_FILES%\WinLockPro\Languages\portugueseBR.lng
%PROGRAM_FILES%\WinLockPro\Languages\is-UJ6DR.tmp в %PROGRAM_FILES%\WinLockPro\Languages\chineseS.lng
%PROGRAM_FILES%\WinLockPro\Languages\is-N9HGB.tmp в %PROGRAM_FILES%\WinLockPro\Languages\italian.lng
%PROGRAM_FILES%\WinLockPro\Languages\is-TIQI5.tmp в %PROGRAM_FILES%\WinLockPro\Languages\indonesian.lng
%PROGRAM_FILES%\WinLockPro\Languages\is-RF8E6.tmp в %PROGRAM_FILES%\WinLockPro\Languages\hungarian.lng
%PROGRAM_FILES%\WinLockPro\Languages\is-C0ND5.tmp в %PROGRAM_FILES%\WinLockPro\Languages\spanish.lng
%PROGRAM_FILES%\WinLockPro\Languages\is-JKT9T.tmp в %PROGRAM_FILES%\WinLockPro\Languages\turkish.lng
%PROGRAM_FILES%\WinLockPro\Languages\is-DF82T.tmp в %PROGRAM_FILES%\WinLockPro\Languages\romanian.lng
%PROGRAM_FILES%\WinLockPro\is-FACTS.tmp в %PROGRAM_FILES%\WinLockPro\wlg.exe
%PROGRAM_FILES%\WinLockPro\is-PTGUG.tmp в %PROGRAM_FILES%\WinLockPro\winlock.chm
%PROGRAM_FILES%\WinLockPro\is-IKIET.tmp в %PROGRAM_FILES%\WinLockPro\license.txt
%PROGRAM_FILES%\WinLockPro\is-CP8G6.tmp в %PROGRAM_FILES%\WinLockPro\winlock.exe
%PROGRAM_FILES%\WinLockPro\is-TGIQC.tmp в %PROGRAM_FILES%\WinLockPro\unins000.exe
%PROGRAM_FILES%\WinLockPro\is-VOCA4.tmp в %PROGRAM_FILES%\WinLockPro\wlg32.dat
%PROGRAM_FILES%\WinLockPro\is-L3GQ3.tmp в %PROGRAM_FILES%\WinLockPro\elv.exe
%ALLUSERSPROFILE%\Application Data\Crystal Office\WL\is-FI535.tmp в %ALLUSERSPROFILE%\Application Data\Crystal Office\WL\winlocka.dat
%ALLUSERSPROFILE%\Documents\WinLock\is-1DL9S.tmp в %ALLUSERSPROFILE%\Documents\WinLock\internet.wlp
%ALLUSERSPROFILE%\Documents\WinLock\is-M42LR.tmp в %ALLUSERSPROFILE%\Documents\WinLock\kiosk.wlp
%ALLUSERSPROFILE%\Documents\WinLock\is-V7QBS.tmp в %ALLUSERSPROFILE%\Documents\WinLock\media.wlp
%ALLUSERSPROFILE%\Documents\WinLock\is-V1O8H.tmp в %ALLUSERSPROFILE%\Documents\WinLock\install.wlp
%PROGRAM_FILES%\WinLockPro\is-P6KUG.tmp в %PROGRAM_FILES%\WinLockPro\winlockw.dat
%ALLUSERSPROFILE%\Documents\WinLock\is-F1LDS.tmp в %ALLUSERSPROFILE%\Documents\WinLock\dialogs.wlp
%ALLUSERSPROFILE%\Documents\WinLock\is-RFUP4.tmp в %ALLUSERSPROFILE%\Documents\WinLock\games.wlp