Техническая информация
Для обеспечения автозапуска и распространения:
Изменяет следующие исполняемые системные файлы:
- <SYSTEM32>\libmysql.dll
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\cmd.exe' /c ""c:\LAYATUA\INST.BAT" "
Изменения в файловой системе:
Создает следующие файлы:
- C:\LAYATUA\gravar_nw.bmp
- C:\LAYATUA\GPS.bmp
- C:\LAYATUA\GPM.bmp
- C:\LAYATUA\imprimir_nw.bmp
- C:\LAYATUA\help2_nw.bmp
- C:\LAYATUA\help_nw.bmp
- C:\LAYATUA\excluir_nw.bmp
- C:\LAYATUA\desf_setor.bmp
- C:\LAYATUA\desf_geral.bmp
- C:\LAYATUA\fecha_setor.bmp
- C:\LAYATUA\fecha_geral.bmp
- C:\LAYATUA\expandir_nw.bmp
- C:\LAYATUA\processo_nw.bmp
- C:\LAYATUA\processar_nw.bmp
- C:\LAYATUA\open_nw.bmp
- C:\LAYATUA\restore_nw.bmp
- C:\LAYATUA\Reservprinc_nw.bmp
- C:\LAYATUA\rescisao_nw.bmp
- C:\LAYATUA\login.bmp
- C:\LAYATUA\localizar_nw.bmp
- C:\LAYATUA\liberar_nw.bmp
- C:\LAYATUA\mens_retornar.bmp
- C:\LAYATUA\mens_confirmar_nw.bmp
- C:\LAYATUA\mens_cancelar_nw.bmp
- C:\LAYATUA\dbxfb.dll
- C:\LAYATUA\WinRAR.exe
- C:\LAYATUA\VP.exe
- C:\LAYATUA\libmySQL.dll
- C:\LAYATUA\fbclient.dll
- C:\LAYATUA\dbxmys.dll
- C:\LAYATUA\RarExtLoader.exe
- C:\LAYATUA\Rar.exe
- C:\LAYATUA\INTPUB.exe
- C:\LAYATUA\UnRAR.exe
- C:\LAYATUA\Uninstall.exe
- C:\LAYATUA\sfpbkp2009.exe
- C:\LAYATUA\backup_nw.bmp
- C:\LAYATUA\alterar_nw.bmp
- C:\LAYATUA\afastamento_nw.bmp
- C:\LAYATUA\CriaArqui_nw.bmp
- C:\LAYATUA\confirmar_nw.bmp
- C:\LAYATUA\cancelar_nw.bmp
- C:\LAYATUA\sde61.dll
- C:\LAYATUA\RarExt64.dll
- C:\LAYATUA\RarExt.dll
- C:\LAYATUA\admissao_nw.bmp
- C:\LAYATUA\add_nw.bmp
- C:\LAYATUA\acessar_nw.bmp
- C:\LAYATUA\retornar_nw.bmp
- C:\LAYATUA\segoeuii.ttf
- C:\LAYATUA\segoeuib.ttf
- C:\LAYATUA\segoeui.ttf
- C:\LAYATUA\DADOSCONT.xls
- C:\LAYATUA\14.12A.VER
- C:\LAYATUA\segoeuiz.ttf
- C:\LAYATUA\calibri.ttf
- C:\LAYATUA\SCRIPTTPCONTAS.sql
- C:\LAYATUA\ScriptFieldsFolhaGRH.sql
- C:\LAYATUA\calibriz.ttf
- C:\LAYATUA\calibrii.ttf
- C:\LAYATUA\calibrib.ttf
- C:\LAYATUA\LOGOLAY.JPG
- C:\LAYATUA\LayoutAcesso.jpg
- C:\LAYATUA\marca da agua.PNG
- <SYSTEM32>\dbxmys.dll
- C:\LAYATUA\timbrado.JPG
- C:\LAYATUA\recalculo_2011.jpg
- C:\LAYATUA\icon2.gif
- C:\LAYATUA\icon1.gif
- C:\LAYATUA\PERSONALIZADO.xls
- C:\LAYATUA\BANNER_2013.png
- C:\LAYATUA\progress_bar.gif
- C:\LAYATUA\menu2_videoaula.gif
- C:\LAYATUA\rarnew.dat
- C:\LAYATUA\treeview.css
- C:\LAYATUA\WinRAR.chm
- C:\LAYATUA\Thumbs.db
- C:\LAYATUA\photothumb.db
- C:\LAYATUA\zipnew.dat
- C:\LAYATUA\usuario_nw.bmp
- C:\LAYATUA\senha_nw.bmp
- C:\LAYATUA\sair_nw.bmp
- C:\LAYATUA\progress_bar.avi
- C:\LAYATUA\copy_to_disk_large.avi
- C:\LAYATUA\versao.bmp
- C:\LAYATUA\WinCon.SFX
- C:\LAYATUA\Default.SFX
- C:\LAYATUA\winrar.lng
- C:\LAYATUA\SCRIPTBANCOS.sql
- C:\LAYATUA\MUNIC_IBGE.sql
- C:\LAYATUA\Zip.SFX
- C:\LAYATUA\SFP.INT
- C:\LAYATUA\index.hta
- C:\LAYATUA\REPORT.FDB
- C:\LAYATUA\uninstall.lng
- C:\LAYATUA\rarext.lng
- C:\LAYATUA\rar.lng
- C:\LAYATUA\Instala.exe
- C:\LAYATUA\14.06d.html
- C:\LAYATUA\14.06c.html
- C:\LAYATUA\14.06b.html
- C:\LAYATUA\14.08b.html
- C:\LAYATUA\14.07b.html
- C:\LAYATUA\14.07a.html
- C:\LAYATUA\14.04c.html
- C:\LAYATUA\14.04b.html
- C:\LAYATUA\14.04a.html
- C:\LAYATUA\14.06a.html
- C:\LAYATUA\14.05a.html
- C:\LAYATUA\14.04d.html
- C:\LAYATUA\14.11c.html
- C:\LAYATUA\14.11b.html
- C:\LAYATUA\14.11a.html
- C:\LAYATUA\Versao.html
- C:\LAYATUA\left.html
- C:\LAYATUA\index.html
- C:\LAYATUA\14.09d.html
- C:\LAYATUA\14.09c.html
- C:\LAYATUA\14.09b.html
- C:\LAYATUA\14.10c.html
- C:\LAYATUA\14.10b.html
- C:\LAYATUA\14.10a.html
- C:\LAYATUA\txtrar.txt
- C:\LAYATUA\TechNote.txt
- C:\LAYATUA\Rar.txt
- C:\LAYATUA\Order.htm
- C:\LAYATUA\WhatsNew.txt
- C:\LAYATUA\UnrarSrc.txt
- C:\LAYATUA\ReadMe.txt
- C:\LAYATUA\Descript.ion
- C:\LAYATUA\File_Id.diz
- C:\LAYATUA\License.txt
- C:\LAYATUA\deficMTE.txt
- C:\LAYATUA\CBO2002_Ocupacao.txt
- C:\LAYATUA\14.02e.html
- C:\LAYATUA\14.02d.html
- C:\LAYATUA\14.02c.html
- C:\LAYATUA\14.03c.html
- C:\LAYATUA\14.03b.html
- C:\LAYATUA\14.03a.html
- C:\LAYATUA\14.01c.html
- C:\LAYATUA\14.01b.html
- C:\LAYATUA\14.01a.html
- C:\LAYATUA\14.02b.html
- C:\LAYATUA\14.02a.html
- C:\LAYATUA\14.01d.html
- C:\LAYATUA\RarFiles.lst
- C:\LAYATUA\14.08D.rtf
- C:\LAYATUA\14.08C.rtf
- C:\LAYATUA\14.08B.rtf
- C:\LAYATUA\14.09B.rtf
- C:\LAYATUA\14.09A.rtf
- C:\LAYATUA\14.08E.rtf
- C:\LAYATUA\14.06D.rtf
- C:\LAYATUA\14.06C.rtf
- C:\LAYATUA\14.06B.rtf
- C:\LAYATUA\14.08A.rtf
- C:\LAYATUA\14.07B.rtf
- C:\LAYATUA\14.07A.rtf
- C:\LAYATUA\14.12A.rtf
- C:\LAYATUA\14.11C.rtf
- C:\LAYATUA\14.11B.rtf
- C:\LAYATUA\fmwsim.exe
- C:\LAYATUA\14.12A.exe
- C:\LAYATUA\HELPSFP.HLP
- C:\LAYATUA\14.10A.rtf
- C:\LAYATUA\14.09D.rtf
- C:\LAYATUA\14.09C.rtf
- C:\LAYATUA\14.11A.rtf
- C:\LAYATUA\14.10C.rtf
- C:\LAYATUA\14.10B.rtf
- C:\LAYATUA\14.01C.rtf
- C:\LAYATUA\14.01B.rtf
- C:\LAYATUA\14.01A.rtf
- C:\LAYATUA\14.02B.rtf
- C:\LAYATUA\14.02A.rtf
- C:\LAYATUA\14.01D.rtf
- C:\LAYATUA\HELP.ini
- C:\LAYATUA\desktop.ini
- C:\LAYATUA\Uninstall.lst
- C:\LAYATUA\PASTAS.BAT
- C:\LAYATUA\INST.BAT
- C:\LAYATUA\FIRE.BAT
- C:\LAYATUA\14.04C.rtf
- C:\LAYATUA\14.04B.rtf
- C:\LAYATUA\14.04A.rtf
- C:\LAYATUA\14.06A.rtf
- C:\LAYATUA\14.05A.rtf
- C:\LAYATUA\14.04D.rtf
- C:\LAYATUA\14.02E.rtf
- C:\LAYATUA\14.02D.rtf
- C:\LAYATUA\14.02C.rtf
- C:\LAYATUA\14.03C.rtf
- C:\LAYATUA\14.03B.rtf
- C:\LAYATUA\14.03A.rtf
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\LAYATUA\Thumbs.db
- C:\LAYATUA\photothumb.db
Удаляет следующие файлы:
- C:\LAYATUA\login.bmp
- C:\LAYATUA\localizar_nw.bmp
- C:\LAYATUA\LOGOLAY.JPG
- C:\LAYATUA\mens_cancelar_nw.bmp
- C:\LAYATUA\marca da agua.PNG
- C:\LAYATUA\License.txt
- C:\LAYATUA\LayoutAcesso.jpg
- C:\LAYATUA\INTPUB.exe
- C:\LAYATUA\left.html
- C:\LAYATUA\libmySQL.dll
- C:\LAYATUA\liberar_nw.bmp
- C:\LAYATUA\mens_confirmar_nw.bmp
- C:\LAYATUA\processar_nw.bmp
- C:\LAYATUA\PERSONALIZADO.xls
- C:\LAYATUA\processo_nw.bmp
- C:\LAYATUA\progress_bar.gif
- C:\LAYATUA\progress_bar.avi
- C:\LAYATUA\PASTAS.BAT
- C:\LAYATUA\menu2_videoaula.gif
- C:\LAYATUA\mens_retornar.bmp
- C:\LAYATUA\MUNIC_IBGE.sql
- C:\LAYATUA\Order.htm
- C:\LAYATUA\open_nw.bmp
- C:\LAYATUA\Instala.exe
- C:\LAYATUA\fecha_setor.bmp
- C:\LAYATUA\fecha_geral.bmp
- C:\LAYATUA\File_Id.diz
- C:\LAYATUA\fmwsim.exe
- C:\LAYATUA\FIRE.BAT
- C:\LAYATUA\fbclient.dll
- C:\LAYATUA\desf_setor.bmp
- C:\LAYATUA\desf_geral.bmp
- C:\LAYATUA\desktop.ini
- C:\LAYATUA\expandir_nw.bmp
- C:\LAYATUA\excluir_nw.bmp
- C:\LAYATUA\GPM.bmp
- C:\LAYATUA\icon2.gif
- C:\LAYATUA\icon1.gif
- C:\LAYATUA\imprimir_nw.bmp
- C:\LAYATUA\index.html
- C:\LAYATUA\index.hta
- C:\LAYATUA\help_nw.bmp
- C:\LAYATUA\gravar_nw.bmp
- C:\LAYATUA\GPS.bmp
- C:\LAYATUA\HELP.ini
- C:\LAYATUA\HELPSFP.HLP
- C:\LAYATUA\help2_nw.bmp
- C:\LAYATUA\Rar.exe
- C:\LAYATUA\Uninstall.exe
- C:\LAYATUA\txtrar.txt
- C:\LAYATUA\uninstall.lng
- C:\LAYATUA\UnRAR.exe
- C:\LAYATUA\Uninstall.lst
- C:\LAYATUA\treeview.css
- C:\LAYATUA\SFP.INT
- C:\LAYATUA\senha_nw.bmp
- C:\LAYATUA\sfpbkp2009.exe
- C:\LAYATUA\timbrado.JPG
- C:\LAYATUA\TechNote.txt
- C:\LAYATUA\UnrarSrc.txt
- C:\LAYATUA\WinRAR.exe
- C:\LAYATUA\WinRAR.chm
- C:\LAYATUA\winrar.lng
- C:\LAYATUA\zipnew.dat
- C:\LAYATUA\Zip.SFX
- C:\LAYATUA\WinCon.SFX
- C:\LAYATUA\versao.bmp
- C:\LAYATUA\usuario_nw.bmp
- C:\LAYATUA\Versao.html
- C:\LAYATUA\WhatsNew.txt
- C:\LAYATUA\VP.exe
- C:\LAYATUA\segoeuiz.ttf
- C:\LAYATUA\rarnew.dat
- C:\LAYATUA\RarFiles.lst
- C:\LAYATUA\ReadMe.txt
- C:\LAYATUA\REPORT.FDB
- C:\LAYATUA\recalculo_2011.jpg
- C:\LAYATUA\RarExtLoader.exe
- C:\LAYATUA\Rar.txt
- C:\LAYATUA\rar.lng
- C:\LAYATUA\RarExt.dll
- C:\LAYATUA\RarExt64.dll
- C:\LAYATUA\rarext.lng
- C:\LAYATUA\rescisao_nw.bmp
- C:\LAYATUA\sde61.dll
- C:\LAYATUA\SCRIPTTPCONTAS.sql
- C:\LAYATUA\segoeui.ttf
- C:\LAYATUA\segoeuii.ttf
- C:\LAYATUA\segoeuib.ttf
- C:\LAYATUA\ScriptFieldsFolhaGRH.sql
- C:\LAYATUA\restore_nw.bmp
- C:\LAYATUA\Reservprinc_nw.bmp
- C:\LAYATUA\retornar_nw.bmp
- C:\LAYATUA\SCRIPTBANCOS.sql
- C:\LAYATUA\sair_nw.bmp
- C:\LAYATUA\Descript.ion
- C:\LAYATUA\14.04D.rtf
- C:\LAYATUA\14.04d.html
- C:\LAYATUA\14.05a.html
- C:\LAYATUA\14.06a.html
- C:\LAYATUA\14.05A.rtf
- C:\LAYATUA\14.04C.rtf
- C:\LAYATUA\14.04A.rtf
- C:\LAYATUA\14.04a.html
- C:\LAYATUA\14.04b.html
- C:\LAYATUA\14.04c.html
- C:\LAYATUA\14.04B.rtf
- C:\LAYATUA\14.06A.rtf
- C:\LAYATUA\14.07A.rtf
- C:\LAYATUA\14.07a.html
- C:\LAYATUA\14.07b.html
- C:\LAYATUA\14.08A.rtf
- C:\LAYATUA\14.07B.rtf
- C:\LAYATUA\14.06D.rtf
- C:\LAYATUA\14.06B.rtf
- C:\LAYATUA\14.06b.html
- C:\LAYATUA\14.06c.html
- C:\LAYATUA\14.06d.html
- C:\LAYATUA\14.06C.rtf
- C:\LAYATUA\14.03C.rtf
- C:\LAYATUA\14.01D.rtf
- C:\LAYATUA\14.01d.html
- C:\LAYATUA\14.02a.html
- C:\LAYATUA\14.02b.html
- C:\LAYATUA\14.02A.rtf
- C:\LAYATUA\14.01C.rtf
- C:\LAYATUA\14.01A.rtf
- C:\LAYATUA\14.01a.html
- C:\LAYATUA\14.01b.html
- C:\LAYATUA\14.01c.html
- C:\LAYATUA\14.01B.rtf
- C:\LAYATUA\14.02B.rtf
- C:\LAYATUA\14.03A.rtf
- C:\LAYATUA\14.03a.html
- C:\LAYATUA\14.03b.html
- C:\LAYATUA\14.03c.html
- C:\LAYATUA\14.03B.rtf
- C:\LAYATUA\14.02E.rtf
- C:\LAYATUA\14.02C.rtf
- C:\LAYATUA\14.02c.html
- C:\LAYATUA\14.02d.html
- C:\LAYATUA\14.02e.html
- C:\LAYATUA\14.02D.rtf
- C:\LAYATUA\14.08b.html
- C:\LAYATUA\backup_nw.bmp
- C:\LAYATUA\alterar_nw.bmp
- C:\LAYATUA\BANNER_2013.png
- C:\LAYATUA\calibrib.ttf
- C:\LAYATUA\calibri.ttf
- C:\LAYATUA\afastamento_nw.bmp
- C:\LAYATUA\14.12A.VER
- C:\LAYATUA\14.12A.rtf
- C:\LAYATUA\acessar_nw.bmp
- C:\LAYATUA\admissao_nw.bmp
- C:\LAYATUA\add_nw.bmp
- C:\LAYATUA\calibrii.ttf
- C:\LAYATUA\dbxfb.dll
- C:\LAYATUA\DADOSCONT.xls
- C:\LAYATUA\dbxmys.dll
- C:\LAYATUA\deficMTE.txt
- C:\LAYATUA\Default.SFX
- C:\LAYATUA\CriaArqui_nw.bmp
- C:\LAYATUA\cancelar_nw.bmp
- C:\LAYATUA\calibriz.ttf
- C:\LAYATUA\CBO2002_Ocupacao.txt
- C:\LAYATUA\copy_to_disk_large.avi
- C:\LAYATUA\confirmar_nw.bmp
- C:\LAYATUA\14.12A.exe
- C:\LAYATUA\14.09c.html
- C:\LAYATUA\14.09B.rtf
- C:\LAYATUA\14.09C.rtf
- C:\LAYATUA\14.09D.rtf
- C:\LAYATUA\14.09d.html
- C:\LAYATUA\14.09b.html
- C:\LAYATUA\14.08C.rtf
- C:\LAYATUA\14.08B.rtf
- C:\LAYATUA\14.08D.rtf
- C:\LAYATUA\14.09A.rtf
- C:\LAYATUA\14.08E.rtf
- C:\LAYATUA\14.10a.html
- C:\LAYATUA\14.11b.html
- C:\LAYATUA\14.11A.rtf
- C:\LAYATUA\14.11B.rtf
- C:\LAYATUA\14.11C.rtf
- C:\LAYATUA\14.11c.html
- C:\LAYATUA\14.11a.html
- C:\LAYATUA\14.10b.html
- C:\LAYATUA\14.10A.rtf
- C:\LAYATUA\14.10B.rtf
- C:\LAYATUA\14.10C.rtf
- C:\LAYATUA\14.10c.html
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'EDIT' WindowName: ''
