Trojan.KillFiles.17374

Техническая информация

Вредоносные функции:

Создает и запускает на исполнение:

'%PROGRAM_FILES%\Wanadoo\afxmsg.exe' Wanadoo\Initializing ...
'%PROGRAM_FILES%\Wanadoo\Shell.exe' %PROGRAM_FILES%\Wanadoo\prepareinstall.shl
'%PROGRAM_FILES%\Wanadoo\Shell.exe' prepareinstallCustom.shl
'%PROGRAM_FILES%\Wanadoo\tuer.exe' taskbaricon.exe
'%PROGRAM_FILES%\Wanadoo\Shell.exe' %PROGRAM_FILES%\Wanadoo\subisrunning.shl|PROCESSNAME=instal~1.exe
'%PROGRAM_FILES%\Wanadoo\Shell.exe' %PROGRAM_FILES%\Wanadoo\subisrunning.shl|PROCESSNAME=installv5.exe

Запускает на исполнение:

'<SYSTEM32>\wbem\wmiadap.exe' /R /T

Изменения в файловой системе:

Создает следующие файлы:

%PROGRAM_FILES%\Wanadoo\~GLH0004.TMP
%PROGRAM_FILES%\Wanadoo\~GLH0003.TMP
%PROGRAM_FILES%\Wanadoo\~GLH0005.TMP
%PROGRAM_FILES%\Wanadoo\~GLH0007.TMP
%PROGRAM_FILES%\Wanadoo\~GLH0006.TMP
%PROGRAM_FILES%\Wanadoo\~GLH0002.TMP
%PROGRAM_FILES%\Wanadoo\~GLH0001.TMP
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING2.MAP
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.DATA
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\RestorePointSize
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.MAP
%PROGRAM_FILES%\Wanadoo\~GLH0008.TMP
%PROGRAM_FILES%\Wanadoo\shell.txt
%PROGRAM_FILES%\Wanadoo\~GLH000f.TMP
%WINDIR%\Kit.ini
%PROGRAM_FILES%\Wanadoo\~GLH0011.TMP
%PROGRAM_FILES%\Wanadoo\~GLH0010.TMP
%PROGRAM_FILES%\Wanadoo\~GLH000e.TMP
%PROGRAM_FILES%\Wanadoo\~GLH000a.TMP
%PROGRAM_FILES%\Wanadoo\~GLH0009.TMP
%PROGRAM_FILES%\Wanadoo\~GLH000b.TMP
%PROGRAM_FILES%\Wanadoo\Component\~GLH000d.TMP
%PROGRAM_FILES%\Wanadoo\~GLH000c.TMP
%TEMP%\GLI5.tmp
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-2052111302-484763869-725345543-1003
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SECURITY
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_.DEFAULT
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\rp.log
%TEMP%\GLC1.tmp
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SOFTWARE
%TEMP%\~GLH0000.TMP
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.BTR
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.MAP
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING1.MAP
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING.VER
%TEMP%\GLG3.tmp
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SAM
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SYSTEM
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\ComDb.Dat
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\$WinMgmt.CFG
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\domain.txt

Удаляет следующие файлы:

%PROGRAM_FILES%\Wanadoo\AfxMsg.exe
<SYSTEM32>\wbem\Performance\WmiApRpl.ini
%PROGRAM_FILES%\Wanadoo\warning.txt
%TEMP%\GLG3.tmp
%PROGRAM_FILES%\Wanadoo\tuer.exe

Перемещает следующие файлы:

%PROGRAM_FILES%\Wanadoo\~GLH000b.TMP в %PROGRAM_FILES%\Wanadoo\Tuer.exe
%PROGRAM_FILES%\Wanadoo\~GLH000c.TMP в %PROGRAM_FILES%\Wanadoo\warning.txt
%PROGRAM_FILES%\Wanadoo\~GLH0009.TMP в %PROGRAM_FILES%\Wanadoo\Shell.exe
%PROGRAM_FILES%\Wanadoo\~GLH000a.TMP в %PROGRAM_FILES%\Wanadoo\subIsRunning.shl
%PROGRAM_FILES%\Wanadoo\Component\~GLH000d.TMP в %PROGRAM_FILES%\Wanadoo\Component\SOFTIsRunning.xml
%PROGRAM_FILES%\Wanadoo\~GLH0010.TMP в %PROGRAM_FILES%\Wanadoo\warning.txt
%PROGRAM_FILES%\Wanadoo\~GLH0011.TMP в %PROGRAM_FILES%\Wanadoo\afxmsg.exe
%PROGRAM_FILES%\Wanadoo\~GLH000e.TMP в %PROGRAM_FILES%\Wanadoo\prepareinstallCustom.shl
%PROGRAM_FILES%\Wanadoo\~GLH000f.TMP в %PROGRAM_FILES%\Wanadoo\Ref_Kit.xml
%PROGRAM_FILES%\Wanadoo\~GLH0002.TMP в %PROGRAM_FILES%\Wanadoo\AfxMsg.exe
%PROGRAM_FILES%\Wanadoo\~GLH0003.TMP в %PROGRAM_FILES%\Wanadoo\DetectComponent.dll
%TEMP%\~GLH0000.TMP в %TEMP%\GLF4.tmp
%PROGRAM_FILES%\Wanadoo\~GLH0001.TMP в %PROGRAM_FILES%\Wanadoo\tuer.exe
%PROGRAM_FILES%\Wanadoo\~GLH0004.TMP в %PROGRAM_FILES%\Wanadoo\mfc42.dll
%PROGRAM_FILES%\Wanadoo\~GLH0007.TMP в %PROGRAM_FILES%\Wanadoo\prepareinstall.shl
%PROGRAM_FILES%\Wanadoo\~GLH0008.TMP в %PROGRAM_FILES%\Wanadoo\PSAPI.DLL
%PROGRAM_FILES%\Wanadoo\~GLH0005.TMP в %PROGRAM_FILES%\Wanadoo\msvcrt.dll
%PROGRAM_FILES%\Wanadoo\~GLH0006.TMP в %PROGRAM_FILES%\Wanadoo\OutilsFT.dll