Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Classes\nolfile\shell\open\command] '' = '%PROGRAM_FILES%\CA\SharedComponents\CA_LIC\mergeolf.exe "%1" -r'
- [<HKLM>\SOFTWARE\Classes\Applications\mergeolf.exe\shell\open\command] '' = '%PROGRAM_FILES%\CA\SharedComponents\CA_LIC\mergeolf.exe "%1" -r'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\LogWatch] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- '%WINDIR%\Installer\MSI15.tmp'
- '%WINDIR%\Installer\MSIF.tmp'
- '%WINDIR%\Installer\MSI19.tmp'
- '%PROGRAM_FILES%\CA\SharedComponents\CA_LIC\LogWatNT.exe'
- '%WINDIR%\Installer\MSIE.tmp'
- '%TEMP%\cb1.tmp\setup.exe' /s /f2"%TEMP%\\calic_setup.log"
- '%TEMP%\cb1.tmp\silent.exe'
- '%TEMP%\MSI7.tmp'
- '%CommonProgramFiles%\InstallShield\Driver\8\Intel 32\IDriver.exe' -Embedding
Запускает на исполнение:
- '<SYSTEM32>\wbem\wmiadap.exe' /R /T
- '<SYSTEM32>\msiexec.exe' -Embedding 85B9465E91AD039F3DAFEE960FA4329B M Global\MSI0000
- '<SYSTEM32>\msiexec.exe' -Embedding E95149C7B285152245AA2753BAAD4203
- '<SYSTEM32>\msiexec.exe' /V
- '<SYSTEM32>\msiexec.exe' -Embedding DCA1A7C424A0F3A3DB5F270E24760E33 C
Изменения в файловой системе:
Создает следующие файлы:
- %WINDIR%\Installer\MSI12.tmp
- C:\Config.Msi\377e6.rbs
- %WINDIR%\Installer\MSI14.tmp
- %WINDIR%\Installer\MSI13.tmp
- %WINDIR%\Installer\MSI10.tmp
- %WINDIR%\Installer\MSID.tmp
- %WINDIR%\Installer\MSIC.tmp
- %WINDIR%\Installer\MSIF.tmp
- %WINDIR%\Installer\MSIE.tmp
- %PROGRAM_FILES%\CA\SharedComponents\CA_LIC\prod_codes.txt
- %PROGRAM_FILES%\CA\SharedComponents\CA_LIC\countriesTrial.txt
- %PROGRAM_FILES%\CA\SharedComponents\CA_LIC\countries.txt
- %PROGRAM_FILES%\CA\SharedComponents\CA_LIC\silntreg.tmp
- %PROGRAM_FILES%\CA\SharedComponents\CA_LIC\LicenseITfieldtrial.cnt
- %PROGRAM_FILES%\CA\SharedComponents\CA_LIC\statesTrial.txt
- %PROGRAM_FILES%\CA\SharedComponents\CA_LIC\lic98.cap
- %PROGRAM_FILES%\CA\SharedComponents\CA_LIC\vendor.dat
- %PROGRAM_FILES%\CA\SharedComponents\CA_LIC\lic98.err
- %PROGRAM_FILES%\CA\SharedComponents\CA_LIC\lic_comp_codes.dat
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.BTR
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\$WinMgmt.CFG
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING.VER
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\domain.txt
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SYSTEM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SOFTWARE
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\ComDb.Dat
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SAM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING1.MAP
- %WINDIR%\Installer\MSI9.tmp
- %WINDIR%\Installer\MSI8.tmp
- %WINDIR%\Installer\MSIB.tmp
- %WINDIR%\Installer\MSIA.tmp
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\RestorePointSize
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.DATA
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING2.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.MAP
- %WINDIR%\Installer\377e4.msi
- %PROGRAM_FILES%\CA\SharedComponents\CA_LIC\CALicnse.exe
- %WINDIR%\Installer\MSI15.tmp
- %PROGRAM_FILES%\CA\SharedComponents\CA_LIC\mergeolf.exe
- %PROGRAM_FILES%\CA\SharedComponents\CA_LIC\lic98.dat
- %WINDIR%\Installer\MSI16.tmp
- %PROGRAM_FILES%\CA\SharedComponents\CA_LIC\mergecalic.exe
- %PROGRAM_FILES%\CA\SharedComponents\CA_LIC\licregres.dll
- %PROGRAM_FILES%\CA\SharedComponents\CA_LIC\licreg_64_amd.dll
- %PROGRAM_FILES%\CA\SharedComponents\CA_LIC\licregres_64_amd.dll
- %PROGRAM_FILES%\CA\SharedComponents\CA_LIC\licregres_64.dll
- %WINDIR%\Installer\{E7A7EABD-7F4D-4D18-B84E-56FC3BBF2EBF}\NewShortcut1.94BB0795_F15F_417A_9EB5_62D7B1430F23.exe
- %WINDIR%\Installer\MSI1C.tmp
- %WINDIR%\Installer\MSI1B.tmp
- %TEMP%\calic_setup.log
- %PROGRAM_FILES%\InstallShield Installation Information\{E7A7EABD-7F4D-4D18-B84E-56FC3BBF2EBF}\setu5466.rra
- %TEMP%\CAServiceAct1.log
- %WINDIR%\Installer\MSI17.tmp
- %WINDIR%\Installer\{E7A7EABD-7F4D-4D18-B84E-56FC3BBF2EBF}\ARPPRODUCTICON.exe
- %WINDIR%\Installer\MSI19.tmp
- %WINDIR%\Installer\MSI18.tmp
- %PROGRAM_FILES%\CA\SharedComponents\CA_LIC\LicRCmd.exe
- %PROGRAM_FILES%\CA\SharedComponents\CA_LIC\LicDebug.exe
- %PROGRAM_FILES%\CA\SharedComponents\CA_LIC\lic98.dll
- %PROGRAM_FILES%\CA\SharedComponents\CA_LIC\LogWatNT.exe
- %PROGRAM_FILES%\CA\SharedComponents\CA_LIC\Lic98Msg.dll
- %PROGRAM_FILES%\CA\SharedComponents\CA_LIC\CAregit.exe
- %PROGRAM_FILES%\CA\SharedComponents\CA_LIC\CAminfo.exe
- %PROGRAM_FILES%\CA\SharedComponents\CA_LIC\LICENSEITFIELDCOMBINED.HLP
- %PROGRAM_FILES%\CA\SharedComponents\CA_LIC\ErrBox.exe
- %PROGRAM_FILES%\CA\SharedComponents\CA_LIC\lic98_64.dll
- %PROGRAM_FILES%\CA\SharedComponents\CA_LIC\licencrypt.dll
- %PROGRAM_FILES%\CA\SharedComponents\CA_LIC\licdscvr.dll
- %PROGRAM_FILES%\CA\SharedComponents\CA_LIC\licreg_64.dll
- %PROGRAM_FILES%\CA\SharedComponents\CA_LIC\licreg.dll
- %PROGRAM_FILES%\CA\SharedComponents\CA_LIC\lic98version.exe
- %PROGRAM_FILES%\CA\SharedComponents\CA_LIC\lic98log.exe
- %PROGRAM_FILES%\CA\SharedComponents\CA_LIC\lic98_64_amd.dll
- %PROGRAM_FILES%\CA\SharedComponents\CA_LIC\lic98rmtd.exe
- %PROGRAM_FILES%\CA\SharedComponents\CA_LIC\lic98rmt.exe
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SECURITY
- %TEMP%\cb1.tmp\LICENSE\lic98_64.dll
- %TEMP%\cb1.tmp\LICENSE\lic98version.exe
- %TEMP%\cb1.tmp\LICENSE\LicDebug.exe
- %TEMP%\cb1.tmp\LICENSE\lic98_64_amd.dll
- %TEMP%\cb1.tmp\LICENSE\lic98rmtd.exe
- %TEMP%\cb1.tmp\LICENSE\lic98log.exe
- %TEMP%\cb1.tmp\LICENSE\lic98.err
- %TEMP%\cb1.tmp\LICENSE\lic98rmt.exe
- %TEMP%\cb1.tmp\LICENSE\Lic98Msg.dll
- %TEMP%\cb1.tmp\LICENSE\licdscvr.dll
- %TEMP%\cb1.tmp\LICENSE\licregres_64.dll
- %TEMP%\cb1.tmp\LICENSE\licregres.dll
- %TEMP%\cb1.tmp\LICENSE\licreg_64.dll
- %TEMP%\cb1.tmp\LICENSE\licregres_64_amd.dll
- %TEMP%\cb1.tmp\LICENSE\licreg.dll
- %TEMP%\cb1.tmp\LICENSE\LICENSEITFIELDCOMBINED.HLP
- %TEMP%\cb1.tmp\LICENSE\licencrypt.dll
- %TEMP%\cb1.tmp\LICENSE\LicRCmd.exe
- %TEMP%\cb1.tmp\LICENSE\LicenseITfieldtrial.cnt
- %TEMP%\cb1.tmp\README.txt
- %TEMP%\cb1.tmp\ISScript8.Msi
- %TEMP%\cb1.tmp\Setup.ini
- %TEMP%\cb1.tmp\setup.exe
- %TEMP%\cb1.tmp\instmsiw.exe
- %TEMP%\cb1.tmp\0x040a.ini
- %TEMP%\cb1.tmp\zzCab.cab
- %TEMP%\cb1.tmp\instmsia.exe
- %TEMP%\cb1.tmp\CA Licensing.msi
- %TEMP%\cb1.tmp\setup.iss
- %TEMP%\cb1.tmp\LICENSE\ErrBox.exe
- %TEMP%\cb1.tmp\LICENSE\countriesTrial.txt
- %TEMP%\cb1.tmp\LICENSE\lic98.dll
- %TEMP%\cb1.tmp\LICENSE\lic98.cap
- %TEMP%\cb1.tmp\LICENSE\countries.txt
- %TEMP%\cb1.tmp\LICENSE\CALicnse.exe
- %TEMP%\cb1.tmp\silent.exe
- %TEMP%\cb1.tmp\LICENSE\CAregit.exe
- %TEMP%\cb1.tmp\LICENSE\CAminfo.exe
- %TEMP%\cb1.tmp\LICENSE\licreg_64_amd.dll
- %TEMP%\{E7A7EABD-7F4D-4D18-B84E-56FC3BBF2EBF}\String1034.txt
- %TEMP%\{E7A7EABD-7F4D-4D18-B84E-56FC3BBF2EBF}\_ISRES.DLL
- %TEMP%\MSI6.tmp
- %TEMP%\{E7A7EABD-7F4D-4D18-B84E-56FC3BBF2EBF}\IGdi.dll
- %TEMP%\{E7A7EABD-7F4D-4D18-B84E-56FC3BBF2EBF}\IsConfig.INI
- %CommonProgramFiles%\InstallShield\Driver\8\Intel 32\IDriver2.exe
- %CommonProgramFiles%\InstallShield\Driver\8\Intel 32\_ISRES1033.dll
- %TEMP%\{E7A7EABD-7F4D-4D18-B84E-56FC3BBF2EBF}\ISRT.DLL
- %TEMP%\{E7A7EABD-7F4D-4D18-B84E-56FC3BBF2EBF}\setup.inx
- %TEMP%\MSI7.tmp
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_.DEFAULT
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\rp.log
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19
- %TEMP%\cb1.tmp\LICENSE\silntreg.tmp
- %TEMP%\cb1.tmp\LICENSE\prod_codes.txt
- %TEMP%\cb1.tmp\LICENSE\vendor.dat
- %TEMP%\cb1.tmp\LICENSE\statesTrial.txt
- %TEMP%\cb1.tmp\LICENSE\mergeolf.exe
- %TEMP%\cb1.tmp\LICENSE\LogWat95.exe
- %TEMP%\cb1.tmp\LICENSE\lic_comp_codes.dat
- %TEMP%\cb1.tmp\LICENSE\mergecalic.exe
- %TEMP%\cb1.tmp\LICENSE\LogWatNT.exe
- %TEMP%\calic_debug.log
- %CommonProgramFiles%\InstallShield\Driver\8\Intel 32\IUser8.dll
- %CommonProgramFiles%\InstallShield\Driver\8\Intel 32\objps8.dll
- %CommonProgramFiles%\InstallShield\Driver\8\Intel 32\ISRT.dll
- %CommonProgramFiles%\InstallShield\Driver\8\Intel 32\IScript8.dll
- %CommonProgramFiles%\InstallShield\Driver\8\Intel 32\IDriver.exe
- %WINDIR%\Installer\377e0.msi
- C:\Config.Msi\377e3.rbs
- %WINDIR%\Installer\MSI3.tmp
Удаляет следующие файлы:
- %WINDIR%\Installer\MSI1C.tmp
- %WINDIR%\Installer\MSI1B.tmp
- %WINDIR%\Installer\377e4.msi
- %WINDIR%\Installer\MSI8.tmp
- C:\Config.Msi\377e6.rbs
- %WINDIR%\Installer\MSI18.tmp
- %WINDIR%\Installer\MSI17.tmp
- %WINDIR%\Installer\MSID.tmp
- %WINDIR%\Installer\MSI19.tmp
- %TEMP%\{E7A7EABD-7F4D-4D18-B84E-56FC3BBF2EBF}\_ISRES.DLL
- %TEMP%\{E7A7EABD-7F4D-4D18-B84E-56FC3BBF2EBF}\String1034.txt
- <SYSTEM32>\PerfStringBackup.TMP
- <SYSTEM32>\wbem\Performance\WmiApRpl.ini
- %TEMP%\{E7A7EABD-7F4D-4D18-B84E-56FC3BBF2EBF}\setup.inx
- %TEMP%\{E7A7EABD-7F4D-4D18-B84E-56FC3BBF2EBF}\IGdi.dll
- %WINDIR%\Installer\377e5.ipi
- %TEMP%\{E7A7EABD-7F4D-4D18-B84E-56FC3BBF2EBF}\ISRT.DLL
- %TEMP%\{E7A7EABD-7F4D-4D18-B84E-56FC3BBF2EBF}\IsConfig.INI
- %WINDIR%\Installer\MSI9.tmp
- %TEMP%\MSI7.tmp
- %WINDIR%\Installer\MSIB.tmp
- %WINDIR%\Installer\MSIA.tmp
- %TEMP%\MSI6.tmp
- C:\Config.Msi\377e3.rbs
- %WINDIR%\Installer\MSI3.tmp
- %WINDIR%\Installer\377e2.ipi
- %WINDIR%\Installer\377e0.msi
- %WINDIR%\Installer\MSI14.tmp
- %WINDIR%\Installer\MSI13.tmp
- %WINDIR%\Installer\MSI16.tmp
- %WINDIR%\Installer\MSI15.tmp
- %WINDIR%\Installer\MSI12.tmp
- %WINDIR%\Installer\MSIE.tmp
- %WINDIR%\Installer\MSIC.tmp
- %WINDIR%\Installer\MSI10.tmp
- %WINDIR%\Installer\MSIF.tmp
Перемещает следующие файлы:
- %TEMP%\def7.rra в %PROGRAM_FILES%\InstallShield Installation Information\{E7A7EABD-7F4D-4D18-B84E-56FC3BBF2EBF}\Setup.ilg
- %PROGRAM_FILES%\InstallShield Installation Information\{E7A7EABD-7F4D-4D18-B84E-56FC3BBF2EBF}\setu5466.rra в %PROGRAM_FILES%\InstallShield Installation Information\{E7A7EABD-7F4D-4D18-B84E-56FC3BBF2EBF}\setup.inx
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
