Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Pragma5' = '%PROGRAM_FILES%\Trident Software\Pragma\prestart.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\PTsup5] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- '%PROGRAM_FILES%\Trident Software\Pragma\PTsup5.exe' -Service
- '%TEMP%\RarSFX0\hidcon.exe' pragma5fix.exe
- '%TEMP%\RarSFX0\pragma5fix.exe'
- '%TEMP%\RarSFX0\setup.exe'
- '%TEMP%\RarSFX0\eng_rus_ukr.exe'
- '%TEMP%\RarSFX0\pragma5.exe'
Запускает на исполнение:
- '%WINDIR%\regedit.exe' /S 2.reg
Изменения в файловой системе:
Создает следующие файлы:
- %PROGRAM_FILES%\Trident Software\Pragma\pnotify.dll
- %PROGRAM_FILES%\Trident Software\Pragma\poomgr.dll
- %PROGRAM_FILES%\Trident Software\Pragma\phtmmgr.dll
- %PROGRAM_FILES%\Trident Software\Pragma\pindic.dll
- %PROGRAM_FILES%\Trident Software\Pragma\pragma.cfg
- %PROGRAM_FILES%\Trident Software\Pragma\prestart.exe
- %PROGRAM_FILES%\Trident Software\Pragma\prtfmgr.dll
- %PROGRAM_FILES%\Trident Software\Pragma\pragma.exe
- %PROGRAM_FILES%\Trident Software\Pragma\pragmsg.dll
- %PROGRAM_FILES%\Trident Software\Pragma\p4msg.dll
- %PROGRAM_FILES%\Trident Software\Pragma\pabout.dll
- %PROGRAM_FILES%\Trident Software\Pragma\ie.exe
- %PROGRAM_FILES%\Trident Software\Pragma\MTCORSVA.TTF
- %PROGRAM_FILES%\Trident Software\Pragma\pclip.dll
- %PROGRAM_FILES%\Trident Software\Pragma\pfox3mgr.dll
- %PROGRAM_FILES%\Trident Software\Pragma\pfoxmgr.dll
- %PROGRAM_FILES%\Trident Software\Pragma\pcore5.dll
- %PROGRAM_FILES%\Trident Software\Pragma\pdocmgr.dll
- %PROGRAM_FILES%\Trident Software\Pragma\pstat.dll
- %ALLUSERSPROFILE%\Start Menu\Programs\Office\Pragma\Pragma Uninstaller.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\Office\Pragma\AutoUpdater.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\Office\Pragma\Corrector.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\Office\Pragma\Check-up.lnk
- %WINDIR%\Pragma Uninstaller.exe
- %TEMP%\RarSFX0\2.reg
- %TEMP%\bt1088.bat
- %WINDIR%\Fonts\MTCORSVA.TTF
- %TEMP%\RarSFX0\1.reg
- %PROGRAM_FILES%\Trident Software\Pragma\PTsup5.exe
- %PROGRAM_FILES%\Trident Software\Pragma\ptxtmgr.dll
- %PROGRAM_FILES%\Trident Software\Pragma\ptbar5.dll
- %PROGRAM_FILES%\Trident Software\Pragma\pthook.dll
- %PROGRAM_FILES%\Trident Software\Pragma\uninstall.exe
- %PROGRAM_FILES%\Trident Software\Pragma\Help\pragmar.chm
- %ALLUSERSPROFILE%\Start Menu\Programs\Office\Pragma\Start Pragma.lnk
- %PROGRAM_FILES%\Trident Software\Pragma\Diction\windows.kod
- %PROGRAM_FILES%\Trident Software\Pragma\Help\pragmae.chm
- %PROGRAM_FILES%\Trident Software\Pragma\Diction\gwrus.pr
- %PROGRAM_FILES%\Trident Software\Pragma\Diction\gwukr.pr
- %PROGRAM_FILES%\Trident Software\Pragma\Diction\c.pr
- %PROGRAM_FILES%\Trident Software\Pragma\Diction\gweng.pr
- %PROGRAM_FILES%\Trident Software\Pragma\Diction\meng.pr
- %PROGRAM_FILES%\Trident Software\Pragma\Diction\seng.pr
- %PROGRAM_FILES%\Trident Software\Pragma\Diction\srus.pr
- %PROGRAM_FILES%\Trident Software\Pragma\Diction\mrus.pr
- %PROGRAM_FILES%\Trident Software\Pragma\Diction\mukr.pr
- %TEMP%\RarSFX0\pragma.exe
- %TEMP%\RarSFX0\pragma5.exe
- %TEMP%\RarSFX0\eng_rus_ukr.exe
- %TEMP%\RarSFX0\hidcon.exe
- %TEMP%\RarSFX0\pragma5fix.exe
- %PROGRAM_FILES%\Trident Software\Pragma\Diction\brus.pr
- %PROGRAM_FILES%\Trident Software\Pragma\Diction\bukr.pr
- %TEMP%\RarSFX0\setup.exe
- %PROGRAM_FILES%\Trident Software\Pragma\Diction\beng.pr
- %PROGRAM_FILES%\Trident Software\Pragma\Diction\sukr.pr
- %TEMP%\aiw177859.bmp
- %TEMP%\aiw177875.DLL
- %TEMP%\aiw177796.bmp
- %TEMP%\aiw177828.bmp
- %TEMP%\aiw177953.EXE
- %PROGRAM_FILES%\Trident Software\Pragma\dlg4.dll
- %PROGRAM_FILES%\Trident Software\Pragma\ide21201.vxd
- %CommonProgramFiles%\Thraex Software\AutoUpdator\AutoUpdator.exe
- %PROGRAM_FILES%\Trident Software\Pragma\corrector.exe
- %PROGRAM_FILES%\Trident Software\Pragma\Diction\trusukr.pr
- %PROGRAM_FILES%\Trident Software\Pragma\Diction\tukrrus.pr
- %PROGRAM_FILES%\Trident Software\Pragma\Diction\tengrus.pr
- %PROGRAM_FILES%\Trident Software\Pragma\Diction\truseng.pr
- %PROGRAM_FILES%\Trident Software\Pragma\Diction\veng.pr
- %TEMP%\aiw177734.bmp
- %TEMP%\aiw177765.bmp
- %PROGRAM_FILES%\Trident Software\Pragma\Diction\vrus.pr
- %PROGRAM_FILES%\Trident Software\Pragma\Diction\vukr.pr
Присваивает атрибут 'скрытый' для следующих файлов:
- %TEMP%\bt1088.bat
Удаляет следующие файлы:
- %TEMP%\RarSFX0\1.reg
- %PROGRAM_FILES%\Trident Software\Pragma\pragma.exe
- %TEMP%\aiw177875.DLL
- %TEMP%\RarSFX0\hidcon.exe
- %TEMP%\RarSFX0\eng_rus_ukr.exe
- %TEMP%\RarSFX0\2.reg
- %TEMP%\aiw177859.bmp
- %TEMP%\aiw177734.bmp
- %PROGRAM_FILES%\Trident Software\Pragma\MTCORSVA.TTF
- %TEMP%\aiw177953.EXE
- %TEMP%\aiw177828.bmp
- %TEMP%\aiw177796.bmp
- %TEMP%\aiw177765.bmp
Другое:
Ищет следующие окна:
- ClassName: 'RegEdit_RegEdit' WindowName: ''
- ClassName: 'Indicator' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
