Техническая информация
Вредоносные функции:
Создает и запускает на исполнение:
- '%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\IKernel.exe' 32\IKernel.exe -Embedding
- '%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\IKernel.exe' /REGSERVER
- '%TEMP%\pft3.tmp\Disk1\Setup.exe' -install
- '%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\IKernel.exe' -RegServer
Запускает на исполнение:
- '<SYSTEM32>\regsvr32.exe' /s /u %PROGRAM_FILES%\Palm\PalmCntl.ocx
- '<SYSTEM32>\wbem\wmiadap.exe' /R /T
- '<SYSTEM32>\regsvr32.exe' /s /u %PROGRAM_FILES%\Palm\ComDirect.dll
- '<SYSTEM32>\regsvr32.exe' /s /u %PROGRAM_FILES%\Palm\ComStandard.dll
Изменения в файловой системе:
Создает следующие файлы:
- %PROGRAM_FILES%\InstallShield Installation Information\{B525BB2C-9338-11D4-8B84-00B0D03E6A83}\dataeb6b.rra
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.MAP
- %PROGRAM_FILES%\InstallShield Installation Information\{B525BB2C-9338-11D4-8B84-00B0D03E6A83}\layoea9f.rra
- %PROGRAM_FILES%\InstallShield Installation Information\{B525BB2C-9338-11D4-8B84-00B0D03E6A83}\dataeb0d.rra
- %PROGRAM_FILES%\InstallShield Installation Information\{B525BB2C-9338-11D4-8B84-00B0D03E6A83}\Setuec84.rra
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING2.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING.VER
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING1.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.BTR
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SOFTWARE
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SYSTEM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_.DEFAULT
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SECURITY
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\domain.txt
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\$WinMgmt.CFG
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SAM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\ComDb.Dat
- %PROGRAM_FILES%\Palm\ComSf4a2.rra
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.MAP
- %PROGRAM_FILES%\Palm\Userf33b.rra
- %PROGRAM_FILES%\Palm\ComCf406.rra
- %PROGRAM_FILES%\Palm\ComDf609.rra
- %PROGRAM_FILES%\Palm\setufd0e.rra
- %PROGRAM_FILES%\Palm\Palmf5da.rra
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\RestorePointSize
- %PROGRAM_FILES%\Palm\Instf250.rra
- %PROGRAM_FILES%\InstallShield Installation Information\{B525BB2C-9338-11D4-8B84-00B0D03E6A83}\setued3f.rra
- %PROGRAM_FILES%\InstallShield Installation Information\{B525BB2C-9338-11D4-8B84-00B0D03E6A83}\Setup.ini
- %PROGRAM_FILES%\InstallShield Installation Information\{B525BB2C-9338-11D4-8B84-00B0D03E6A83}\Setuece2.rra
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.DATA
- %PROGRAM_FILES%\Palm\condf0d9.rra
- %PROGRAM_FILES%\Palm\ComDf1a4.rra
- %PROGRAM_FILES%\Palm\HSAPef72.rra
- %PROGRAM_FILES%\Palm\ComSf03d.rra
- %TEMP%\pft3.tmp\Disk1\setup.iss
- %TEMP%\IEC4.tmp
- %TEMP%\pft3.tmp\Disk1\Setup.ini
- %TEMP%\pft3.tmp\Disk1\setup.inx
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\core2dc8.rra
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\ctor2f4e.rra
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\temp.000
- %TEMP%\pft3.tmp\Disk1\Setup.exe
- %TEMP%\pft3.tmp\pftw1.pkg
- %TEMP%\pft3.tmp\Disk1\data1.cab
- %TEMP%\ext2.tmp
- %TEMP%\plf1.tmp
- %TEMP%\pft3.tmp\Disk1\ikernel.ex_
- %TEMP%\pft3.tmp\Disk1\layout.bin
- %TEMP%\pft3.tmp\Disk1\data1.hdr
- %TEMP%\pft3.tmp\Disk1\data2.cab
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\rp.log
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20
- %TEMP%\{b525bb2c-9338-11d4-8b84-00b0d03e6a83}\_IsR5d63.rra
- %CommonProgramFiles%\InstallShield\IScript\iscr3c4e.rra
- %TEMP%\{b525bb2c-9338-11d4-8b84-00b0d03e6a83}\setu513e.rra
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\obje3430.rra
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\iuse353a.rra
- %TEMP%\{b525bb2c-9338-11d4-8b84-00b0d03e6a83}\isrt5a17.rra
- %TEMP%\{b525bb2c-9338-11d4-8b84-00b0d03e6a83}\defa5bfc.rra
- %TEMP%\{b525bb2c-9338-11d4-8b84-00b0d03e6a83}\Inst52c4.rra
- %TEMP%\{b525bb2c-9338-11d4-8b84-00b0d03e6a83}\valu5881.rra
Удаляет следующие файлы:
- %TEMP%\pft3.tmp\Disk1\data2.cab
- %TEMP%\pft3.tmp\Disk1\ikernel.ex_
- %TEMP%\pft3.tmp\Disk1\data1.hdr
- %TEMP%\plf1.tmp
- %TEMP%\pft3.tmp\Disk1\data1.cab
- %TEMP%\pft3.tmp\Disk1\setup.inx
- %TEMP%\pft3.tmp\Disk1\setup.iss
- %TEMP%\pft3.tmp\Disk1\Setup.ini
- %TEMP%\pft3.tmp\Disk1\layout.bin
- %TEMP%\pft3.tmp\Disk1\Setup.exe
- <SYSTEM32>\PerfStringBackup.TMP
- %TEMP%\{b525bb2c-9338-11d4-8b84-00b0d03e6a83}\_IsRes.dll
- %TEMP%\{b525bb2c-9338-11d4-8b84-00b0d03e6a83}\default.pal
- %TEMP%\IEC4.tmp
- %TEMP%\ext2.tmp
- %TEMP%\pft3.tmp\pftw1.pkg
- %TEMP%\{b525bb2c-9338-11d4-8b84-00b0d03e6a83}\setup.inx
- <SYSTEM32>\wbem\Performance\WmiApRpl.ini
- %TEMP%\{b525bb2c-9338-11d4-8b84-00b0d03e6a83}\Instaide.dll
- %TEMP%\{b525bb2c-9338-11d4-8b84-00b0d03e6a83}\isrt.dll
- %TEMP%\{b525bb2c-9338-11d4-8b84-00b0d03e6a83}\value.shl
Перемещает следующие файлы:
- %PROGRAM_FILES%\Palm\ComSf03d.rra в %PROGRAM_FILES%\Palm\ComStandard.tlb
- %PROGRAM_FILES%\Palm\condf0d9.rra в %PROGRAM_FILES%\Palm\condmgr.dll
- %PROGRAM_FILES%\Palm\ComDf1a4.rra в %PROGRAM_FILES%\Palm\ComDirect.tlb
- %PROGRAM_FILES%\Palm\HSAPef72.rra в %PROGRAM_FILES%\Palm\HSAPI.dll
- %PROGRAM_FILES%\InstallShield Installation Information\{B525BB2C-9338-11D4-8B84-00B0D03E6A83}\Setuec84.rra в %PROGRAM_FILES%\InstallShield Installation Information\{B525BB2C-9338-11D4-8B84-00B0D03E6A83}\Setup.exe
- %PROGRAM_FILES%\InstallShield Installation Information\{B525BB2C-9338-11D4-8B84-00B0D03E6A83}\Setuece2.rra в %PROGRAM_FILES%\InstallShield Installation Information\{B525BB2C-9338-11D4-8B84-00B0D03E6A83}\Setup.ini
- %PROGRAM_FILES%\InstallShield Installation Information\{B525BB2C-9338-11D4-8B84-00B0D03E6A83}\setued3f.rra в %PROGRAM_FILES%\InstallShield Installation Information\{B525BB2C-9338-11D4-8B84-00B0D03E6A83}\setup.inx
- %PROGRAM_FILES%\Palm\Instf250.rra в %PROGRAM_FILES%\Palm\Instaide.dll
- %PROGRAM_FILES%\Palm\ComDf609.rra в %PROGRAM_FILES%\Palm\ComDirect.dll
- %PROGRAM_FILES%\Palm\setufd0e.rra в %PROGRAM_FILES%\Palm\setup.iss
- %TEMP%\1e66.rra в %PROGRAM_FILES%\InstallShield Installation Information\{B525BB2C-9338-11D4-8B84-00B0D03E6A83}\setup.ilg
- %PROGRAM_FILES%\Palm\Palmf5da.rra в %PROGRAM_FILES%\Palm\PalmCntl.ocx
- %PROGRAM_FILES%\Palm\Userf33b.rra в %PROGRAM_FILES%\Palm\UserData.dll
- %PROGRAM_FILES%\Palm\ComCf406.rra в %PROGRAM_FILES%\Palm\ComConduit.dll
- %PROGRAM_FILES%\Palm\ComSf4a2.rra в %PROGRAM_FILES%\Palm\ComStandard.dll
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\iuse353a.rra в %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\iuser.dll
- %CommonProgramFiles%\InstallShield\IScript\iscr3c4e.rra в %CommonProgramFiles%\InstallShield\IScript\iscript.dll
- %TEMP%\{b525bb2c-9338-11d4-8b84-00b0d03e6a83}\setu513e.rra в %TEMP%\{b525bb2c-9338-11d4-8b84-00b0d03e6a83}\setup.inx
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\obje3430.rra в %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\objectps.dll
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\temp.000 в %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\IKernel.exe
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\core2dc8.rra в %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\corecomp.ini
- %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\ctor2f4e.rra в %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\ctor.dll
- %TEMP%\{b525bb2c-9338-11d4-8b84-00b0d03e6a83}\Inst52c4.rra в %TEMP%\{b525bb2c-9338-11d4-8b84-00b0d03e6a83}\Instaide.dll
- %PROGRAM_FILES%\InstallShield Installation Information\{B525BB2C-9338-11D4-8B84-00B0D03E6A83}\layoea9f.rra в %PROGRAM_FILES%\InstallShield Installation Information\{B525BB2C-9338-11D4-8B84-00B0D03E6A83}\layout.bin
- %PROGRAM_FILES%\InstallShield Installation Information\{B525BB2C-9338-11D4-8B84-00B0D03E6A83}\dataeb0d.rra в %PROGRAM_FILES%\InstallShield Installation Information\{B525BB2C-9338-11D4-8B84-00B0D03E6A83}\data1.hdr
- %PROGRAM_FILES%\InstallShield Installation Information\{B525BB2C-9338-11D4-8B84-00B0D03E6A83}\dataeb6b.rra в %PROGRAM_FILES%\InstallShield Installation Information\{B525BB2C-9338-11D4-8B84-00B0D03E6A83}\data1.cab
- %TEMP%\{b525bb2c-9338-11d4-8b84-00b0d03e6a83}\_IsR5d63.rra в %TEMP%\{b525bb2c-9338-11d4-8b84-00b0d03e6a83}\_IsRes.dll
- %TEMP%\{b525bb2c-9338-11d4-8b84-00b0d03e6a83}\valu5881.rra в %TEMP%\{b525bb2c-9338-11d4-8b84-00b0d03e6a83}\value.shl
- %TEMP%\{b525bb2c-9338-11d4-8b84-00b0d03e6a83}\isrt5a17.rra в %TEMP%\{b525bb2c-9338-11d4-8b84-00b0d03e6a83}\isrt.dll
- %TEMP%\{b525bb2c-9338-11d4-8b84-00b0d03e6a83}\defa5bfc.rra в %TEMP%\{b525bb2c-9338-11d4-8b84-00b0d03e6a83}\default.pal
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
