Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32] 'VIDC.FFDS' = 'ff_vfw.dll'
Вредоносные функции:
Создает и запускает на исполнение:
- '%TEMP%\is-VE41E.tmp\ffdshow.tmp' /SL5="$30092,4266850,140800,%TEMP%\ffdshow.exe" /VERYSILENT
- '%TEMP%\ffdshow.exe' /VERYSILENT
Запускает на исполнение:
- '<SYSTEM32>\regsvr32.exe' /s "%PROGRAM_FILES%\ffdshow\ffdshow.ax"
Изменения в файловой системе:
Создает следующие файлы:
- %PROGRAM_FILES%\ffdshow\custom matrices\is-OTOSE.tmp
- %PROGRAM_FILES%\ffdshow\custom matrices\is-IHO4J.tmp
- %PROGRAM_FILES%\ffdshow\custom matrices\is-BAJN2.tmp
- %PROGRAM_FILES%\ffdshow\custom matrices\is-7TL2P.tmp
- %PROGRAM_FILES%\ffdshow\custom matrices\is-2QJRK.tmp
- %PROGRAM_FILES%\ffdshow\custom matrices\is-AHA0I.tmp
- %PROGRAM_FILES%\ffdshow\custom matrices\is-N6RMI.tmp
- %PROGRAM_FILES%\ffdshow\custom matrices\is-5ICLE.tmp
- %PROGRAM_FILES%\ffdshow\custom matrices\is-5FNFJ.tmp
- %PROGRAM_FILES%\ffdshow\custom matrices\is-BIBHR.tmp
- %PROGRAM_FILES%\ffdshow\custom matrices\is-S2LPO.tmp
- %PROGRAM_FILES%\ffdshow\custom matrices\is-JM3FM.tmp
- %PROGRAM_FILES%\ffdshow\languages\is-359MQ.tmp
- %PROGRAM_FILES%\ffdshow\languages\is-E0E5K.tmp
- %PROGRAM_FILES%\ffdshow\languages\is-KF6C9.tmp
- %PROGRAM_FILES%\ffdshow\custom matrices\is-JAVUI.tmp
- %PROGRAM_FILES%\ffdshow\custom matrices\is-16JV2.tmp
- %PROGRAM_FILES%\ffdshow\custom matrices\is-V4C4U.tmp
- %PROGRAM_FILES%\ffdshow\custom matrices\is-T961J.tmp
- %PROGRAM_FILES%\ffdshow\custom matrices\is-LEHGE.tmp
- %PROGRAM_FILES%\ffdshow\custom matrices\is-QVMRN.tmp
- %PROGRAM_FILES%\ffdshow\is-B7V9J.tmp
- %ALLUSERSPROFILE%\Start Menu\Programs\ffdshow\Audio decoder configuration.lnk
- %PROGRAM_FILES%\ffdshow\is-QEF4R.tmp
- %PROGRAM_FILES%\ffdshow\custom matrices\is-IT8J3.tmp
- %PROGRAM_FILES%\ffdshow\is-B7CVB.tmp
- %ALLUSERSPROFILE%\Start Menu\Programs\ffdshow\Homepage.url
- %PROGRAM_FILES%\ffdshow\unins000.dat
- %ALLUSERSPROFILE%\Start Menu\Programs\ffdshow\Uninstall ffdshow.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\ffdshow\Video decoder configuration.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\ffdshow\VFW configuration.lnk
- %PROGRAM_FILES%\ffdshow\custom matrices\is-PJDLE.tmp
- %PROGRAM_FILES%\ffdshow\custom matrices\is-2OVTB.tmp
- %PROGRAM_FILES%\ffdshow\custom matrices\is-49DAA.tmp
- %PROGRAM_FILES%\ffdshow\custom matrices\is-HSK9Q.tmp
- %PROGRAM_FILES%\ffdshow\custom matrices\is-6CRLH.tmp
- %PROGRAM_FILES%\ffdshow\custom matrices\is-MH8NP.tmp
- %PROGRAM_FILES%\ffdshow\custom matrices\is-N7E99.tmp
- %PROGRAM_FILES%\ffdshow\custom matrices\is-OPMJN.tmp
- %PROGRAM_FILES%\ffdshow\custom matrices\is-EELM6.tmp
- %PROGRAM_FILES%\ffdshow\custom matrices\is-TLF8I.tmp
- %PROGRAM_FILES%\ffdshow\languages\is-L7ICB.tmp
- %PROGRAM_FILES%\ffdshow\is-AVUKS.tmp
- %PROGRAM_FILES%\ffdshow\is-KBRVB.tmp
- %PROGRAM_FILES%\ffdshow\is-BA211.tmp
- %PROGRAM_FILES%\ffdshow\is-A39GT.tmp
- %PROGRAM_FILES%\ffdshow\is-S60CN.tmp
- %PROGRAM_FILES%\ffdshow\is-T7ASK.tmp
- %PROGRAM_FILES%\ffdshow\is-S7JT8.tmp
- %PROGRAM_FILES%\ffdshow\is-J9J2U.tmp
- %PROGRAM_FILES%\ffdshow\is-3ETNU.tmp
- %PROGRAM_FILES%\ffdshow\is-7FQ82.tmp
- <Текущая директория>\GoogleMap.html
- <Текущая директория>\CarMarker.png
- <Текущая директория>\AxInterop.WMPLib.dll
- <Текущая директория>\setting.ini
- <Текущая директория>\Interop.WMPLib.dll
- %TEMP%\is-S0E6J.tmp\WinCPUID.dll
- %TEMP%\is-S0E6J.tmp\ffSpkCfg.dll
- %TEMP%\is-S0E6J.tmp\_isetup\_shfoldr.dll
- %TEMP%\ffdshow.exe
- %TEMP%\is-VE41E.tmp\ffdshow.tmp
- %PROGRAM_FILES%\ffdshow\is-GB31O.tmp
- %PROGRAM_FILES%\ffdshow\languages\is-IS3GV.tmp
- %PROGRAM_FILES%\ffdshow\languages\is-B56F1.tmp
- %PROGRAM_FILES%\ffdshow\languages\is-A7J7Q.tmp
- %PROGRAM_FILES%\ffdshow\languages\is-GBIBK.tmp
- %PROGRAM_FILES%\ffdshow\languages\is-RNK6K.tmp
- %PROGRAM_FILES%\ffdshow\languages\is-D1TBB.tmp
- %PROGRAM_FILES%\ffdshow\languages\is-94FJ4.tmp
- %PROGRAM_FILES%\ffdshow\languages\is-R76FK.tmp
- %PROGRAM_FILES%\ffdshow\languages\is-BNKML.tmp
- %PROGRAM_FILES%\ffdshow\languages\is-N61IU.tmp
- %PROGRAM_FILES%\ffdshow\is-T8R4U.tmp
- <SYSTEM32>\is-42PPB.tmp
- %PROGRAM_FILES%\ffdshow\is-OSAKG.tmp
- %PROGRAM_FILES%\ffdshow\is-9G0UG.tmp
- %PROGRAM_FILES%\ffdshow\is-AOPDF.tmp
- %PROGRAM_FILES%\ffdshow\languages\is-T2P96.tmp
- %PROGRAM_FILES%\ffdshow\languages\is-IM70S.tmp
- %PROGRAM_FILES%\ffdshow\languages\is-SRSSA.tmp
- <SYSTEM32>\is-CNNAK.tmp
- %PROGRAM_FILES%\ffdshow\languages\is-SJ8PC.tmp
Удаляет следующие файлы:
- %TEMP%\is-VE41E.tmp\ffdshow.tmp
- %TEMP%\ffdshow.exe
- %TEMP%\is-S0E6J.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-S0E6J.tmp\ffSpkCfg.dll
- %TEMP%\is-S0E6J.tmp\WinCPUID.dll
Перемещает следующие файлы:
- %PROGRAM_FILES%\ffdshow\custom matrices\is-BAJN2.tmp в %PROGRAM_FILES%\ffdshow\custom matrices\eqm_v3ehr.xcm
- %PROGRAM_FILES%\ffdshow\custom matrices\is-OTOSE.tmp в %PROGRAM_FILES%\ffdshow\custom matrices\eqm_v3hr.xcm
- %PROGRAM_FILES%\ffdshow\custom matrices\is-7TL2P.tmp в %PROGRAM_FILES%\ffdshow\custom matrices\eqm_avc_hr.cfg
- %PROGRAM_FILES%\ffdshow\custom matrices\is-2QJRK.tmp в %PROGRAM_FILES%\ffdshow\custom matrices\eqm_v1.xcm
- %PROGRAM_FILES%\ffdshow\custom matrices\is-BIBHR.tmp в %PROGRAM_FILES%\ffdshow\custom matrices\eqm_v3ulr_rev3.xcm
- %PROGRAM_FILES%\ffdshow\custom matrices\is-5ICLE.tmp в %PROGRAM_FILES%\ffdshow\custom matrices\hvs-best-picture.xcm
- %PROGRAM_FILES%\ffdshow\custom matrices\is-IHO4J.tmp в %PROGRAM_FILES%\ffdshow\custom matrices\eqm_v3lr.xcm
- %PROGRAM_FILES%\ffdshow\custom matrices\is-5FNFJ.tmp в %PROGRAM_FILES%\ffdshow\custom matrices\eqm_v3uhr_rev2.xcm
- %PROGRAM_FILES%\ffdshow\custom matrices\is-JM3FM.tmp в %PROGRAM_FILES%\ffdshow\custom matrices\andreas_doppelte_99er.matrix.xcm
- %PROGRAM_FILES%\ffdshow\custom matrices\is-T961J.tmp в %PROGRAM_FILES%\ffdshow\custom matrices\andreas_einfache_99er.matrix.xcm
- %PROGRAM_FILES%\ffdshow\languages\is-359MQ.tmp в %PROGRAM_FILES%\ffdshow\languages\ffdshow.2052.sc
- %PROGRAM_FILES%\ffdshow\custom matrices\is-S2LPO.tmp в %PROGRAM_FILES%\ffdshow\custom matrices\andreas_78er.matrix.xcm
- %PROGRAM_FILES%\ffdshow\custom matrices\is-JAVUI.tmp в %PROGRAM_FILES%\ffdshow\custom matrices\CG-Animation Matrix.xcm
- %PROGRAM_FILES%\ffdshow\custom matrices\is-16JV2.tmp в %PROGRAM_FILES%\ffdshow\custom matrices\eqm_autogk_sharp.xcm
- %PROGRAM_FILES%\ffdshow\custom matrices\is-LEHGE.tmp в %PROGRAM_FILES%\ffdshow\custom matrices\Bulletproof's Heavy Compression Matrix.xcm
- %PROGRAM_FILES%\ffdshow\custom matrices\is-V4C4U.tmp в %PROGRAM_FILES%\ffdshow\custom matrices\Bulletproof's High Quality Matrix.xcm
- %PROGRAM_FILES%\ffdshow\custom matrices\is-AHA0I.tmp в %PROGRAM_FILES%\ffdshow\custom matrices\hvs-better-picture.xcm
- %PROGRAM_FILES%\ffdshow\custom matrices\is-MH8NP.tmp в %PROGRAM_FILES%\ffdshow\custom matrices\Ultimate Matrix.xcm
- %PROGRAM_FILES%\ffdshow\custom matrices\is-N7E99.tmp в %PROGRAM_FILES%\ffdshow\custom matrices\Ultra Low Bitrate Matrix.xcm
- %PROGRAM_FILES%\ffdshow\custom matrices\is-TLF8I.tmp в %PROGRAM_FILES%\ffdshow\custom matrices\Soulhunters V5.xcm
- %PROGRAM_FILES%\ffdshow\custom matrices\is-OPMJN.tmp в %PROGRAM_FILES%\ffdshow\custom matrices\Standard.xcm
- %PROGRAM_FILES%\ffdshow\is-QEF4R.tmp в %PROGRAM_FILES%\ffdshow\gnu_license.txt
- %PROGRAM_FILES%\ffdshow\is-B7V9J.tmp в %PROGRAM_FILES%\ffdshow\Boost_Software_License_1.0.txt
- %PROGRAM_FILES%\ffdshow\custom matrices\is-IT8J3.tmp в %PROGRAM_FILES%\ffdshow\custom matrices\Very Low Bitrate Matrix.xcm
- %PROGRAM_FILES%\ffdshow\is-B7CVB.tmp в %PROGRAM_FILES%\ffdshow\openIE.js
- %PROGRAM_FILES%\ffdshow\custom matrices\is-HSK9Q.tmp в %PROGRAM_FILES%\ffdshow\custom matrices\MPEG.xcm
- %PROGRAM_FILES%\ffdshow\custom matrices\is-6CRLH.tmp в %PROGRAM_FILES%\ffdshow\custom matrices\pvcd.xcm
- %PROGRAM_FILES%\ffdshow\custom matrices\is-N6RMI.tmp в %PROGRAM_FILES%\ffdshow\custom matrices\hvs-good-picture.xcm
- %PROGRAM_FILES%\ffdshow\custom matrices\is-QVMRN.tmp в %PROGRAM_FILES%\ffdshow\custom matrices\Low Bitrate Matrix.xcm
- %PROGRAM_FILES%\ffdshow\custom matrices\is-2OVTB.tmp в %PROGRAM_FILES%\ffdshow\custom matrices\q_matrix_def.cfg
- %PROGRAM_FILES%\ffdshow\custom matrices\is-EELM6.tmp в %PROGRAM_FILES%\ffdshow\custom matrices\Soulhunters V3.xcm
- %PROGRAM_FILES%\ffdshow\custom matrices\is-49DAA.tmp в %PROGRAM_FILES%\ffdshow\custom matrices\q_matrix.cfg
- %PROGRAM_FILES%\ffdshow\custom matrices\is-PJDLE.tmp в %PROGRAM_FILES%\ffdshow\custom matrices\q_matrix2.cfg
- %PROGRAM_FILES%\ffdshow\languages\is-KF6C9.tmp в %PROGRAM_FILES%\ffdshow\languages\ffdshow.1053.sv
- %PROGRAM_FILES%\ffdshow\is-GB31O.tmp в %PROGRAM_FILES%\ffdshow\TomsMoComp_ff.dll
- %PROGRAM_FILES%\ffdshow\is-9G0UG.tmp в %PROGRAM_FILES%\ffdshow\libmpeg2_ff.dll
- %PROGRAM_FILES%\ffdshow\is-T7ASK.tmp в %PROGRAM_FILES%\ffdshow\xvidcore.dll
- %PROGRAM_FILES%\ffdshow\is-S7JT8.tmp в %PROGRAM_FILES%\ffdshow\ff_kernelDeint.dll
- %PROGRAM_FILES%\ffdshow\is-T8R4U.tmp в %PROGRAM_FILES%\ffdshow\ff_wmv9.dll
- <SYSTEM32>\is-42PPB.tmp в <SYSTEM32>\ff_vfw.dll
- %PROGRAM_FILES%\ffdshow\is-AOPDF.tmp в %PROGRAM_FILES%\ffdshow\ffdshow.ax
- %PROGRAM_FILES%\ffdshow\is-OSAKG.tmp в %PROGRAM_FILES%\ffdshow\ffdshow.ax.manifest
- %PROGRAM_FILES%\ffdshow\is-BA211.tmp в %PROGRAM_FILES%\ffdshow\ff_liba52.dll
- %PROGRAM_FILES%\ffdshow\is-AVUKS.tmp в %PROGRAM_FILES%\ffdshow\ff_libdts.dll
- %PROGRAM_FILES%\ffdshow\is-A39GT.tmp в %PROGRAM_FILES%\ffdshow\unins000.exe
- %PROGRAM_FILES%\ffdshow\is-S60CN.tmp в %PROGRAM_FILES%\ffdshow\ffmpeg.dll
- %PROGRAM_FILES%\ffdshow\is-7FQ82.tmp в %PROGRAM_FILES%\ffdshow\ff_unrar.dll
- %PROGRAM_FILES%\ffdshow\is-J9J2U.tmp в %PROGRAM_FILES%\ffdshow\ff_samplerate.dll
- %PROGRAM_FILES%\ffdshow\is-KBRVB.tmp в %PROGRAM_FILES%\ffdshow\ff_libfaad2.dll
- %PROGRAM_FILES%\ffdshow\is-3ETNU.tmp в %PROGRAM_FILES%\ffdshow\ff_libmad.dll
- <SYSTEM32>\is-CNNAK.tmp в <SYSTEM32>\ff_vfw.dll.manifest
- %PROGRAM_FILES%\ffdshow\languages\is-N61IU.tmp в %PROGRAM_FILES%\ffdshow\languages\ffdshow.1041.ja
- %PROGRAM_FILES%\ffdshow\languages\is-R76FK.tmp в %PROGRAM_FILES%\ffdshow\languages\ffdshow.1042.ko
- %PROGRAM_FILES%\ffdshow\languages\is-B56F1.tmp в %PROGRAM_FILES%\ffdshow\languages\ffdshow.1038.hu
- %PROGRAM_FILES%\ffdshow\languages\is-BNKML.tmp в %PROGRAM_FILES%\ffdshow\languages\ffdshow.1040.it
- %PROGRAM_FILES%\ffdshow\languages\is-L7ICB.tmp в %PROGRAM_FILES%\ffdshow\languages\ffdshow.1049.ru
- %PROGRAM_FILES%\ffdshow\languages\is-E0E5K.tmp в %PROGRAM_FILES%\ffdshow\languages\ffdshow.1051.sk
- %PROGRAM_FILES%\ffdshow\languages\is-D1TBB.tmp в %PROGRAM_FILES%\ffdshow\languages\ffdshow.1045.pl
- %PROGRAM_FILES%\ffdshow\languages\is-94FJ4.tmp в %PROGRAM_FILES%\ffdshow\languages\ffdshow.1046.br
- %PROGRAM_FILES%\ffdshow\languages\is-T2P96.tmp в %PROGRAM_FILES%\ffdshow\languages\ffdshow.1029.cs
- %PROGRAM_FILES%\ffdshow\languages\is-IM70S.tmp в %PROGRAM_FILES%\ffdshow\languages\ffdshow.1031.de
- %PROGRAM_FILES%\ffdshow\languages\is-SJ8PC.tmp в %PROGRAM_FILES%\ffdshow\languages\ffdshow.1026.bg
- %PROGRAM_FILES%\ffdshow\languages\is-SRSSA.tmp в %PROGRAM_FILES%\ffdshow\languages\ffdshow.1028.tc
- %PROGRAM_FILES%\ffdshow\languages\is-A7J7Q.tmp в %PROGRAM_FILES%\ffdshow\languages\ffdshow.1035.fi
- %PROGRAM_FILES%\ffdshow\languages\is-IS3GV.tmp в %PROGRAM_FILES%\ffdshow\languages\ffdshow.1036.fr
- %PROGRAM_FILES%\ffdshow\languages\is-GBIBK.tmp в %PROGRAM_FILES%\ffdshow\languages\ffdshow.1033.en
- %PROGRAM_FILES%\ffdshow\languages\is-RNK6K.tmp в %PROGRAM_FILES%\ffdshow\languages\ffdshow.1034.es
Сетевая активность:
Подключается к:
- '74.##5.232.51':80
- 'localhost':1036
TCP:
Запросы HTTP GET:
- 74.##5.232.51/maps/api/js?se##########
UDP:
- DNS ASK ma##.google.com
Другое:
Ищет следующие окна:
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
