Trojan.Siggen6.42831

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKCU>\Software\VOS\Splash Lite<HKLM>\SOFTWARE\Classes\SplashLite.MPG\shell\open\command] '' = '%PROGRAM_FILES%\Mirillis\Splash Lite\SplashLite.exe "%1"'
[<HKCU>\Software\VOS\Splash Lite<HKLM>\SOFTWARE\Classes\SplashLite.MTS\shell\open\command] '' = '%PROGRAM_FILES%\Mirillis\Splash Lite\SplashLite.exe "%1"'
[<HKCU>\Software\VOS\Splash Lite<HKLM>\SOFTWARE\Classes\SplashLite.MP4\shell\open\command] '' = '%PROGRAM_FILES%\Mirillis\Splash Lite\SplashLite.exe "%1"'
[<HKCU>\Software\VOS\Splash Lite<HKLM>\SOFTWARE\Classes\SplashLite.MP2\shell\open\command] '' = '%PROGRAM_FILES%\Mirillis\Splash Lite\SplashLite.exe "%1"'
[<HKCU>\Software\VOS\Splash Lite<HKLM>\SOFTWARE\Classes\SplashLite.MP3\shell\open\command] '' = '%PROGRAM_FILES%\Mirillis\Splash Lite\SplashLite.exe "%1"'
[<HKCU>\Software\VOS\Splash Lite<HKLM>\SOFTWARE\Classes\SplashLite.VOB\shell\open\command] '' = '%PROGRAM_FILES%\Mirillis\Splash Lite\SplashLite.exe "%1"'
[<HKCU>\Software\VOS\Splash Lite<HKLM>\SOFTWARE\Classes\SplashLite.WMV\shell\open\command] '' = '%PROGRAM_FILES%\Mirillis\Splash Lite\SplashLite.exe "%1"'
[<HKCU>\Software\VOS\Splash Lite<HKLM>\SOFTWARE\Classes\SplashLite.TS\shell\open\command] '' = '%PROGRAM_FILES%\Mirillis\Splash Lite\SplashLite.exe "%1"'
[<HKCU>\Software\VOS\Splash Lite<HKLM>\SOFTWARE\Classes\SplashLite.OGG\shell\open\command] '' = '%PROGRAM_FILES%\Mirillis\Splash Lite\SplashLite.exe "%1"'
[<HKCU>\Software\VOS\Splash Lite<HKLM>\SOFTWARE\Classes\SplashLite.SPLASH\shell\open\command] '' = '%PROGRAM_FILES%\Mirillis\Splash Lite\SplashLite.exe "%1"'
[<HKCU>\Software\VOS\Splash Lite<HKLM>\SOFTWARE\Classes\SplashLite.MOV\shell\open\command] '' = '%PROGRAM_FILES%\Mirillis\Splash Lite\SplashLite.exe "%1"'
[<HKCU>\Software\VOS\Splash Lite<HKLM>\SOFTWARE\Classes\SplashLite.FLAC\shell\open\command] '' = '%PROGRAM_FILES%\Mirillis\Splash Lite\SplashLite.exe "%1"'
[<HKCU>\Software\VOS\Splash Lite<HKLM>\SOFTWARE\Classes\SplashLite.M2T\shell\open\command] '' = '%PROGRAM_FILES%\Mirillis\Splash Lite\SplashLite.exe "%1"'
[<HKCU>\Software\VOS\Splash Lite<HKLM>\SOFTWARE\Classes\SplashLite.DIVX\shell\open\command] '' = '%PROGRAM_FILES%\Mirillis\Splash Lite\SplashLite.exe "%1"'
[<HKCU>\Software\VOS\Splash Lite<HKLM>\SOFTWARE\Classes\SplashLite.AAC\shell\open\command] '' = '%PROGRAM_FILES%\Mirillis\Splash Lite\SplashLite.exe "%1"'
[<HKCU>\Software\VOS\Splash Lite<HKLM>\SOFTWARE\Classes\SplashLite.AVI\shell\open\command] '' = '%PROGRAM_FILES%\Mirillis\Splash Lite\SplashLite.exe "%1"'
[<HKCU>\Software\VOS\Splash Lite<HKLM>\SOFTWARE\Classes\SplashLite.MBT\shell\open\command] '' = '%PROGRAM_FILES%\Mirillis\Splash Lite\SplashLite.exe "%1"'
[<HKCU>\Software\VOS\Splash Lite<HKLM>\SOFTWARE\Classes\SplashLite.MKV\shell\open\command] '' = '%PROGRAM_FILES%\Mirillis\Splash Lite\SplashLite.exe "%1"'
[<HKCU>\Software\VOS\Splash Lite<HKLM>\SOFTWARE\Classes\SplashLite.M4V\shell\open\command] '' = '%PROGRAM_FILES%\Mirillis\Splash Lite\SplashLite.exe "%1"'
[<HKCU>\Software\VOS\Splash Lite<HKLM>\SOFTWARE\Classes\SplashLite.M2TS\shell\open\command] '' = '%PROGRAM_FILES%\Mirillis\Splash Lite\SplashLite.exe "%1"'
[<HKCU>\Software\VOS\Splash Lite<HKLM>\SOFTWARE\Classes\SplashLite.M4A\shell\open\command] '' = '%PROGRAM_FILES%\Mirillis\Splash Lite\SplashLite.exe "%1"'

Изменения в файловой системе:

Создает следующие файлы:

%APPDATA%\VOS\Splash Lite\%Program Files%\Mirillis\Splash Lite\D3DX9_40.dll
%APPDATA%\VOS\Splash Lite\%Program Files%\Mirillis\Splash Lite\Microsoft.VC90.CRT\Microsoft.VC90.CRT.manifest
%APPDATA%\VOS\Splash Lite\%Program Files%\Mirillis\Splash Lite\Microsoft.VC90.CRT\msvcm90.dll
%APPDATA%\VOS\Splash Lite\%Programs%\Mirillis\Splash Lite\Quick Start.lnk
%APPDATA%\VOS\Splash Lite\%Programs%\Mirillis\Splash Lite\Splash Lite.lnk
%APPDATA%\VOS\Splash Lite\%Desktop%\Splash Lite.lnk
%APPDATA%\VOS\Splash Lite\%Program Files%\Mirillis\Splash Lite\Microsoft.VC90.CRT\msvcp90.dll
%APPDATA%\VOS\Splash Lite\Icons\SplashLite_QuickStart.pdf.ico
%APPDATA%\VOS\Splash Lite\ZipCache
%APPDATA%\VOS\Splash Lite\ZipCache.20130302-140804.890.stamp
%APPDATA%\VOS\Splash Lite\%Program Files%\Mirillis\Splash Lite\Microsoft.VC90.CRT\msvcr90.dll
%APPDATA%\VOS\Splash Lite\%Program Files%\Mirillis\Splash Lite\libvorbis.dll
%APPDATA%\VOS\Splash Lite\Icons\SplashLite.exe.ico
%APPDATA%\VOS\Splash Lite\VirtFiles.db.2860.tmp
%APPDATA%\VOS\Splash Lite\AppVirtDll_Splash Lite.dll
%APPDATA%\VOS\Splash Lite\AppVirtDll_Splash Lite.dll.20130302-140804.203.stamp
%APPDATA%\VOS\Splash Lite\AppVirtDll64_Splash Lite.dll
%TEMP%\~DF644C.tmp
%APPDATA%\VOS\Splash Lite\VirtApp.ini
%APPDATA%\VOS\Splash Lite\VirtApp.ini.20130302-140804.875.stamp
%APPDATA%\VOS\Splash Lite\AppVirtDll64_Splash Lite.dll.20130302-140804.578.stamp
%APPDATA%\VOS\Splash Lite\SandboxCfg.db.20130302-140804.875.stamp
%APPDATA%\VOS\Splash Lite\VirtReg.export
%APPDATA%\VOS\Splash Lite\VirtReg.export.20130302-140804.875.stamp
%APPDATA%\VOS\Splash Lite\VirtFiles.db
%APPDATA%\VOS\Splash Lite\VirtFiles.db.20130302-140804.875.stamp
%APPDATA%\VOS\Splash Lite\SandboxCfg.db