Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'ProgramaInicia' = '<Полный путь к вирусу>'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '49' = '%WINDIR%\System\49.exe'
Вредоносные функции:
Запускает на исполнение:
- <SYSTEM32>\ntvdm.exe -f -i18
- <SYSTEM32>\ntvdm.exe -f -i17
- <SYSTEM32>\ntvdm.exe -f -i1a
- <SYSTEM32>\ntvdm.exe -f -i19
- <SYSTEM32>\ntvdm.exe -f -i16
- <SYSTEM32>\ntvdm.exe -f -i13
- <SYSTEM32>\ntvdm.exe -f -i12
- <SYSTEM32>\ntvdm.exe -f -i15
- <SYSTEM32>\ntvdm.exe -f -i14
- <SYSTEM32>\ntvdm.exe -f -i21
- <SYSTEM32>\ntvdm.exe -f -i20
- <SYSTEM32>\ntvdm.exe -f -i23
- <SYSTEM32>\ntvdm.exe -f -i22
- <SYSTEM32>\ntvdm.exe -f -i1f
- <SYSTEM32>\ntvdm.exe -f -i1c
- <SYSTEM32>\ntvdm.exe -f -i1b
- <SYSTEM32>\ntvdm.exe -f -i1e
- <SYSTEM32>\ntvdm.exe -f -i1d
- <SYSTEM32>\ntvdm.exe -f -i7
- <SYSTEM32>\ntvdm.exe -f -i6
- <SYSTEM32>\ntvdm.exe -f -i9
- <SYSTEM32>\ntvdm.exe -f -i8
- <SYSTEM32>\ntvdm.exe -f -i5
- <SYSTEM32>\ntvdm.exe -f -i2
- <SYSTEM32>\ntvdm.exe -f -i1
- <SYSTEM32>\ntvdm.exe -f -i4
- <SYSTEM32>\ntvdm.exe -f -i3
- <SYSTEM32>\attrib.exe +h +s %WINDIR%\system\49.exe
- <SYSTEM32>\ntvdm.exe -f -if
- <SYSTEM32>\ntvdm.exe -f -i11
- <SYSTEM32>\ntvdm.exe -f -i10
- <SYSTEM32>\ntvdm.exe -f -ie
- <SYSTEM32>\ntvdm.exe -f -ib
- <SYSTEM32>\ntvdm.exe -f -ia
- <SYSTEM32>\ntvdm.exe -f -id
- <SYSTEM32>\ntvdm.exe -f -ic
Изменения в файловой системе:
Создает следующие файлы:
- %WINDIR%\Temp\scs29.tmp
- %WINDIR%\Temp\scs28.tmp
- %WINDIR%\Temp\scs27.tmp
- %WINDIR%\Temp\scs2A.tmp
- %WINDIR%\Temp\scs2D.tmp
- %WINDIR%\Temp\scs2C.tmp
- %WINDIR%\Temp\scs2B.tmp
- %WINDIR%\Temp\scs26.tmp
- %WINDIR%\Temp\scs21.tmp
- %WINDIR%\Temp\scs20.tmp
- %WINDIR%\Temp\scs1F.tmp
- %WINDIR%\Temp\scs22.tmp
- %WINDIR%\Temp\scs25.tmp
- %WINDIR%\Temp\scs24.tmp
- %WINDIR%\Temp\scs23.tmp
- %WINDIR%\Temp\scs2E.tmp
- %WINDIR%\Temp\scs39.tmp
- %WINDIR%\Temp\scs38.tmp
- %WINDIR%\Temp\scs37.tmp
- %WINDIR%\Temp\scs3A.tmp
- %WINDIR%\Temp\scs3D.tmp
- %WINDIR%\Temp\scs3C.tmp
- %WINDIR%\Temp\scs3B.tmp
- %WINDIR%\Temp\scs36.tmp
- %WINDIR%\Temp\scs31.tmp
- %WINDIR%\Temp\scs30.tmp
- %WINDIR%\Temp\scs2F.tmp
- %WINDIR%\Temp\scs32.tmp
- %WINDIR%\Temp\scs35.tmp
- %WINDIR%\Temp\scs34.tmp
- %WINDIR%\Temp\scs33.tmp
- %WINDIR%\Temp\scsA.tmp
- %WINDIR%\Temp\scs9.tmp
- %WINDIR%\Temp\scs8.tmp
- %WINDIR%\Temp\scsB.tmp
- %WINDIR%\Temp\scsE.tmp
- %WINDIR%\Temp\scsD.tmp
- %WINDIR%\Temp\scsC.tmp
- %WINDIR%\Temp\scs7.tmp
- %WINDIR%\Temp\scs2.tmp
- %WINDIR%\Temp\scs1.tmp
- %WINDIR%\system\49.exe
- %WINDIR%\Temp\scs3.tmp
- %WINDIR%\Temp\scs6.tmp
- %WINDIR%\Temp\scs5.tmp
- %WINDIR%\Temp\scs4.tmp
- %WINDIR%\Temp\scsF.tmp
- %WINDIR%\Temp\scs1A.tmp
- %WINDIR%\Temp\scs19.tmp
- %WINDIR%\Temp\scs18.tmp
- %WINDIR%\Temp\scs1B.tmp
- %WINDIR%\Temp\scs1E.tmp
- %WINDIR%\Temp\scs1D.tmp
- %WINDIR%\Temp\scs1C.tmp
- %WINDIR%\Temp\scs16.tmp
- %WINDIR%\Temp\scs12.tmp
- %WINDIR%\Temp\scs11.tmp
- %WINDIR%\Temp\scs10.tmp
- %WINDIR%\Temp\scs13.tmp
- %WINDIR%\Temp\scs17.tmp
- %WINDIR%\Temp\scs15.tmp
- %WINDIR%\Temp\scs14.tmp
Присваивает атрибут 'скрытый' для следующих файлов:
- %WINDIR%\system\49.exe
Удаляет следующие файлы:
- %WINDIR%\Temp\scs22.tmp
- %WINDIR%\Temp\scs19.tmp
- %WINDIR%\Temp\scs1B.tmp
- %WINDIR%\Temp\scs1C.tmp
- %WINDIR%\Temp\scs24.tmp
- %WINDIR%\Temp\scs20.tmp
- %WINDIR%\Temp\scs1D.tmp
- %WINDIR%\Temp\scs12.tmp
- %WINDIR%\Temp\scs15.tmp
- %WINDIR%\Temp\scs17.tmp
- %WINDIR%\Temp\scs1E.tmp
- %WINDIR%\Temp\scs25.tmp
- %WINDIR%\Temp\scs2C.tmp
- %WINDIR%\Temp\scs2F.tmp
- %WINDIR%\Temp\scs30.tmp
- %WINDIR%\Temp\scs27.tmp
- %WINDIR%\Temp\scs23.tmp
- %WINDIR%\Temp\scs1F.tmp
- %WINDIR%\Temp\scs26.tmp
- %WINDIR%\Temp\scs28.tmp
- %WINDIR%\Temp\scs2A.tmp
- %WINDIR%\Temp\scs21.tmp
- %WINDIR%\Temp\scsB.tmp
- %WINDIR%\Temp\scs5.tmp
- %WINDIR%\Temp\scs7.tmp
- %WINDIR%\Temp\scs8.tmp
- %WINDIR%\Temp\scsE.tmp
- %WINDIR%\Temp\scs9.tmp
- %WINDIR%\Temp\scs4.tmp
- %WINDIR%\Temp\scs1.tmp
- %WINDIR%\Temp\scs2.tmp
- %WINDIR%\Temp\scs3.tmp
- %WINDIR%\Temp\scs6.tmp
- %WINDIR%\Temp\scsF.tmp
- %WINDIR%\Temp\scs16.tmp
- %WINDIR%\Temp\scs18.tmp
- %WINDIR%\Temp\scs1A.tmp
- %WINDIR%\Temp\scs11.tmp
- %WINDIR%\Temp\scsD.tmp
- %WINDIR%\Temp\scsC.tmp
- %WINDIR%\Temp\scs10.tmp
- %WINDIR%\Temp\scs14.tmp
- %WINDIR%\Temp\scs13.tmp
- %WINDIR%\Temp\scsA.tmp
Другое:
Ищет следующие окна:
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-b40.b48.51001a'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-b1c.b30.500019'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-b78.b84.53001c'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-b64.b68.52001b'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-b04.b08.4f0018'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-aa8.ab0.4c0015'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-a98.aa0.4b0014'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-ae4.ae8.4e0017'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-ac4.ad0.4d0016'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-c50.c54.5a0022'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-c3c.c48.590021'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-c98.ca0.5c0024'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-c70.c78.5b0023'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-c18.c24.580020'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-bc0.bcc.55001d'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-ba0.bac.540001'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-bf4.bfc.57001f'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-bd8.bdc.56001e'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-9b0.9b8.3f0008'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-9a8.9ac.3e0007'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-9d0.9d4.41000a'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-9c0.9c4.400009'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-994.998.3d0006'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-968.96c.3a0001'
- ClassName: '' WindowName: 'Gerenciador de tarefas do windows'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-988.98c.3c0005'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-978.97c.3b0002'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-a50.a54.480011'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-a3c.a40.470010'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-a78.a80.4a0013'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-a64.a6c.490012'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-a2c.a30.46000f'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-9f8.9fc.43000c'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-9ec.9f4.42000b'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-a18.a1c.45000e'
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-a08.a0c.44000d'
