Техническая информация
Вредоносные функции:
Создает и запускает на исполнение:
- %WINDIR%\Temp\_ISTMP1.DIR\000202E4._MP
- C:\TEST\OLITEMP\AMDVIA\miniport.exe /s
Запускает на исполнение:
- %WINDIR%\regedit.exe -s %WINDIR%\TEMP\_ISTMP1.DIR\_ISTMP0.DIR\ATA133.REG
- <SYSTEM32>\ntvdm.exe -f -i1 -w -a <SYSTEM32>\krnl386.exe
- <SYSTEM32>\cmd.exe /c ""C:\TEST\OLITEMP\AMDVIA\SETUP.BAT" "
Изменения в файловой системе:
Создает следующие файлы:
- %PROGRAM_FILES%\AMDAGP\~GLH0008.TMP
- %PROGRAM_FILES%\AMDAGP\~GLH0009.TMP
- %PROGRAM_FILES%\AMDAGP\temp.000
- %PROGRAM_FILES%\AMDAGP\~GLH0007.TMP
- %TEMP%\~GLH0004.TMP
- %TEMP%\~GLH0005.TMP
- %PROGRAM_FILES%\AMDAGP\~GLH0006.TMP
- %PROGRAM_FILES%\AMDAGP\~GLH000b.TMP
- %WINDIR%\Temp\_ISTMP1.DIR\000202E4._MP
- %WINDIR%\Temp\_ISTMP1.DIR\ZDATAI51.DLL
- %WINDIR%\Temp\_ISTMP1.DIR\_WUTL951.DLL
- %WINDIR%\Temp\scs9.tmp
- %PROGRAM_FILES%\AMDAGP\~GLH000c.TMP
- %PROGRAM_FILES%\AMDAGP\INSTALL.LOG
- %WINDIR%\Temp\scs8.tmp
- C:\TEST\OLITEMP\AMDVIA\SETUP.INI
- C:\TEST\OLITEMP\AMDVIA\SETUP.INS
- C:\TEST\OLITEMP\AMDVIA\SETUP.ISS
- C:\TEST\OLITEMP\AMDVIA\Setup.exe
- C:\TEST\OLITEMP\AMDVIA\PHOTO1.BMP
- C:\TEST\OLITEMP\AMDVIA\PHOTO2.BMP
- C:\TEST\OLITEMP\AMDVIA\SETUP.BMP
- C:\TEST\OLITEMP\AMDVIA\SETUP.LID
- %TEMP%\~GLH0001.TMP
- %TEMP%\~GLH0002.TMP
- %TEMP%\~GLH0003.TMP
- %TEMP%\~GLH0000.TMP
- %TEMP%\GLC1.tmp
- %TEMP%\GLK2.tmp
- %TEMP%\GLG4.tmp
- %WINDIR%\Temp\_ISTMP1.DIR\_ISTMP0.DIR\Viaagp.dll
- %WINDIR%\Temp\_ISTMP1.DIR\_ISTMP0.DIR\VIAUSB98.SYS
- %WINDIR%\Temp\_ISTMP1.DIR\_ISTMP0.DIR\USB.DLL
- %WINDIR%\Temp\_ISTMP1.DIR\_ISTMP0.DIR\VIAINF.DLL
- %WINDIR%\Temp\_ISTMP1.DIR\_ISTMP0.DIR\viasetup2.dll
- %WINDIR%\Temp\_ISTMP1.DIR\_ISTMP0.DIR\Meinf.dll
- %WINDIR%\Temp\_ISTMP1.DIR\_ISTMP0.DIR\VIAIDE2K.DLL
- %WINDIR%\Temp\_ISTMP1.DIR\_ISTMP0.DIR\VIAUSB2k.SYS
- %WINDIR%\inf\catalog\viamach.cat
- %WINDIR%\inf\VIAMACH.INF
- <DRIVERS>\viaagp1.sys
- %WINDIR%\IsUninst.exe
- %WINDIR%\Temp\_ISTMP1.DIR\_ISTMP0.DIR\viaacpi.dll
- %WINDIR%\Temp\_ISTMP1.DIR\_ISTMP0.DIR\ATA133.REG
- %WINDIR%\Temp\_ISTMP1.DIR\_ISTMP0.DIR\VALUE.SHL
- C:\TEST\OLITEMP\AMDVIA\setup.log
- %WINDIR%\Temp\_ISTMP1.DIR\_ISTMP0.DIR\Corecomp.ini
- %WINDIR%\Temp\_ISTMP1.DIR\_ISTMP0.DIR\Ctl3d32.dll
- %WINDIR%\_delis43.ini
- %WINDIR%\Temp\_ISTMP1.DIR\_INS0432.INI
- %WINDIR%\_iserr31.ini
- %WINDIR%\_ISENV31.INI
- %WINDIR%\Temp\_ISTMP1.DIR\_ISTMP0.DIR\_IsRes.Dll
- %WINDIR%\Temp\_ISTMP1.DIR\_ISTMP0.DIR\VIASetup.dll
- %WINDIR%\Temp\_ISTMP1.DIR\_ISTMP0.DIR\AGP.DLL
- %WINDIR%\Temp\_ISTMP1.DIR\_ISTMP0.DIR\Install_NT.dll
- %WINDIR%\Temp\_ISTMP1.DIR\_ISTMP0.DIR\Readme.txt
- %WINDIR%\Temp\_ISTMP1.DIR\_ISTMP0.DIR\IsUninst.728
- %WINDIR%\Temp\_ISTMP1.DIR\_ISTMP0.DIR\INFO35.TXT
- %WINDIR%\Temp\_ISTMP1.DIR\_ISTMP0.DIR\INFOLIST.TXT
- C:\TEST\OLITEMP\AMDVIA\IDEWinXP\VIAMINI.CAT
- C:\TEST\OLITEMP\AMDVIA\Inf\WINXP\VIAMACH.INF
- C:\TEST\OLITEMP\AMDVIA\Inf\WINXP\viamach.cat
- C:\TEST\OLITEMP\AMDVIA\IDEWinXP\VIAIDEXP.INF
- C:\TEST\OLITEMP\AMDVIA\IDEWin2K\VIAMINI.CAT
- C:\TEST\OLITEMP\AMDVIA\IDEWinXP\VIAIDE2K.DLL
- C:\TEST\OLITEMP\AMDVIA\IDEWinXP\VIAIDEXP.SYS
- C:\TEST\OLITEMP\AMDVIA\Inf\WIN2000\VIAMACH.INF
- C:\TEST\OLITEMP\AMDVIA\Inf\WINME\VIAMACH.INF
- C:\TEST\OLITEMP\AMDVIA\Inf\WINME\viamach.cat
- C:\TEST\OLITEMP\AMDVIA\IRQ\VTNIRQ.PCI
- C:\TEST\OLITEMP\AMDVIA\Inf\WIN98SE\VIAMACH.INF
- C:\TEST\OLITEMP\AMDVIA\Inf\WIN2000\viamach.cat
- C:\TEST\OLITEMP\AMDVIA\Inf\WIN95\VIAMACH.INF
- C:\TEST\OLITEMP\AMDVIA\Inf\WIN98\VIAMACH.INF
- C:\TEST\OLITEMP\AMDVIA\AGP\VIAGART.VXD
- C:\TEST\OLITEMP\AMDVIA\AGP\VIAGART.CAT
- C:\TEST\OLITEMP\AMDVIA\AGP33\Viagart.vxd
- C:\TEST\OLITEMP\AMDVIA\AGP\OEM.REG
- C:\TEST\OLITEMP\AMDVIA\miniport.exe
- C:\TEST\OLITEMP\AMDVIA\SETUP.BAT
- C:\TEST\OLITEMP\AMDVIA\AGP\VIAGART.INF
- C:\TEST\OLITEMP\AMDVIA\AGP33\VIAGART.INF
- C:\TEST\OLITEMP\AMDVIA\IDEWin2K\VIAIDE2K.DLL
- C:\TEST\OLITEMP\AMDVIA\IDEWin2K\VIAIDE.SYS
- C:\TEST\OLITEMP\AMDVIA\IDEWin2K\VIAIDE.INF
- C:\TEST\OLITEMP\AMDVIA\AgpME\OEM.REG
- C:\TEST\OLITEMP\AMDVIA\AgpME\VIAGART.INF
- C:\TEST\OLITEMP\AMDVIA\AgpME\VIAGART.CAT
- C:\TEST\OLITEMP\AMDVIA\AgpME\VIAGART.VXD
- C:\TEST\OLITEMP\AMDVIA\_SYS1.HDR
- C:\TEST\OLITEMP\AMDVIA\_USER1.CAB
- C:\TEST\OLITEMP\AMDVIA\_USER1.HDR
- C:\TEST\OLITEMP\AMDVIA\_SYS1.CAB
- C:\TEST\OLITEMP\AMDVIA\_INST32I.EX_
- C:\TEST\OLITEMP\AMDVIA\_ISDel.exe
- C:\TEST\OLITEMP\AMDVIA\_Setup.dll
- C:\TEST\OLITEMP\AMDVIA\DATA.TAG
- C:\TEST\OLITEMP\AMDVIA\LANG.DAT
- C:\TEST\OLITEMP\AMDVIA\LAYOUT.BIN
- C:\TEST\OLITEMP\AMDVIA\OS.DAT
- C:\TEST\OLITEMP\AMDVIA\KillPro.dll
- C:\TEST\OLITEMP\AMDVIA\DATA1.CAB
- C:\TEST\OLITEMP\AMDVIA\DATA1.HDR
- C:\TEST\OLITEMP\AMDVIA\DMAOPT.DAT
- C:\TEST\OLITEMP\AMDVIA\WIN9X\VIAVSD.INF
- C:\TEST\OLITEMP\AMDVIA\WIN9X\VATAPI.VXD
- C:\TEST\OLITEMP\AMDVIA\WIN9X\VIADSK.CAT
- C:\TEST\OLITEMP\AMDVIA\WIN2K\VIAAGP1.SYS
- C:\TEST\OLITEMP\AMDVIA\Pfd\VIAPFD.SYS
- C:\TEST\OLITEMP\AMDVIA\WIN2K\VIAAGP1.INF
- C:\TEST\OLITEMP\AMDVIA\WIN2K\VIAAGP1.CAT
- C:\TEST\OLITEMP\AMDVIA\WINME\VATAPI.VXD
- C:\TEST\OLITEMP\AMDVIA\WinXP\VIAAGP1.SYS
- C:\TEST\OLITEMP\AMDVIA\WinXP\VIAAGP1.INF
- C:\TEST\OLITEMP\AMDVIA\WinXP\VIAAGP1.CAT
- C:\TEST\OLITEMP\AMDVIA\WINNT\VIAIDE.INF
- C:\TEST\OLITEMP\AMDVIA\WINME\VIAVSD.INF
- C:\TEST\OLITEMP\AMDVIA\WINME\VIADSK.CAT
- C:\TEST\OLITEMP\AMDVIA\WINNT\VIADSK.SYS
Удаляет следующие файлы:
- %WINDIR%\Temp\_ISTMP1.DIR\_ISTMP0.DIR\viaacpi.dll
- %WINDIR%\Temp\_ISTMP1.DIR\_ISTMP0.DIR\VALUE.SHL
- %WINDIR%\Temp\_ISTMP1.DIR\_ISTMP0.DIR\VIAIDE2K.DLL
- %WINDIR%\Temp\_ISTMP1.DIR\_ISTMP0.DIR\Viaagp.dll
- %WINDIR%\Temp\_ISTMP1.DIR\_ISTMP0.DIR\USB.DLL
- %WINDIR%\Temp\_ISTMP1.DIR\_ISTMP0.DIR\Install_NT.dll
- %WINDIR%\Temp\_ISTMP1.DIR\_ISTMP0.DIR\INFOLIST.TXT
- %WINDIR%\Temp\_ISTMP1.DIR\_ISTMP0.DIR\Meinf.dll
- %WINDIR%\Temp\_ISTMP1.DIR\_ISTMP0.DIR\IsUninst.exe
- %WINDIR%\Temp\_ISTMP1.DIR\ZDATAI51.DLL
- %WINDIR%\Temp\_ISTMP1.DIR\000202E4._MP
- %WINDIR%\_delis43.ini
- %WINDIR%\Temp\_ISTMP1.DIR\_WUTL951.DLL
- %WINDIR%\Temp\_ISTMP1.DIR\_ISTMP0.DIR\VIAUSB98.SYS
- %WINDIR%\Temp\_ISTMP1.DIR\_ISTMP0.DIR\VIASetup.dll
- %WINDIR%\Temp\_ISTMP1.DIR\_ISTMP0.DIR\VIAINF.DLL
- %WINDIR%\Temp\_ISTMP1.DIR\_ISTMP0.DIR\VIAUSB2k.SYS
- %WINDIR%\Temp\_ISTMP1.DIR\_ISTMP0.DIR\viasetup2.dll
- %WINDIR%\Temp\_ISTMP1.DIR\_ISTMP0.DIR\INFO35.TXT
- %TEMP%\GLC1.tmp
- %TEMP%\GLF7.tmp
- %WINDIR%\Temp\scs9.tmp
- %WINDIR%\Temp\scs8.tmp
- %TEMP%\GLF6.tmp
- %TEMP%\GLG4.tmp
- %PROGRAM_FILES%\AMDAGP\~GLH0009.TMP
- %TEMP%\GLF5.tmp
- %TEMP%\GLK2.tmp
- %WINDIR%\Temp\_ISTMP1.DIR\_ISTMP0.DIR\ATA133.REG
- %WINDIR%\Temp\_ISTMP1.DIR\_ISTMP0.DIR\AGP.DLL
- %WINDIR%\Temp\_ISTMP1.DIR\_ISTMP0.DIR\Ctl3d32.dll
- %WINDIR%\Temp\_ISTMP1.DIR\_ISTMP0.DIR\Corecomp.ini
- %WINDIR%\Temp\_ISTMP1.DIR\_ISTMP0.DIR\20a27.DLL
- %WINDIR%\_iserr31.ini
- %WINDIR%\Temp\_ISTMP1.DIR\_INS0432.INI
- %WINDIR%\Temp\_ISTMP1.DIR\_ISTMP0.DIR\Readme.txt
- %WINDIR%\_ISENV31.INI
Другое:
Ищет следующие окна:
- ClassName: 'RegEdit_RegEdit' WindowName: ''
- ClassName: 'WOWFaxClass' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
