Trojan.Encoder.3670

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'zsevice-455' = '%APPDATA%\bonvkhe45.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'zsevice-34' = '%APPDATA%\bonvkhe45.exe'

Создает или изменяет следующие файлы:

%ALLUSERSPROFILE%\Start Menu\Programs\Startup\help_recover_instructions+dqm.html
%ALLUSERSPROFILE%\Start Menu\Programs\Startup\help_recover_instructions+dqm.txt

Вредоносные функции:

Создает и запускает на исполнение:

'%APPDATA%\bonvkhe45.exe'

Запускает на исполнение:

'<SYSTEM32>\cmd.exe' /c DEL <Полный путь к вирусу>

Завершает или пытается завершить

следующие системные процессы:

<SYSTEM32>\cmd.exe

следующие пользовательские процессы:

ecmd.exe

Изменения в файловой системе:

Создает следующие файлы:

%APPDATA%\Microsoft\Internet Explorer\help_recover_instructions+dqm.txt
%APPDATA%\Microsoft\Internet Explorer\help_recover_instructions+dqm.html
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\help_recover_instructions+dqm.html
%APPDATA%\Microsoft\Credentials\help_recover_instructions+dqm.html
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\help_recover_instructions+dqm.txt
%APPDATA%\Microsoft\Media Player\help_recover_instructions+dqm.txt
%APPDATA%\Microsoft\SystemCertificates\My\Certificates\help_recover_instructions+dqm.txt
%APPDATA%\Microsoft\SystemCertificates\My\Certificates\help_recover_instructions+dqm.html
%APPDATA%\Microsoft\MMC\help_recover_instructions+dqm.html
%APPDATA%\Microsoft\Media Player\help_recover_instructions+dqm.html
%APPDATA%\Microsoft\MMC\help_recover_instructions+dqm.txt
%APPDATA%\Microsoft\Credentials\help_recover_instructions+dqm.txt
%APPDATA%\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\help_recover_instructions+dqm.txt
%APPDATA%\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\help_recover_instructions+dqm.html
C:\Documents and Settings\NetworkService\help_recover_instructions+dqm.html
C:\Documents and Settings\NetworkService\Local Settings\help_recover_instructions+dqm.html
C:\Documents and Settings\NetworkService\help_recover_instructions+dqm.txt
%APPDATA%\Identities\help_recover_instructions+dqm.txt
%APPDATA%\Microsoft\Credentials\S-1-5-21-2052111302-484763869-725345543-1003\help_recover_instructions+dqm.txt
%APPDATA%\Microsoft\Credentials\S-1-5-21-2052111302-484763869-725345543-1003\help_recover_instructions+dqm.html
%APPDATA%\Microsoft\Address Book\help_recover_instructions+dqm.html
%APPDATA%\Identities\help_recover_instructions+dqm.html
%APPDATA%\Microsoft\Address Book\help_recover_instructions+dqm.txt
%APPDATA%\Mozilla\Extensions\help_recover_instructions+dqm.html
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\bookmarkbackups\help_recover_instructions+dqm.txt
%APPDATA%\Mozilla\Extensions\help_recover_instructions+dqm.txt
%APPDATA%\Microsoft\help_recover_instructions+dqm.txt
%APPDATA%\Microsoft\help_recover_instructions+dqm.html
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\bookmarkbackups\help_recover_instructions+dqm.html
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\help_recover_instructions+dqm.html
%APPDATA%\Mozilla\Firefox\Profiles\help_recover_instructions+dqm.txt
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\help_recover_instructions+dqm.txt
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\help_recover_instructions+dqm.txt
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\help_recover_instructions+dqm.html
%APPDATA%\Microsoft\Windows\help_recover_instructions+dqm.html
%APPDATA%\Microsoft\SystemCertificates\My\CTLs\help_recover_instructions+dqm.html
%APPDATA%\Microsoft\SystemCertificates\My\help_recover_instructions+dqm.txt
%APPDATA%\Microsoft\SystemCertificates\My\CTLs\help_recover_instructions+dqm.txt
%APPDATA%\Microsoft\SystemCertificates\My\CRLs\help_recover_instructions+dqm.txt
%APPDATA%\Microsoft\SystemCertificates\My\CRLs\help_recover_instructions+dqm.html
%APPDATA%\Microsoft\SystemCertificates\My\help_recover_instructions+dqm.html
%APPDATA%\Microsoft\Windows\Themes\help_recover_instructions+dqm.html
%APPDATA%\Microsoft\Windows\help_recover_instructions+dqm.txt
%APPDATA%\Microsoft\Windows\Themes\help_recover_instructions+dqm.txt
%APPDATA%\Microsoft\SystemCertificates\help_recover_instructions+dqm.txt
%APPDATA%\Microsoft\SystemCertificates\help_recover_instructions+dqm.html
C:\Documents and Settings\NetworkService\Local Settings\help_recover_instructions+dqm.txt
C:\Documents and Settings\NetworkService\Application Data\help_recover_instructions+dqm.html
C:\Documents and Settings\NetworkService\Cookies\help_recover_instructions+dqm.txt
C:\Documents and Settings\NetworkService\Application Data\help_recover_instructions+dqm.txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\help_recover_instructions+dqm.txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\help_recover_instructions+dqm.html
C:\Documents and Settings\NetworkService\Cookies\help_recover_instructions+dqm.html
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Credentials\help_recover_instructions+dqm.html
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\help_recover_instructions+dqm.txt
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Credentials\help_recover_instructions+dqm.txt
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-20\help_recover_instructions+dqm.txt
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-20\help_recover_instructions+dqm.html
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\help_recover_instructions+dqm.html
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\Certificates\help_recover_instructions+dqm.html
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\CRLs\help_recover_instructions+dqm.txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\Certificates\help_recover_instructions+dqm.txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Media Player\help_recover_instructions+dqm.txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Media Player\help_recover_instructions+dqm.html
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\CRLs\help_recover_instructions+dqm.html
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\help_recover_instructions+dqm.html
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\help_recover_instructions+dqm.txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\help_recover_instructions+dqm.txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\CTLs\help_recover_instructions+dqm.txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\CTLs\help_recover_instructions+dqm.html
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\help_recover_instructions+dqm.txt
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\help_recover_instructions+dqm.html
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\help_recover_instructions+dqm.html
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\help_recover_instructions+dqm.html
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\help_recover_instructions+dqm.txt
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\help_recover_instructions+dqm.txt
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\help_recover_instructions+dqm.txt
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\help_recover_instructions+dqm.html
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\help_recover_instructions+dqm.html
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\help_recover_instructions+dqm.html
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\help_recover_instructions+dqm.txt
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\help_recover_instructions+dqm.txt
C:\Documents and Settings\NetworkService\Local Settings\Application Data\help_recover_instructions+dqm.txt
C:\Documents and Settings\NetworkService\Local Settings\Application Data\help_recover_instructions+dqm.html
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\help_recover_instructions+dqm.html
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\help_recover_instructions+dqm.html
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\help_recover_instructions+dqm.txt
C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\help_recover_instructions+dqm.txt
C:\Documents and Settings\NetworkService\Local Settings\Temp\help_recover_instructions+dqm.txt
C:\Documents and Settings\NetworkService\Local Settings\Temp\help_recover_instructions+dqm.html
C:\Documents and Settings\NetworkService\Local Settings\History\help_recover_instructions+dqm.html
C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\help_recover_instructions+dqm.html
C:\Documents and Settings\NetworkService\Local Settings\History\help_recover_instructions+dqm.txt
%APPDATA%\Mozilla\Firefox\Profiles\help_recover_instructions+dqm.html
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\E\help_recover_instructions+dqm.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\E\help_recover_instructions+dqm.html
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\D\help_recover_instructions+dqm.html
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\C\help_recover_instructions+dqm.html
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\D\help_recover_instructions+dqm.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\F\help_recover_instructions+dqm.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\startupCache\help_recover_instructions+dqm.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\startupCache\help_recover_instructions+dqm.html
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\help_recover_instructions+dqm.html
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\F\help_recover_instructions+dqm.html
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\help_recover_instructions+dqm.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\C\help_recover_instructions+dqm.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\8\help_recover_instructions+dqm.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\8\help_recover_instructions+dqm.html
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\7\help_recover_instructions+dqm.html
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\6\help_recover_instructions+dqm.html
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\7\help_recover_instructions+dqm.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\9\help_recover_instructions+dqm.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\B\help_recover_instructions+dqm.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\B\help_recover_instructions+dqm.html
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\A\help_recover_instructions+dqm.html
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\9\help_recover_instructions+dqm.html
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\A\help_recover_instructions+dqm.txt
%HOMEPATH%\Local Settings\History\History.IE5\help_recover_instructions+dqm.html
%HOMEPATH%\Local Settings\History\help_recover_instructions+dqm.txt
%HOMEPATH%\Local Settings\History\History.IE5\help_recover_instructions+dqm.txt
%HOMEPATH%\Local Settings\History\History.IE5\MSHist012011111020111111\help_recover_instructions+dqm.txt
%HOMEPATH%\Local Settings\History\History.IE5\MSHist012011111020111111\help_recover_instructions+dqm.html
%HOMEPATH%\Local Settings\History\help_recover_instructions+dqm.html
%HOMEPATH%\Local Settings\Temporary Internet Files\help_recover_instructions+dqm.html
%HOMEPATH%\Local Settings\help_recover_instructions+dqm.txt
%HOMEPATH%\Local Settings\Temporary Internet Files\help_recover_instructions+dqm.txt
%TEMP%\help_recover_instructions+dqm.txt
%TEMP%\help_recover_instructions+dqm.html
<LS_APPDATA>\help_recover_instructions+dqm.html
<LS_APPDATA>\Mozilla\Firefox\Profiles\help_recover_instructions+dqm.html
<LS_APPDATA>\Mozilla\Firefox\help_recover_instructions+dqm.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\help_recover_instructions+dqm.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\help_recover_instructions+dqm.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\help_recover_instructions+dqm.html
<LS_APPDATA>\Mozilla\Firefox\help_recover_instructions+dqm.html
<LS_APPDATA>\VMware\help_recover_instructions+dqm.html
<LS_APPDATA>\help_recover_instructions+dqm.txt
<LS_APPDATA>\VMware\help_recover_instructions+dqm.txt
<LS_APPDATA>\Mozilla\help_recover_instructions+dqm.txt
<LS_APPDATA>\Mozilla\help_recover_instructions+dqm.html
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\6\help_recover_instructions+dqm.txt
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Microsoft\help_recover_instructions+dqm.html
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\help_recover_instructions+dqm.txt
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Microsoft\help_recover_instructions+dqm.txt
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Microsoft\Outlook Express\help_recover_instructions+dqm.txt
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Microsoft\Outlook Express\help_recover_instructions+dqm.html
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\help_recover_instructions+dqm.html
<LS_APPDATA>\Microsoft\Credentials\S-1-5-21-2052111302-484763869-725345543-1003\help_recover_instructions+dqm.html
<LS_APPDATA>\Microsoft\Credentials\help_recover_instructions+dqm.txt
<LS_APPDATA>\Microsoft\Credentials\S-1-5-21-2052111302-484763869-725345543-1003\help_recover_instructions+dqm.txt
<LS_APPDATA>\Identities\help_recover_instructions+dqm.txt
<LS_APPDATA>\Identities\help_recover_instructions+dqm.html
%HOMEPATH%\Favorites\help_recover_instructions+dqm.html
%APPDATA%\Mozilla\help_recover_instructions+dqm.html
%APPDATA%\help_recover_instructions+dqm.txt
%APPDATA%\Mozilla\help_recover_instructions+dqm.txt
%APPDATA%\Mozilla\Firefox\help_recover_instructions+dqm.txt
%APPDATA%\Mozilla\Firefox\help_recover_instructions+dqm.html
%APPDATA%\help_recover_instructions+dqm.html
%HOMEPATH%\Favorites\Links\help_recover_instructions+dqm.html
%HOMEPATH%\Favorites\help_recover_instructions+dqm.txt
%HOMEPATH%\Favorites\Links\help_recover_instructions+dqm.txt
%HOMEPATH%\Cookies\help_recover_instructions+dqm.txt
%HOMEPATH%\Cookies\help_recover_instructions+dqm.html
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\2\help_recover_instructions+dqm.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\2\help_recover_instructions+dqm.html
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\1\help_recover_instructions+dqm.html
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\0\help_recover_instructions+dqm.html
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\1\help_recover_instructions+dqm.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\3\help_recover_instructions+dqm.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\5\help_recover_instructions+dqm.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\5\help_recover_instructions+dqm.html
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\4\help_recover_instructions+dqm.html
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\3\help_recover_instructions+dqm.html
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\4\help_recover_instructions+dqm.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\0\help_recover_instructions+dqm.txt
<LS_APPDATA>\Microsoft\Windows\help_recover_instructions+dqm.txt
<LS_APPDATA>\Microsoft\Windows\help_recover_instructions+dqm.html
<LS_APPDATA>\Microsoft\Media Player\help_recover_instructions+dqm.html
<LS_APPDATA>\Microsoft\Credentials\help_recover_instructions+dqm.html
<LS_APPDATA>\Microsoft\Media Player\help_recover_instructions+dqm.txt
<LS_APPDATA>\Microsoft\Windows Media\9.0\help_recover_instructions+dqm.txt
<LS_APPDATA>\Microsoft\help_recover_instructions+dqm.txt
<LS_APPDATA>\Microsoft\help_recover_instructions+dqm.html
<LS_APPDATA>\Microsoft\Windows Media\help_recover_instructions+dqm.html
<LS_APPDATA>\Microsoft\Windows Media\9.0\help_recover_instructions+dqm.html
<LS_APPDATA>\Microsoft\Windows Media\help_recover_instructions+dqm.txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Internet Explorer\help_recover_instructions+dqm.html
C:\Documents and Settings\Default User\Application Data\Microsoft\help_recover_instructions+dqm.txt
C:\Documents and Settings\Default User\Application Data\Microsoft\help_recover_instructions+dqm.html
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\help_recover_instructions+dqm.html
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\help_recover_instructions+dqm.html
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\help_recover_instructions+dqm.txt
C:\Documents and Settings\Default User\Application Data\help_recover_instructions+dqm.txt
C:\Documents and Settings\Default User\Favorites\help_recover_instructions+dqm.txt
C:\Documents and Settings\Default User\Favorites\help_recover_instructions+dqm.html
C:\Documents and Settings\Default User\Cookies\help_recover_instructions+dqm.html
C:\Documents and Settings\Default User\Application Data\help_recover_instructions+dqm.html
C:\Documents and Settings\Default User\Cookies\help_recover_instructions+dqm.txt
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\help_recover_instructions+dqm.txt
C:\Documents and Settings\Default User\Application Data\Microsoft\Media Player\help_recover_instructions+dqm.txt
C:\Documents and Settings\Default User\Application Data\Microsoft\Media Player\help_recover_instructions+dqm.html
C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\help_recover_instructions+dqm.html
%ALLUSERSPROFILE%\help_recover_instructions+dqm.html
C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\help_recover_instructions+dqm.txt
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\Certificates\help_recover_instructions+dqm.txt
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CTLs\help_recover_instructions+dqm.txt
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CTLs\help_recover_instructions+dqm.html
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CRLs\help_recover_instructions+dqm.html
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\Certificates\help_recover_instructions+dqm.html
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CRLs\help_recover_instructions+dqm.txt
C:\Documents and Settings\Default User\Local Settings\Temp\help_recover_instructions+dqm.html
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\help_recover_instructions+dqm.txt
C:\Documents and Settings\Default User\Local Settings\Temp\help_recover_instructions+dqm.txt
C:\Documents and Settings\Default User\Local Settings\History\help_recover_instructions+dqm.txt
C:\Documents and Settings\Default User\Local Settings\History\help_recover_instructions+dqm.html
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\help_recover_instructions+dqm.html
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\help_recover_instructions+dqm.html
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\help_recover_instructions+dqm.txt
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\help_recover_instructions+dqm.txt
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\help_recover_instructions+dqm.txt
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\help_recover_instructions+dqm.html
C:\Documents and Settings\Default User\Local Settings\History\History.IE5\help_recover_instructions+dqm.html
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\help_recover_instructions+dqm.html
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\help_recover_instructions+dqm.txt
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\help_recover_instructions+dqm.txt
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Media Player\help_recover_instructions+dqm.txt
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Media Player\help_recover_instructions+dqm.html
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\help_recover_instructions+dqm.html
C:\Documents and Settings\Default User\Local Settings\Application Data\help_recover_instructions+dqm.html
C:\Documents and Settings\Default User\Local Settings\History\History.IE5\help_recover_instructions+dqm.txt
C:\Documents and Settings\Default User\Local Settings\Application Data\help_recover_instructions+dqm.txt
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\help_recover_instructions+dqm.txt
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\help_recover_instructions+dqm.html
%ALLUSERSPROFILE%\help_recover_instructions+dqm.txt
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\help_recover_instructions+dqm.html
%ALLUSERSPROFILE%\Documents\My Pictures\help_recover_instructions+dqm.txt
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\help_recover_instructions+dqm.txt
%ALLUSERSPROFILE%\Documents\My Music\help_recover_instructions+dqm.txt
%ALLUSERSPROFILE%\Documents\My Music\help_recover_instructions+dqm.html
%ALLUSERSPROFILE%\Documents\My Pictures\help_recover_instructions+dqm.html
%ALLUSERSPROFILE%\Documents\help_recover_instructions+dqm.html
%ALLUSERSPROFILE%\DRM\help_recover_instructions+dqm.txt
%ALLUSERSPROFILE%\Documents\help_recover_instructions+dqm.txt
%ALLUSERSPROFILE%\Documents\My Videos\help_recover_instructions+dqm.txt
%ALLUSERSPROFILE%\Documents\My Videos\help_recover_instructions+dqm.html
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\help_recover_instructions+dqm.html
<Текущая директория>\help_recover_instructions+dqm.html
%ALLUSERSPROFILE%\Documents\My Music\My Playlists\help_recover_instructions+dqm.txt
<Текущая директория>\help_recover_instructions+dqm.txt
%APPDATA%\bonvkhe45.exe
%HOMEPATH%\My Documents\recover_file_fvpalduyl.txt
%ALLUSERSPROFILE%\Documents\My Music\My Playlists\help_recover_instructions+dqm.html
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\0338E140\help_recover_instructions+dqm.html
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\help_recover_instructions+dqm.txt
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\0338E140\help_recover_instructions+dqm.txt
%ALLUSERSPROFILE%\Documents\My Music\Sample Music\help_recover_instructions+dqm.txt
%ALLUSERSPROFILE%\Documents\My Music\Sample Music\help_recover_instructions+dqm.html
%ALLUSERSPROFILE%\Start Menu\Programs\Games\help_recover_instructions+dqm.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Games\help_recover_instructions+dqm.html
%ALLUSERSPROFILE%\Start Menu\Programs\Administrative Tools\help_recover_instructions+dqm.html
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\help_recover_instructions+dqm.html
%ALLUSERSPROFILE%\Start Menu\Programs\Administrative Tools\help_recover_instructions+dqm.txt
%ALLUSERSPROFILE%\Start Menu\Programs\help_recover_instructions+dqm.txt
%ALLUSERSPROFILE%\Templates\help_recover_instructions+dqm.txt
%ALLUSERSPROFILE%\Templates\help_recover_instructions+dqm.html
%ALLUSERSPROFILE%\Start Menu\help_recover_instructions+dqm.html
%ALLUSERSPROFILE%\Start Menu\Programs\help_recover_instructions+dqm.html
%ALLUSERSPROFILE%\Start Menu\help_recover_instructions+dqm.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\help_recover_instructions+dqm.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Accessibility\help_recover_instructions+dqm.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Accessibility\help_recover_instructions+dqm.html
%ALLUSERSPROFILE%\Favorites\help_recover_instructions+dqm.html
%ALLUSERSPROFILE%\DRM\help_recover_instructions+dqm.html
%ALLUSERSPROFILE%\Favorites\help_recover_instructions+dqm.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Communications\help_recover_instructions+dqm.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\System Tools\help_recover_instructions+dqm.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\System Tools\help_recover_instructions+dqm.html
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Entertainment\help_recover_instructions+dqm.html
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Communications\help_recover_instructions+dqm.html
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Entertainment\help_recover_instructions+dqm.txt
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\help_recover_instructions+dqm.html
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\help_recover_instructions+dqm.txt
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\help_recover_instructions+dqm.html
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\help_recover_instructions+dqm.html
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Credentials\help_recover_instructions+dqm.html
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\help_recover_instructions+dqm.txt
C:\Documents and Settings\LocalService\Local Settings\Application Data\help_recover_instructions+dqm.txt
C:\Documents and Settings\LocalService\Local Settings\History\help_recover_instructions+dqm.txt
C:\Documents and Settings\LocalService\Local Settings\History\help_recover_instructions+dqm.html
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\help_recover_instructions+dqm.html
C:\Documents and Settings\LocalService\Local Settings\Application Data\help_recover_instructions+dqm.html
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\help_recover_instructions+dqm.txt
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Credentials\help_recover_instructions+dqm.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\help_recover_instructions+dqm.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\help_recover_instructions+dqm.html
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\help_recover_instructions+dqm.html
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\help_recover_instructions+dqm.html
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\help_recover_instructions+dqm.txt
C:\Documents and Settings\LocalService\Application Data\help_recover_instructions+dqm.txt
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-19\help_recover_instructions+dqm.txt
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-19\help_recover_instructions+dqm.html
C:\Documents and Settings\LocalService\Cookies\help_recover_instructions+dqm.html
C:\Documents and Settings\LocalService\Application Data\help_recover_instructions+dqm.html
C:\Documents and Settings\LocalService\Cookies\help_recover_instructions+dqm.txt
C:\Documents and Settings\LocalService\Local Settings\help_recover_instructions+dqm.html
C:\Documents and Settings\LocalService\help_recover_instructions+dqm.txt
C:\Documents and Settings\LocalService\Local Settings\help_recover_instructions+dqm.txt
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\help_recover_instructions+dqm.txt
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\help_recover_instructions+dqm.html
C:\Documents and Settings\LocalService\help_recover_instructions+dqm.html
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Credentials\help_recover_instructions+dqm.html
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Internet Explorer\help_recover_instructions+dqm.txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Credentials\help_recover_instructions+dqm.txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Credentials\S-1-5-20\help_recover_instructions+dqm.txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Credentials\S-1-5-20\help_recover_instructions+dqm.html
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\help_recover_instructions+dqm.html
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\BGGTYMH1\help_recover_instructions+dqm.html
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\CJCTQ25G\help_recover_instructions+dqm.txt
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\BGGTYMH1\help_recover_instructions+dqm.txt
C:\Documents and Settings\LocalService\Local Settings\Temp\help_recover_instructions+dqm.txt
C:\Documents and Settings\LocalService\Local Settings\Temp\help_recover_instructions+dqm.html
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\CJCTQ25G\help_recover_instructions+dqm.html
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\MOE00UY1\help_recover_instructions+dqm.html
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\help_recover_instructions+dqm.txt
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\MOE00UY1\help_recover_instructions+dqm.txt
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\LBMMC3H3\help_recover_instructions+dqm.txt
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\LBMMC3H3\help_recover_instructions+dqm.html
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\help_recover_instructions+dqm.txt
C:\Documents and Settings\Default User\SendTo\help_recover_instructions+dqm.html
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Accessibility\help_recover_instructions+dqm.txt
C:\Documents and Settings\Default User\SendTo\help_recover_instructions+dqm.txt
C:\Documents and Settings\Default User\Recent\help_recover_instructions+dqm.txt
C:\Documents and Settings\Default User\Recent\help_recover_instructions+dqm.html
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Accessibility\help_recover_instructions+dqm.html
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\help_recover_instructions+dqm.html
C:\Documents and Settings\Default User\Start Menu\Programs\Startup\help_recover_instructions+dqm.txt
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\help_recover_instructions+dqm.txt
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Entertainment\help_recover_instructions+dqm.txt
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Entertainment\help_recover_instructions+dqm.html
C:\Documents and Settings\Default User\PrintHood\help_recover_instructions+dqm.html
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\help_recover_instructions+dqm.html
C:\Documents and Settings\Default User\Local Settings\help_recover_instructions+dqm.txt
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\help_recover_instructions+dqm.txt
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\help_recover_instructions+dqm.txt
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\help_recover_instructions+dqm.html
C:\Documents and Settings\Default User\Local Settings\help_recover_instructions+dqm.html
C:\Documents and Settings\Default User\NetHood\help_recover_instructions+dqm.html
C:\Documents and Settings\Default User\PrintHood\help_recover_instructions+dqm.txt
C:\Documents and Settings\Default User\NetHood\help_recover_instructions+dqm.txt
C:\Documents and Settings\Default User\My Documents\help_recover_instructions+dqm.txt
C:\Documents and Settings\Default User\My Documents\help_recover_instructions+dqm.html
C:\Documents and Settings\LocalService\Application Data\Microsoft\Media Player\help_recover_instructions+dqm.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\Media Player\help_recover_instructions+dqm.html
C:\Documents and Settings\LocalService\Application Data\Microsoft\Internet Explorer\help_recover_instructions+dqm.html
C:\Documents and Settings\LocalService\Application Data\Microsoft\Credentials\help_recover_instructions+dqm.html
C:\Documents and Settings\LocalService\Application Data\Microsoft\Internet Explorer\help_recover_instructions+dqm.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\Certificates\help_recover_instructions+dqm.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CTLs\help_recover_instructions+dqm.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CTLs\help_recover_instructions+dqm.html
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CRLs\help_recover_instructions+dqm.html
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\Certificates\help_recover_instructions+dqm.html
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CRLs\help_recover_instructions+dqm.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\Credentials\help_recover_instructions+dqm.txt
C:\Documents and Settings\Default User\Start Menu\help_recover_instructions+dqm.txt
C:\Documents and Settings\Default User\Start Menu\help_recover_instructions+dqm.html
C:\Documents and Settings\Default User\Start Menu\Programs\help_recover_instructions+dqm.html
C:\Documents and Settings\Default User\Start Menu\Programs\Startup\help_recover_instructions+dqm.html
C:\Documents and Settings\Default User\Start Menu\Programs\help_recover_instructions+dqm.txt
C:\Documents and Settings\Default User\Templates\help_recover_instructions+dqm.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\Credentials\S-1-5-19\help_recover_instructions+dqm.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\Credentials\S-1-5-19\help_recover_instructions+dqm.html
C:\Documents and Settings\Default User\help_recover_instructions+dqm.html
C:\Documents and Settings\Default User\Templates\help_recover_instructions+dqm.html
C:\Documents and Settings\Default User\help_recover_instructions+dqm.txt

Перемещает следующие файлы:

%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\prefs.js в %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\prefs.js.micro
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\sessionstore.js в %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\sessionstore.js.micro
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\userContent-example.css в %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\userContent-example.css.micro
%APPDATA%\Microsoft\Internet Explorer\brndlog.txt в %APPDATA%\Microsoft\Internet Explorer\brndlog.txt.micro
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\userChrome-example.css в %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\userChrome-example.css.micro

Самоудаляется.

Сетевая активность:

Подключается к:

'su###est.com':80
'www.ne###vis.org':80
'ya####gulten.com':80
'sa####atrading.com':80
'ip.#yk.nu':80
'www.sh#######wakarmaengworks.com':80
'su#####housebuyers.com':80

TCP:

Запросы HTTP GET:

http://ip.#yk.nu/

Запросы HTTP POST:

http://su###est.com/mssys.php
http://www.ne###vis.org/administrator/components/com_acymailing/extensions/plg_editors_acyeditor/acyeditor/ckeditor/plugins/image/dialogs/miscinfo.php
http://ya####gulten.com/dbsys.php
http://www.sh#######wakarmaengworks.com/mssys.php
http://su#####housebuyers.com/images/watermarks/original/mssys.php
http://sa####atrading.com/mssys.php

UDP:

DNS ASK su###est.com
DNS ASK www.ne###vis.org
DNS ASK ya####gulten.com
DNS ASK sa####atrading.com
DNS ASK ip.#yk.nu
DNS ASK www.sh#######wakarmaengworks.com
DNS ASK su#####housebuyers.com

Другое:

Ищет следующие окна:

ClassName: 'Indicator' WindowName: ''

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней