Trojan.AVKill.61724

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'UserFaultCheck' = '<SYSTEM32>\dumprep 0 -u'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Windows Driver' = '%WINDIR%\lsass.exe'

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\SA.DAT

Вредоносные функции:

Для затруднения выявления своего присутствия в системе

блокирует:

Компонент восстановления системы (SR)

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k netsvcs
'<SYSTEM32>\dumprep.exe' 1116 -dm 7 7 %WINDIR%\PCHealth\ErrorRep\UserDumps\svchost.exe.20160516-192921-00.hdmp 16325836412032008
'<SYSTEM32>\dumprep.exe' 1116 -dm 7 7 %WINDIR%\PCHealth\ErrorRep\UserDumps\svchost.exe.20160516-192921-00.mdmp 16325836412032008

Завершает или пытается завершить

следующие системные процессы:

<SYSTEM32>\svchost.exe

следующие пользовательские процессы:

nod32.exe

Изменения в файловой системе:

Создает следующие файлы:

%WINDIR%\Downloaded Program Files\Need.For.Speed.Undercover.CLONEDVD-THEPIRATEGAY .exe
%WINDIR%\Downloaded Program Files\Grand Theft Auto IV PC Edition REAL DEAL FOLKS 4544939 TPB .exe
%WINDIR%\Downloaded Program Files\LimeWire .exe
%WINDIR%\Downloaded Program Files\AVG Anti-Virus Free Edition .exe
%WINDIR%\Downloaded Program Files\IPCop 1.4.16.exe
%WINDIR%\Downloaded Program Files\Ubuntu Ultimate Edition 1.4 DVD.exe
%ProgramFiles%\Movie Maker\Shared\bad allocation
%WINDIR%\Downloaded Program Files\Adobe CS4 Master Collection Windows-mazuki_darksiderg .exe
%WINDIR%\Downloaded Program Files\Damn Small Linux 3.4 Virtual Machine.cmd
%WINDIR%\Downloaded Program Files\Ad-Aware 2008 .exe
%WINDIR%\pchealth\UploadLB\Grand Theft Auto IV PC Edition REAL DEAL FOLKS 4544939 TPB .exe
%WINDIR%\pchealth\UploadLB\IPCop 1.4.16.exe
%WINDIR%\pchealth\UploadLB\AVG Anti-Virus Free Edition .exe
%WINDIR%\pchealth\UploadLB\Need.For.Speed.Undercover.CLONEDVD-THEPIRATEGAY .exe
%WINDIR%\pchealth\UploadLB\Adobe CS4 Master Collection Windows-mazuki_darksiderg .exe
%WINDIR%\Downloaded Program Files\bad allocation
%WINDIR%\Downloaded Program Files\WinRAR .exe
%WINDIR%\pchealth\UploadLB\Damn Small Linux 3.4 Virtual Machine.cmd
%WINDIR%\pchealth\UploadLB\Ubuntu Ultimate Edition 1.4 DVD.exe
%ProgramFiles%\Movie Maker\Shared\WinRAR .exe
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\downloads\LimeWire .exe
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\downloads\AVG Anti-Virus Free Edition .exe
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\downloads\WinRAR .exe
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\downloads\Ad-Aware 2008 .exe
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\downloads\Need.For.Speed.Undercover.CLONEDVD-THEPIRATEGAY .exe
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\downloads\Adobe CS4 Master Collection Windows-mazuki_darksiderg .exe
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\downloads\Damn Small Linux 3.4 Virtual Machine.cmd
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\downloads\Grand Theft Auto IV PC Edition REAL DEAL FOLKS 4544939 TPB .exe
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\downloads\IPCop 1.4.16.exe
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\downloads\bad allocation
%ProgramFiles%\Movie Maker\Shared\AVG Anti-Virus Free Edition .exe
%ProgramFiles%\Movie Maker\Shared\Need.For.Speed.Undercover.CLONEDVD-THEPIRATEGAY .exe
%ProgramFiles%\Movie Maker\Shared\Ad-Aware 2008 .exe
%ProgramFiles%\Movie Maker\Shared\LimeWire .exe
%ProgramFiles%\Movie Maker\Shared\Grand Theft Auto IV PC Edition REAL DEAL FOLKS 4544939 TPB .exe
%ProgramFiles%\Movie Maker\Shared\Damn Small Linux 3.4 Virtual Machine.cmd
%ProgramFiles%\Movie Maker\Shared\Ubuntu Ultimate Edition 1.4 DVD.exe
%ProgramFiles%\Movie Maker\Shared\IPCop 1.4.16.exe
%ProgramFiles%\Movie Maker\Shared\Adobe CS4 Master Collection Windows-mazuki_darksiderg .exe
<SYSTEM32>\config\systemprofile\Favorites\Ubuntu Ultimate Edition 1.4 DVD.exe
%WINDIR%\SoftwareDistribution\Download\bad allocation
<SYSTEM32>\config\systemprofile\Favorites\Adobe CS4 Master Collection Windows-mazuki_darksiderg .exe
<SYSTEM32>\config\systemprofile\Favorites\Damn Small Linux 3.4 Virtual Machine.cmd
%WINDIR%\SoftwareDistribution\Download\WinRAR .exe
%WINDIR%\SoftwareDistribution\Download\AVG Anti-Virus Free Edition .exe
%WINDIR%\SoftwareDistribution\Download\Need.For.Speed.Undercover.CLONEDVD-THEPIRATEGAY .exe
%WINDIR%\SoftwareDistribution\Download\Ad-Aware 2008 .exe
%WINDIR%\SoftwareDistribution\Download\LimeWire .exe
<SYSTEM32>\config\systemprofile\Favorites\IPCop 1.4.16.exe
<SYSTEM32>\config\systemprofile\Favorites\bad allocation
<SYSTEM32>\config\systemprofile\Favorites\WinRAR .exe
%WINDIR%\pchealth\ERRORREP\UserDumps\svchost.exe.20160516-192921-00.hdmp
<Служебный элемент>
<SYSTEM32>\config\systemprofile\Favorites\Ad-Aware 2008 .exe
<SYSTEM32>\config\systemprofile\Favorites\Need.For.Speed.Undercover.CLONEDVD-THEPIRATEGAY .exe
<SYSTEM32>\config\systemprofile\Favorites\Grand Theft Auto IV PC Edition REAL DEAL FOLKS 4544939 TPB .exe
<SYSTEM32>\config\systemprofile\Favorites\LimeWire .exe
<SYSTEM32>\config\systemprofile\Favorites\AVG Anti-Virus Free Edition .exe
%WINDIR%\SoftwareDistribution\Download\Grand Theft Auto IV PC Edition REAL DEAL FOLKS 4544939 TPB .exe
%WINDIR%\SoftwareDistribution\Adobe CS4 Master Collection Windows-mazuki_darksiderg .exe
%WINDIR%\SoftwareDistribution\Damn Small Linux 3.4 Virtual Machine.cmd
%WINDIR%\SoftwareDistribution\Grand Theft Auto IV PC Edition REAL DEAL FOLKS 4544939 TPB .exe
%WINDIR%\SoftwareDistribution\IPCop 1.4.16.exe
%WINDIR%\SoftwareDistribution\Ubuntu Ultimate Edition 1.4 DVD.exe
%WINDIR%\pchealth\UploadLB\Ad-Aware 2008 .exe
%WINDIR%\pchealth\UploadLB\LimeWire .exe
%WINDIR%\pchealth\UploadLB\bad allocation
%WINDIR%\pchealth\UploadLB\WinRAR .exe
%WINDIR%\SoftwareDistribution\Need.For.Speed.Undercover.CLONEDVD-THEPIRATEGAY .exe
%WINDIR%\SoftwareDistribution\Download\Damn Small Linux 3.4 Virtual Machine.cmd
%WINDIR%\SoftwareDistribution\Download\Ubuntu Ultimate Edition 1.4 DVD.exe
%WINDIR%\SoftwareDistribution\Download\IPCop 1.4.16.exe
%WINDIR%\SoftwareDistribution\Download\Adobe CS4 Master Collection Windows-mazuki_darksiderg .exe
%WINDIR%\SoftwareDistribution\bad allocation
%WINDIR%\SoftwareDistribution\LimeWire .exe
%WINDIR%\SoftwareDistribution\AVG Anti-Virus Free Edition .exe
%WINDIR%\SoftwareDistribution\WinRAR .exe
%WINDIR%\SoftwareDistribution\Ad-Aware 2008 .exe
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\mozapps\downloads\Ubuntu Ultimate Edition 1.4 DVD.exe
%ProgramFiles%\FireFox\chrome\browser\content\browser\bookmarks\IPCop 1.4.16.exe
%ProgramFiles%\FireFox\chrome\browser\content\browser\bookmarks\Adobe CS4 Master Collection Windows-mazuki_darksiderg .exe
%ProgramFiles%\FireFox\chrome\browser\content\browser\bookmarks\Need.For.Speed.Undercover.CLONEDVD-THEPIRATEGAY .exe
%ProgramFiles%\FireFox\chrome\browser\content\browser\bookmarks\Grand Theft Auto IV PC Edition REAL DEAL FOLKS 4544939 TPB .exe
%ProgramFiles%\FireFox\chrome\browser\content\browser\bookmarks\Damn Small Linux 3.4 Virtual Machine.cmd
%CommonProgramFiles%\Microsoft Shared\WinRAR .exe
%CommonProgramFiles%\Microsoft Shared\Ad-Aware 2008 .exe
%ProgramFiles%\FireFox\chrome\browser\content\browser\bookmarks\Ubuntu Ultimate Edition 1.4 DVD.exe
%CommonProgramFiles%\Microsoft Shared\bad allocation
%ProgramFiles%\FireFox\chrome\browser\content\browser\bookmarks\AVG Anti-Virus Free Edition .exe
%ProgramFiles%\FireFox\chrome\en-US\locale\browser\downloads\Adobe CS4 Master Collection Windows-mazuki_darksiderg .exe
%ProgramFiles%\FireFox\chrome\en-US\locale\browser\downloads\Damn Small Linux 3.4 Virtual Machine.cmd
%ProgramFiles%\FireFox\chrome\en-US\locale\browser\downloads\Grand Theft Auto IV PC Edition REAL DEAL FOLKS 4544939 TPB .exe
%ProgramFiles%\FireFox\chrome\en-US\locale\browser\downloads\IPCop 1.4.16.exe
%ProgramFiles%\FireFox\chrome\en-US\locale\browser\downloads\Ubuntu Ultimate Edition 1.4 DVD.exe
%ProgramFiles%\FireFox\chrome\browser\content\browser\bookmarks\Ad-Aware 2008 .exe
%ProgramFiles%\FireFox\chrome\browser\content\browser\bookmarks\LimeWire .exe
%ProgramFiles%\FireFox\chrome\browser\content\browser\bookmarks\bad allocation
%ProgramFiles%\FireFox\chrome\browser\content\browser\bookmarks\WinRAR .exe
%CommonProgramFiles%\Microsoft Shared\LimeWire .exe
%ALLUSERSPROFILE%\Favorites\Need.For.Speed.Undercover.CLONEDVD-THEPIRATEGAY .exe
%ALLUSERSPROFILE%\Favorites\Grand Theft Auto IV PC Edition REAL DEAL FOLKS 4544939 TPB .exe
%ALLUSERSPROFILE%\Favorites\LimeWire .exe
%ALLUSERSPROFILE%\Favorites\AVG Anti-Virus Free Edition .exe
%ALLUSERSPROFILE%\Favorites\IPCop 1.4.16.exe
%ALLUSERSPROFILE%\Favorites\Ubuntu Ultimate Edition 1.4 DVD.exe
%WINDIR%\lsass.exe
%ALLUSERSPROFILE%\Favorites\Adobe CS4 Master Collection Windows-mazuki_darksiderg .exe
%ALLUSERSPROFILE%\Favorites\Damn Small Linux 3.4 Virtual Machine.cmd
%ALLUSERSPROFILE%\Favorites\Ad-Aware 2008 .exe
%CommonProgramFiles%\Microsoft Shared\Grand Theft Auto IV PC Edition REAL DEAL FOLKS 4544939 TPB .exe
%CommonProgramFiles%\Microsoft Shared\IPCop 1.4.16.exe
%CommonProgramFiles%\Microsoft Shared\AVG Anti-Virus Free Edition .exe
%CommonProgramFiles%\Microsoft Shared\Need.For.Speed.Undercover.CLONEDVD-THEPIRATEGAY .exe
%CommonProgramFiles%\Microsoft Shared\Adobe CS4 Master Collection Windows-mazuki_darksiderg .exe
%ALLUSERSPROFILE%\Favorites\bad allocation
%ALLUSERSPROFILE%\Favorites\WinRAR .exe
%CommonProgramFiles%\Microsoft Shared\Damn Small Linux 3.4 Virtual Machine.cmd
%CommonProgramFiles%\Microsoft Shared\Ubuntu Ultimate Edition 1.4 DVD.exe
%ProgramFiles%\FireFox\chrome\toolkit\content\mozapps\downloads\WinRAR .exe
%ProgramFiles%\FireFox\chrome\toolkit\content\mozapps\downloads\Ad-Aware 2008 .exe
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\downloads\Ubuntu Ultimate Edition 1.4 DVD.exe
%ProgramFiles%\FireFox\chrome\toolkit\content\mozapps\downloads\bad allocation
%ProgramFiles%\FireFox\chrome\toolkit\content\mozapps\downloads\LimeWire .exe
%ProgramFiles%\FireFox\chrome\toolkit\content\mozapps\downloads\Grand Theft Auto IV PC Edition REAL DEAL FOLKS 4544939 TPB .exe
%ProgramFiles%\FireFox\chrome\toolkit\content\mozapps\downloads\IPCop 1.4.16.exe
%ProgramFiles%\FireFox\chrome\toolkit\content\mozapps\downloads\AVG Anti-Virus Free Edition .exe
%ProgramFiles%\FireFox\chrome\toolkit\content\mozapps\downloads\Need.For.Speed.Undercover.CLONEDVD-THEPIRATEGAY .exe
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\downloads\Damn Small Linux 3.4 Virtual Machine.cmd
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\downloads\Ad-Aware 2008 .exe
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\downloads\LimeWire .exe
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\downloads\bad allocation
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\downloads\WinRAR .exe
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\downloads\AVG Anti-Virus Free Edition .exe
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\downloads\IPCop 1.4.16.exe
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\downloads\Adobe CS4 Master Collection Windows-mazuki_darksiderg .exe
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\downloads\Need.For.Speed.Undercover.CLONEDVD-THEPIRATEGAY .exe
%ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\downloads\Grand Theft Auto IV PC Edition REAL DEAL FOLKS 4544939 TPB .exe
%ProgramFiles%\FireFox\chrome\toolkit\content\mozapps\downloads\Adobe CS4 Master Collection Windows-mazuki_darksiderg .exe
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\mozapps\downloads\Ubuntu Ultimate Edition 1.4 DVD.exe
%ProgramFiles%\FireFox\chrome\en-US\locale\browser\downloads\bad allocation
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\mozapps\downloads\Adobe CS4 Master Collection Windows-mazuki_darksiderg .exe
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\mozapps\downloads\Damn Small Linux 3.4 Virtual Machine.cmd
%ProgramFiles%\FireFox\chrome\en-US\locale\browser\downloads\WinRAR .exe
%ProgramFiles%\FireFox\chrome\en-US\locale\browser\downloads\AVG Anti-Virus Free Edition .exe
%ProgramFiles%\FireFox\chrome\en-US\locale\browser\downloads\Need.For.Speed.Undercover.CLONEDVD-THEPIRATEGAY .exe
%ProgramFiles%\FireFox\chrome\en-US\locale\browser\downloads\Ad-Aware 2008 .exe
%ProgramFiles%\FireFox\chrome\en-US\locale\browser\downloads\LimeWire .exe
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\mozapps\downloads\IPCop 1.4.16.exe
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\mozapps\downloads\bad allocation
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\mozapps\downloads\WinRAR .exe
%ProgramFiles%\FireFox\chrome\toolkit\content\mozapps\downloads\Damn Small Linux 3.4 Virtual Machine.cmd
%ProgramFiles%\FireFox\chrome\toolkit\content\mozapps\downloads\Ubuntu Ultimate Edition 1.4 DVD.exe
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\mozapps\downloads\Ad-Aware 2008 .exe
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\mozapps\downloads\Need.For.Speed.Undercover.CLONEDVD-THEPIRATEGAY .exe
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\mozapps\downloads\Grand Theft Auto IV PC Edition REAL DEAL FOLKS 4544939 TPB .exe
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\mozapps\downloads\LimeWire .exe
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\mozapps\downloads\AVG Anti-Virus Free Edition .exe

Сетевая активность:

Подключается к:

'21#.#17.229.161':139
'21#.#17.229.161':445

Другое:

Ищет следующие окна:

ClassName: 'RegEdit_RegEdit' WindowName: ''
ClassName: 'Scan' WindowName: ''
ClassName: 'MGHTML_DLG_CLASS' WindowName: ''
ClassName: 'NAVAP Wnd Class' WindowName: ''

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней