Trojan.DownLoader22.14294

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '{Q39SN47D-D83M-ALR9-1I59-HW9R739VK1}' = '%HOMEPATH%\Start Menu\Programs\Startup\{Q39SN47D-D83M-ALR9-1I59-HW9R739VK1}.exe'

Создает или изменяет следующие файлы:

%HOMEPATH%\Start Menu\Programs\Startup\{Q39SN47D-D83M-ALR9-1I59-HW9R739VK1}.exe

Изменения в файловой системе:

Создает следующие файлы:

C:\Far2\Documentation\rus\Plugins.Install.txt.SN-4970138133846987-recovery1@writeme.com
C:\Far2\Documentation\rus\Far.FAQ.txt.SN-4970138133846987-recovery1@writeme.com
C:\Far2\Documentation\rus\Bug.Report.txt.SN-4970138133846987-recovery1@writeme.com
C:\Far2\Plugins\7-Zip\far7z.txt.SN-4970138133846987-recovery1@writeme.com
C:\Far2\Documentation\rus\TechInfo.txt.SN-4970138133846987-recovery1@writeme.com
C:\Far2\Documentation\rus\Plugins.Review.txt.SN-4970138133846987-recovery1@writeme.com
C:\Far2\Documentation\rus\Arc.Support.txt.SN-4970138133846987-recovery1@writeme.com
C:\Far2\Documentation\eng\Far.FAQ.txt.SN-4970138133846987-recovery1@writeme.com
C:\Far2\Documentation\eng\Bug.Report.txt.SN-4970138133846987-recovery1@writeme.com
C:\Far2\Documentation\eng\Arc.Support.txt.SN-4970138133846987-recovery1@writeme.com
C:\Far2\Documentation\eng\TechInfo.txt.SN-4970138133846987-recovery1@writeme.com
C:\Far2\Documentation\eng\Plugins.Install.txt.SN-4970138133846987-recovery1@writeme.com
C:\Far2\Documentation\eng\Plugins.Review.txt.SN-4970138133846987-recovery1@writeme.com
C:\Far2\Plugins\Colorer\catalog.xml.SN-4970138133846987-recovery1@writeme.com
C:\Far2\Plugins\FTP\FtpCmds.txt.SN-4970138133846987-recovery1@writeme.com
C:\Far2\Plugins\ExtSearch\doc\RUS_READ.TXT.SN-4970138133846987-recovery1@writeme.com
C:\Far2\Plugins\ExtSearch\doc\RUS_NEWS.TXT.SN-4970138133846987-recovery1@writeme.com
C:\Far2\Plugins\FTP\Notes_rus.txt.SN-4970138133846987-recovery1@writeme.com
C:\Far2\Plugins\FTP\Notes.txt.SN-4970138133846987-recovery1@writeme.com
C:\Far2\Plugins\FTP\FtpCmds_rus.txt.SN-4970138133846987-recovery1@writeme.com
C:\Far2\Plugins\ExtSearch\doc\REGEXPS.TXT.SN-4970138133846987-recovery1@writeme.com
C:\Far2\Plugins\Colorer\hrd\catalog-rgb.xml.SN-4970138133846987-recovery1@writeme.com
C:\Far2\Plugins\Colorer\hrd\catalog-console.xml.SN-4970138133846987-recovery1@writeme.com
C:\Far2\Plugins\Colorer\hrc\changes.txt.SN-4970138133846987-recovery1@writeme.com
C:\Far2\Plugins\ExtSearch\doc\ENG_READ.TXT.SN-4970138133846987-recovery1@writeme.com
C:\Far2\Plugins\ExtSearch\doc\ENG_NEWS.TXT.SN-4970138133846987-recovery1@writeme.com
C:\Far2\Plugins\Colorer\hrd\catalog-text.xml.SN-4970138133846987-recovery1@writeme.com
C:\Documents and Settings\Default User\Templates\winword.doc.SN-4970138133846987-recovery1@writeme.com
C:\Documents and Settings\Default User\Templates\excel.xls.SN-4970138133846987-recovery1@writeme.com
C:\Documents and Settings\Default User\Templates\excel4.xls.SN-4970138133846987-recovery1@writeme.com
%APPDATA%\Microsoft\Address Book\%USERNAME%.wab.SN-4970138133846987-recovery1@writeme.com
C:\Documents and Settings\Default User\Templates\winword2.doc.SN-4970138133846987-recovery1@writeme.com
C:\Documents and Settings\Default User\Templates\powerpnt.ppt.SN-4970138133846987-recovery1@writeme.com
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\WMSDKNS.XML.SN-4970138133846987-recovery1@writeme.com
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Water lilies.jpg.SN-4970138133846987-recovery1@writeme.com
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Sunset.jpg.SN-4970138133846987-recovery1@writeme.com
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Blue hills.jpg.SN-4970138133846987-recovery1@writeme.com
C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\brndlog.txt.SN-4970138133846987-recovery1@writeme.com
C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\brndlog.bak.SN-4970138133846987-recovery1@writeme.com
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Winter.jpg.SN-4970138133846987-recovery1@writeme.com
%APPDATA%\Microsoft\Internet Explorer\brndlog.bak.SN-4970138133846987-recovery1@writeme.com
%HOMEPATH%\Templates\powerpnt.ppt.SN-4970138133846987-recovery1@writeme.com
%HOMEPATH%\Templates\excel4.xls.SN-4970138133846987-recovery1@writeme.com
%HOMEPATH%\Templates\excel.xls.SN-4970138133846987-recovery1@writeme.com
C:\Far2\Addons\README.TXT.SN-4970138133846987-recovery1@writeme.com
%HOMEPATH%\Templates\winword2.doc.SN-4970138133846987-recovery1@writeme.com
%HOMEPATH%\Templates\winword.doc.SN-4970138133846987-recovery1@writeme.com
<LS_APPDATA>\Microsoft\Windows Media\9.0\WMSDKNS.XML.SN-4970138133846987-recovery1@writeme.com
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\key3.db.SN-4970138133846987-recovery1@writeme.com
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\cert8.db.SN-4970138133846987-recovery1@writeme.com
%APPDATA%\Microsoft\Internet Explorer\brndlog.txt.SN-4970138133846987-recovery1@writeme.com
<LS_APPDATA>\IconCache.db.SN-4970138133846987-recovery1@writeme.com
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\sessionstore.bak.SN-4970138133846987-recovery1@writeme.com
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\secmod.db.SN-4970138133846987-recovery1@writeme.com