Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Classes\SummationCaseInfoFile\shell\open\command] '' = '\\fslitdc01\Apps\Summation\sw32.exe "%1"'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\PrismXL] 'ImagePath' = '%CommonProgramFiles%\New Boundary\PrismXL\PRISMXL.SYS'
- [<HKLM>\SYSTEM\ControlSet001\Services\PrismXL] 'Start' = '00000002'
Вредоносные функции:
Запускает на исполнение:
- '%CommonProgramFiles%\New Boundary\PrismXL\PRISMXL.SYS'
Изменения в файловой системе:
Создает следующие файлы:
- <SYSTEM32>\ltisi13n.dll
- <SYSTEM32>\ltisi13n.ocx
- <SYSTEM32>\ltkrn13n.dll
- <SYSTEM32>\ltefx13n.dll
- <SYSTEM32>\ltfil13n.dll
- <SYSTEM32>\ltimg13n.dll
- <SYSTEM32>\ltlst13n.dll
- <SYSTEM32>\ltodb13n.ocx
- <SYSTEM32>\LTROC13n.DLL
- <SYSTEM32>\LTSCR13n.DLL
- <SYSTEM32>\ltlst13n.ocx
- <SYSTEM32>\LTOCR13n.dll
- <SYSTEM32>\ltocx13n.ocx
- <SYSTEM32>\lfgif13n.dll
- <SYSTEM32>\lfpdf13n.dll
- <SYSTEM32>\lftif13n.dll
- <SYSTEM32>\lfbmp13n.dll
- <SYSTEM32>\lfcmp13n.dll
- <SYSTEM32>\lffax13n.dll
- <SYSTEM32>\ltann13n.dll
- <SYSTEM32>\ltdlg13n.dll
- <SYSTEM32>\ltdlg13n.ocx
- <SYSTEM32>\ltdnc13n.ocx
- <SYSTEM32>\LTDic13n.dll
- <SYSTEM32>\ltdic13n.ocx
- <SYSTEM32>\ltdis13n.dll
- %WINDIR%\Downloaded Program Files\dwusplay.exe
- %WINDIR%\Downloaded Program Files\isusweb.dll
- %WINDIR%\Installer\173f0d36.msi
- <SYSTEM32>\PdfDll32.dll
- <SYSTEM32>\TabCtl32.ocx
- %WINDIR%\Downloaded Program Files\dwusplay.dll
- %WINDIR%\Installer\{AB0360E2-6FD5-46FD-B597-3B8CF45E02BD}\_6AC2DE0257FE429C86B985C3E56F11D9
- %ALLUSERSPROFILE%\Desktop\CT Summation iBlaze Client.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\CT Summation iBlaze Client\CT Summation iBlaze Client.lnk
- %WINDIR%\PICTAKER.LOG
- %WINDIR%\Installer\{AB0360E2-6FD5-46FD-B597-3B8CF45E02BD}\Shortcut0.C3A146F5_4B48_11D5_A819_00B0D0428C0C.exe
- %WINDIR%\Installer\{AB0360E2-6FD5-46FD-B597-3B8CF45E02BD}\SW32.ICO
- %WINDIR%\sum_inst.ini
- <SYSTEM32>\lttwn13n.dll
- <SYSTEM32>\ltvec13n.ocx
- <SYSTEM32>\ltwen13n.dll
- <SYSTEM32>\ltscr13n.ocx
- <SYSTEM32>\lttmb13n.dll
- <SYSTEM32>\lttmb13n.ocx
- <SYSTEM32>\LTWND13n.DLL
- <SYSTEM32>\Mscomct2.ocx
- <SYSTEM32>\MSCOMCTL.OCX
- <SYSTEM32>\msvcp70.dll
- <SYSTEM32>\Ltwvc13n.dll
- <SYSTEM32>\mfc70.dll
- <SYSTEM32>\mfc70u.dll
- %ProgramFiles%\Altiris\Altiris Agent\Software Delivery\AeXSWDPolicy.xml
- %ProgramFiles%\Altiris\Altiris Agent\Software Delivery\{01B54EB5-3679-4C73-9E10-E169D5A5EC59}\package.xml
- %ProgramFiles%\Altiris\Altiris Agent\Software Delivery\{0DC6BD6B-5ED1-4026-987B-B91F1B00327F}\package.xml
- %ProgramFiles%\Altiris\Altiris Agent\Queue\{3E118974-6A06-4D12-BDE9-46AB8DEC208B}
- %ProgramFiles%\Altiris\Altiris Agent\Queue\{A2927123-D0D8-4E31-8C92-55D478095FF3}
- %ProgramFiles%\Altiris\Altiris Agent\Queue\{B5E3A870-DD95-4950-A27B-AC601958E23B}
- %ProgramFiles%\Altiris\Altiris Agent\Software Delivery\{2E86452B-F8E2-4C51-8C6C-43476372EFB1}\package.xml
- %ProgramFiles%\Altiris\Altiris Agent\Software Delivery\{5FA31642-CB4A-43DE-A538-CBB8B6E3BCB7}\package.xml
- %ProgramFiles%\Altiris\Altiris Agent\Software Delivery\{88EE2E78-12BF-46A2-A884-118CE2A3AD6D}\package.xml
- %ProgramFiles%\Altiris\Altiris Agent\Software Delivery\{966BFB9E-E1C1-4577-A10A-0975873613BA}\package.xml
- %ProgramFiles%\Altiris\Altiris Agent\Software Delivery\{3C73267A-B977-4C27-BA39-DF1E5B4E0B1D}\package.xml
- %ProgramFiles%\Altiris\Altiris Agent\Software Delivery\{413C69D4-238D-4ED2-8B12-503956A673A1}\package.xml
- %ProgramFiles%\Altiris\Altiris Agent\Software Delivery\{5B686441-1F6C-4A77-99DD-7EBDE9F6479D}\package.xml
- %ALLUSERSPROFILE%\Application Data\Prism Pack\UNAPPLY\<Имя вируса> 1.PWR
- C:\Config.Msi\173f0d33.rbf
- C:\Config.Msi\173f0d34.rbf
- %TEMP%\PRISMXL.SYS
- %CommonProgramFiles%\New Boundary\PrismXL\PRISMXL.SYS
- %ALLUSERSPROFILE%\Application Data\Prism Pack\UNAPPLY\<Имя вируса>.PWR
- %ALLUSERSPROFILE%\Application Data\InstallShield\UpdateService\Database\{AB0360E2-6FD5-46FD-B597-3B8CF45E02BD}.ini
- %ProgramFiles%\Altiris\Altiris Agent\PackageDownload\{7B3D9240-6943-4776-A010-E86B192C5C9A}\package.xml
- %ProgramFiles%\Altiris\Altiris Agent\PackageDownload\{7B3D9240-6943-4776-A010-E86B192C5C9A}\snapshot.xml
- %ProgramFiles%\Altiris\Altiris Agent\Queue\{00DF3301-6410-495C-B260-68F44BFAF792}
- %ProgramFiles%\Altiris\Altiris Agent\AeXProcessList.txt
- %ProgramFiles%\Altiris\Altiris Agent\Client Policies\DCALTNS01.xml
- %ProgramFiles%\Altiris\Altiris Agent\Logs\agent.log
- %ProgramFiles%\Altiris\Altiris Agent\Tasks\{B2CAFF18-8FF9-43AA-AB4D-390CEDDB987D}.xml
- %ProgramFiles%\Altiris\Altiris Agent\Tasks\{BFBAB29A-46A8-4839-A664-9F181053AFCD}.xml
- %ProgramFiles%\Altiris\Altiris Agent\Tasks\{CC9FE4E4-C2EE-4F60-8782-CC7CCAA3EF77}.xml
- %ProgramFiles%\Altiris\Altiris Agent\Tasks\{60695817-4750-414D-AD84-B47F3EF69BE0}.xml
- %ProgramFiles%\Altiris\Altiris Agent\Tasks\{7E0A8B04-5357-4BC3-8113-22CB62B7B860}.xml
- %ProgramFiles%\Altiris\Altiris Agent\Tasks\{95B05241-D980-4EDE-ABBB-78E811544EC4}.xml
- %ProgramFiles%\Altiris\Altiris Agent\Tasks\{F45A2492-945D-414D-810F-AD72D745316B}.xml
- %CommonProgramFiles%\InstallShield\UpdateService\issch.exe
- %ProgramFiles%\Microsoft Office\OFFICE11\ADDINS\ASMAPISEC.ECF
- <SYSTEM32>\COMDLG32.OCX
- %CommonProgramFiles%\InstallShield\UpdateService\_isusres.dll
- %CommonProgramFiles%\InstallShield\UpdateService\agent.exe
- %CommonProgramFiles%\InstallShield\UpdateService\ISDM.exe
- %ProgramFiles%\Altiris\Altiris Agent\Software Delivery\{EC7804A8-0734-4AC8-B90C-1094B2B23F1F}\package.xml
- %ProgramFiles%\Altiris\Altiris Agent\Tasks\{07A380DD-983F-41AD-A3EB-BAC950CE5B87}.xml
- %ProgramFiles%\Altiris\Altiris Agent\Tasks\{0FDCB93C-531F-4500-AE25-31F4347CB123}.xml
- %ProgramFiles%\Altiris\Altiris Agent\Software Delivery\{BC9C9C95-5203-4E1B-A794-A357E4C8B7F8}\package.xml
- %ProgramFiles%\Altiris\Altiris Agent\Software Delivery\{CCB978D5-28E2-4D97-9900-FCB72631F483}\package.xml
- %ProgramFiles%\Altiris\Altiris Agent\Software Delivery\{E057B41A-8A62-489B-8CAC-E7E78FB0B03C}\package.xml
- %ProgramFiles%\Altiris\Altiris Agent\Tasks\{26072E00-A310-40DE-A9DD-799603D7345B}.xml
- %ProgramFiles%\Altiris\Altiris Agent\Tasks\{5786C5DC-B99E-4056-9394-4FD556718E65}.xml
- %ProgramFiles%\Altiris\Altiris Agent\Tasks\{5DDCB1E1-BC2A-42BA-812E-4E1818C78987}.xml
- %ProgramFiles%\Altiris\Altiris Agent\Tasks\{603C8E25-7873-4F57-B8BA-A3FDD37789DB}.xml
- %ProgramFiles%\Altiris\Altiris Agent\Tasks\{2D3FD280-BA19-46F0-82E8-DC1FCF58C2E0}.xml
- %ProgramFiles%\Altiris\Altiris Agent\Tasks\{31AA89CE-2851-40C5-9178-8BEA31EE5595}.xml
- %ProgramFiles%\Altiris\Altiris Agent\Tasks\{3DCCF10C-F0C3-4F3D-90CD-7BC628317A65}.xml
Удаляет следующие файлы:
- %ALLUSERSPROFILE%\Application Data\Prism Pack\UNAPPLY\<Имя вируса> 1.PWR
- %ALLUSERSPROFILE%\Application Data\Prism Pack\UNAPPLY\<Имя вируса>.PWR
- %TEMP%\PRISMXL.SYS
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
