Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Classes\UVKLicenseKey\Shell\Open\command] '' = '"%ProgramFiles%\UVK - Ultra Virus Killer\UVK_en.exe" "%1"'
- [<HKLM>\SOFTWARE\Classes\SrSettingsFile\Shell\Open\command] '' = '"%ProgramFiles%\UVK - Ultra Virus Killer\UVK_en.exe" -ImportSr "%1" %*'
- [<HKLM>\SOFTWARE\Classes\UVKCommandsScript\Shell\Open\command] '' = '"%ProgramFiles%\UVK - Ultra Virus Killer\UVK_en.exe" -readfile "%1" %*'
Вредоносные функции:
Запускает на исполнение:
- '%ProgramFiles%\UVK - Ultra Virus Killer\UVK_en.exe'
- 'C:\UVKSetup.exe' -Auto -NoRP -NoCMenu
- '<SYSTEM32>\cmd.exe' /c ""C:\start.bat" "
Изменения в файловой системе:
Создает следующие файлы:
- %ProgramFiles%\UVK - Ultra Virus Killer\Pictures\stopico2.png
- %ProgramFiles%\UVK - Ultra Virus Killer\Pictures\stopico.png
- %ProgramFiles%\UVK - Ultra Virus Killer\Pictures\sttypeico.png
- %ProgramFiles%\UVK - Ultra Virus Killer\Pictures\streamico.png
- %ProgramFiles%\UVK - Ultra Virus Killer\Pictures\shortcutico.png
- %ProgramFiles%\UVK - Ultra Virus Killer\Pictures\scanico.png
- %ProgramFiles%\UVK - Ultra Virus Killer\Pictures\startupsico.png
- %ProgramFiles%\UVK - Ultra Virus Killer\Pictures\startico.png
- %ProgramFiles%\UVK - Ultra Virus Killer\Pictures\uncheckico.png
- %ProgramFiles%\UVK - Ultra Virus Killer\Pictures\toolsico2.png
- %ProgramFiles%\UVK - Ultra Virus Killer\Pictures\unlockico.png
- %ProgramFiles%\UVK - Ultra Virus Killer\Pictures\uninstallico.png
- %ProgramFiles%\UVK - Ultra Virus Killer\Pictures\sysrestoreico.png
- %ProgramFiles%\UVK - Ultra Virus Killer\Pictures\sysboostico.png
- %ProgramFiles%\UVK - Ultra Virus Killer\Pictures\toolsico.png
- %ProgramFiles%\UVK - Ultra Virus Killer\Pictures\tasksico.png
- %ProgramFiles%\UVK - Ultra Virus Killer\Pictures\saveico.png
- %ProgramFiles%\UVK - Ultra Virus Killer\Pictures\refreshico.png
- %ProgramFiles%\UVK - Ultra Virus Killer\Pictures\QUM.png
- %ProgramFiles%\UVK - Ultra Virus Killer\Pictures\regkeyico.png
- %ProgramFiles%\UVK - Ultra Virus Killer\Pictures\regeditico.png
- %ProgramFiles%\UVK - Ultra Virus Killer\Pictures\pauseico.png
- %ProgramFiles%\UVK - Ultra Virus Killer\Pictures\moveupico.png
- %ProgramFiles%\UVK - Ultra Virus Killer\Pictures\propsico.png
- %ProgramFiles%\UVK - Ultra Virus Killer\Pictures\procico.png
- %ProgramFiles%\UVK - Ultra Virus Killer\Pictures\report.png
- %ProgramFiles%\UVK - Ultra Virus Killer\Pictures\replaceico.png
- %ProgramFiles%\UVK - Ultra Virus Killer\Pictures\runscriptico.png
- %ProgramFiles%\UVK - Ultra Virus Killer\Pictures\resumeico.png
- %ProgramFiles%\UVK - Ultra Virus Killer\Pictures\regvalico.png
- %ProgramFiles%\UVK - Ultra Virus Killer\Pictures\regseekico.png
- %ProgramFiles%\UVK - Ultra Virus Killer\Pictures\repairico.png
- %ProgramFiles%\UVK - Ultra Virus Killer\Pictures\remfavico.png
- %ProgramFiles%\UVK - Ultra Virus Killer\key.uvkey
- %ProgramFiles%\UVK - Ultra Virus Killer\Icons\TdssKiller.ico
- %ALLUSERSPROFILE%\Start Menu\Programs\UVK - Ultra Virus Killer\UVK - Ultra Virus Killer.lnk
- %ProgramFiles%\UVK - Ultra Virus Killer\UVKSettings.ini
- %ProgramFiles%\UVK - Ultra Virus Killer\Icons\sas.ico
- %ProgramFiles%\UVK - Ultra Virus Killer\Icons\roguekiller.ico
- %ProgramFiles%\UVK - Ultra Virus Killer\Icons\target.ico
- %ProgramFiles%\UVK - Ultra Virus Killer\Icons\setupico.ico
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\checkversion[1].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\cloudsync[1].php
- %ProgramFiles%\UVK - Ultra Virus Killer\urls
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\urls[1]
- %ALLUSERSPROFILE%\Start Menu\Programs\UVK - Ultra Virus Killer\Uninstall.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\UVK - Ultra Virus Killer\Log analyzer.lnk
- %ProgramFiles%\UVK - Ultra Virus Killer\Logs\Log_2016-09-09.ini
- %ALLUSERSPROFILE%\Desktop\UVK - Ultra Virus Killer.lnk
- %ProgramFiles%\UVK - Ultra Virus Killer\Icons\Prog.ico
- %ProgramFiles%\UVK - Ultra Virus Killer\Pictures\waterico.png
- %ProgramFiles%\UVK - Ultra Virus Killer\Pictures\Water splash.jpg
- %ProgramFiles%\UVK - Ultra Virus Killer\Pictures\worldico.png
- %ProgramFiles%\UVK - Ultra Virus Killer\Pictures\Wooden.jpg
- %ProgramFiles%\UVK - Ultra Virus Killer\Pictures\uvkscriptico.png
- %ProgramFiles%\UVK - Ultra Virus Killer\Pictures\userregico.png
- %ProgramFiles%\UVK - Ultra Virus Killer\Pictures\vtico.png
- %ProgramFiles%\UVK - Ultra Virus Killer\Pictures\viewico.png
- %ProgramFiles%\UVK - Ultra Virus Killer\Icons\avast_bc.ico
- %ProgramFiles%\UVK - Ultra Virus Killer\Icons\aswMBR.ico
- %ProgramFiles%\UVK - Ultra Virus Killer\Icons\mbam.ico
- %ProgramFiles%\UVK - Ultra Virus Killer\Icons\fix.ico
- %ProgramFiles%\UVK - Ultra Virus Killer\Pictures\UVK.png
- %ProgramFiles%\UVK - Ultra Virus Killer\Pictures\Abstract.jpg
- %ProgramFiles%\UVK - Ultra Virus Killer\Icons\adwCleaner.ico
- %ProgramFiles%\UVK - Ultra Virus Killer\Icons.zip
- %ProgramFiles%\UVK - Ultra Virus Killer\Pictures\movedownico.png
- %ProgramFiles%\UVK - Ultra Virus Killer\cleanup_tool\cleanup.exe
- %ProgramFiles%\UVK - Ultra Virus Killer\cleanup_tool.zip
- %ProgramFiles%\UVK - Ultra Virus Killer\cleanup_tool\history.txt
- %ProgramFiles%\UVK - Ultra Virus Killer\cleanup_tool\cleanup.ini
- %ProgramFiles%\UVK - Ultra Virus Killer\bluescreenview\BlueScreenView.chm
- %ProgramFiles%\UVK - Ultra Virus Killer\bluescreenview\BlueScreenView.cfg
- %ProgramFiles%\UVK - Ultra Virus Killer\bluescreenview\readme.txt
- %ProgramFiles%\UVK - Ultra Virus Killer\bluescreenview\BlueScreenView.exe
- %ProgramFiles%\UVK - Ultra Virus Killer\Pictures.zip
- %ProgramFiles%\UVK - Ultra Virus Killer\cleanup_tool\sigcheck.exe
- %ProgramFiles%\UVK - Ultra Virus Killer\Pictures\activexico.png
- %ProgramFiles%\UVK - Ultra Virus Killer\Pictures\2browseico.png
- %ProgramFiles%\UVK - Ultra Virus Killer\cleanup_tool\msicuu_readme.txt
- %ProgramFiles%\UVK - Ultra Virus Killer\cleanup_tool\msicuu.exe
- %ProgramFiles%\UVK - Ultra Virus Killer\cleanup_tool\readme.txt
- %ProgramFiles%\UVK - Ultra Virus Killer\cleanup_tool\MsiZap.exe
- %ProgramFiles%\UVK - Ultra Virus Killer\bluescreenview.zip
- %ProgramFiles%\UVK - Ultra Virus Killer\2Browse.exe
- %ProgramFiles%\UVK - Ultra Virus Killer\UVK.zip
- %ProgramFiles%\UVK - Ultra Virus Killer\RebootExec(x64).exe
- %ProgramFiles%\UVK - Ultra Virus Killer\Log analyzer.exe
- C:\start.bat
- C:\key.uvkey
- C:\UVKSetup.exe
- C:\UVKSettings.ini
- %ALLUSERSPROFILE%\Application Data\UVK\Ultra Adware Killer\UAKdb2.zip
- %ProgramFiles%\UVK - Ultra Virus Killer\UVK.dll
- %ALLUSERSPROFILE%\Application Data\UVK\Ultra Adware Killer\UAKdb.txt
- %ALLUSERSPROFILE%\Application Data\UVK\Ultra Adware Killer\UAKdb2.dat
- %ProgramFiles%\UVK - Ultra Virus Killer\UVK(x64).exe
- %ProgramFiles%\UVK - Ultra Virus Killer\RebootExec.exe
- %ProgramFiles%\UVK - Ultra Virus Killer\UVK(x86).dll
- %ProgramFiles%\UVK - Ultra Virus Killer\UVK.exe
- %ProgramFiles%\UVK - Ultra Virus Killer\Pictures\googleico.png
- %ProgramFiles%\UVK - Ultra Virus Killer\Pictures\fontico.png
- %ProgramFiles%\UVK - Ultra Virus Killer\Pictures\IEico.png
- %ProgramFiles%\UVK - Ultra Virus Killer\Pictures\helpico.png
- %ProgramFiles%\UVK - Ultra Virus Killer\Pictures\fileaddico.png
- %ProgramFiles%\UVK - Ultra Virus Killer\Pictures\execprevico.png
- %ProgramFiles%\UVK - Ultra Virus Killer\Pictures\folderaddico.png
- %ProgramFiles%\UVK - Ultra Virus Killer\Pictures\firefoxico.png
- %ProgramFiles%\UVK - Ultra Virus Killer\Pictures\loganalyzerico.png
- %ProgramFiles%\UVK - Ultra Virus Killer\Pictures\lockico.png
- %ProgramFiles%\UVK - Ultra Virus Killer\Pictures\mmenuico.png
- %ProgramFiles%\UVK - Ultra Virus Killer\Pictures\memico.png
- %ProgramFiles%\UVK - Ultra Virus Killer\Pictures\infoico.png
- %ProgramFiles%\UVK - Ultra Virus Killer\Pictures\immunizeico.png
- %ProgramFiles%\UVK - Ultra Virus Killer\Pictures\killprocico.png
- %ProgramFiles%\UVK - Ultra Virus Killer\Pictures\killallico.png
- %ProgramFiles%\UVK - Ultra Virus Killer\Pictures\edgeico.png
- %ProgramFiles%\UVK - Ultra Virus Killer\Pictures\checkdriveico.png
- %ProgramFiles%\UVK - Ultra Virus Killer\Pictures\backico.png
- %ProgramFiles%\UVK - Ultra Virus Killer\Pictures\chromeico.png
- %ProgramFiles%\UVK - Ultra Virus Killer\Pictures\checkico.png
- %ProgramFiles%\UVK - Ultra Virus Killer\Pictures\adkillerico.png
- %ProgramFiles%\UVK - Ultra Virus Killer\Pictures\addfavico.png
- %ProgramFiles%\UVK - Ultra Virus Killer\Pictures\appico.png
- %ProgramFiles%\UVK - Ultra Virus Killer\Pictures\analyzelogico.png
- %ProgramFiles%\UVK - Ultra Virus Killer\Pictures\delfileico.png
- %ProgramFiles%\UVK - Ultra Virus Killer\Pictures\deleteico.png
- %ProgramFiles%\UVK - Ultra Virus Killer\Pictures\driversico.png
- %ProgramFiles%\UVK - Ultra Virus Killer\Pictures\donateico.png
- %ProgramFiles%\UVK - Ultra Virus Killer\Pictures\Cool waves.jpg
- %ProgramFiles%\UVK - Ultra Virus Killer\Pictures\cloudsyncico.png
- %ProgramFiles%\UVK - Ultra Virus Killer\Pictures\defragico.png
- %ProgramFiles%\UVK - Ultra Virus Killer\Pictures\copyico.png
Присваивает атрибут 'скрытый' для следующих файлов:
- %ALLUSERSPROFILE%\Application Data\UVK\Ultra Adware Killer\UAKdb.txt
- %ALLUSERSPROFILE%\Application Data\UVK\Ultra Adware Killer\UAKdb2.dat
Удаляет следующие файлы:
- %ProgramFiles%\UVK - Ultra Virus Killer\Pictures.zip
- %ProgramFiles%\UVK - Ultra Virus Killer\cleanup_tool.zip
- %ProgramFiles%\UVK - Ultra Virus Killer\UVKSettings.ini
- %ProgramFiles%\UVK - Ultra Virus Killer\Icons.zip
- %ProgramFiles%\UVK - Ultra Virus Killer\bluescreenview.zip
- %ALLUSERSPROFILE%\Application Data\UVK\Ultra Adware Killer\UAKdb2.zip
- %ProgramFiles%\UVK - Ultra Virus Killer\UVK.zip
- %ProgramFiles%\UVK - Ultra Virus Killer\RebootExec(x64).exe
- %ProgramFiles%\UVK - Ultra Virus Killer\UVK(x64).exe
Перемещает следующие файлы:
- %ProgramFiles%\UVK - Ultra Virus Killer\UVK(x86).dll в %ProgramFiles%\UVK - Ultra Virus Killer\UVK.dll
- %ProgramFiles%\UVK - Ultra Virus Killer\UVK.exe в %ProgramFiles%\UVK - Ultra Virus Killer\UVK_en.exe
Сетевая активность:
Подключается к:
- 'www.ca###red.com':80
TCP:
Запросы HTTP GET:
- http://www.ca###red.com/uvk/urls
- http://www.ca###red.com/uvk/checkversion.php?e=################################################################################################
- http://www.ca###red.com/uvk/cloudsync.php?u=###################################################################################################################################
UDP:
- DNS ASK www.ca###red.com
Другое:
Ищет следующие окна:
- ClassName: 'UVK Ultra GUI' WindowName: ''
- ClassName: 'Log analyzerW' WindowName: ''
- ClassName: 'UVK Setup GUI' WindowName: ''
- ClassName: 'EDIT' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
