Техническая информация
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\format.com' C: /FS:NTFS /X /Q /y
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\1.tmp\2.bat" <Полный путь к файлу>"
Завершает или пытается завершить
следующие системные процессы:
- <SYSTEM32>\cmd.exe
Изменения в файловой системе:
Создает следующие файлы:
- <SYSTEM32>\dllcache\dosapp.fon.new
- <SYSTEM32>\dllcache\vgaoem.fon.new
- %WINDIR%\Fonts\vgaoem.fon.new
- %TEMP%\1.tmp\2.bat
- %WINDIR%\Fonts\dosapp.fon.new
Удаляет следующие файлы:
- %WINDIR%\Fonts\vga857.fon
- %WINDIR%\Fonts\vga855.fon
- %WINDIR%\Fonts\vga860.fon
- %WINDIR%\Fonts\vga865.fon
- %WINDIR%\Fonts\vga863.fon
- %WINDIR%\Fonts\vga852.fon
- %WINDIR%\Fonts\symbole.fon
- %WINDIR%\Fonts\sserifft.fon
- %WINDIR%\Fonts\vga737.fon
- %WINDIR%\Fonts\vga850.fon
- %WINDIR%\Fonts\vga775.fon
- %WINDIR%\Fonts\vgafixt.fon
- %WINDIR%\Fonts\vgafixr.fon
- %WINDIR%\Fonts\vgaoem.fon
- %WINDIR%\Fonts\vgasys.fon
- %WINDIR%\Fonts\vgas1257.fon
- %WINDIR%\Fonts\vgafixg.fon
- %WINDIR%\Fonts\vga869.fon
- %WINDIR%\Fonts\vga866.fon
- %WINDIR%\Fonts\vgaf1257.fon
- %WINDIR%\Fonts\vgafixe.fon
- %WINDIR%\Fonts\vgafix.fon
- %WINDIR%\Fonts\sseriffr.fon
- %WINDIR%\Fonts\smallf.fon
- %WINDIR%\Fonts\smallet.fon
- %WINDIR%\Fonts\smallfe.fon
- %WINDIR%\Fonts\smallfr.fon
- %WINDIR%\Fonts\smallfg.fon
- %WINDIR%\Fonts\smaller.fon
- %WINDIR%\Fonts\smaf1257.fon
- %WINDIR%\Fonts\smae1257.fon
- %WINDIR%\Fonts\smalle.fon
- %WINDIR%\Fonts\smalleg.fon
- %WINDIR%\Fonts\smallee.fon
- %WINDIR%\Fonts\sserifet.fon
- %WINDIR%\Fonts\sserifer.fon
- %WINDIR%\Fonts\sseriff.fon
- %WINDIR%\Fonts\sseriffg.fon
- %WINDIR%\Fonts\sseriffe.fon
- %WINDIR%\Fonts\sserifeg.fon
- %WINDIR%\Fonts\ssee1257.fon
- %WINDIR%\Fonts\smallft.fon
- %WINDIR%\Fonts\ssef1257.fon
- %WINDIR%\Fonts\sserifee.fon
- %WINDIR%\Fonts\sserife.fon
- %WINDIR%\Fonts\vgasyse.fon
- <SYSTEM32>\config\systemprofile\Start Menu\desktop.ini
- <SYSTEM32>\config\systemprofile\SendTo\desktop.ini
- <SYSTEM32>\config\systemprofile\Start Menu\Programs\desktop.ini
- <SYSTEM32>\config\systemprofile\Start Menu\Programs\Accessories\Accessibility\desktop.ini
- <SYSTEM32>\config\systemprofile\Start Menu\Programs\Accessories\desktop.ini
- <SYSTEM32>\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\W32JX7IL\desktop.ini
- <SYSTEM32>\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini
- <SYSTEM32>\config\systemprofile\Local Settings\Temporary Internet Files\desktop.ini
- <SYSTEM32>\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\6YQRA29M\desktop.ini
- <SYSTEM32>\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\RK37EMDC\desktop.ini
- <SYSTEM32>\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\E4T10P5J\desktop.ini
- <SYSTEM32>\Restore\filelist.xml
- <SYSTEM32>\Microsoft\Protect\S-1-5-18\User\Preferred
- %WINDIR%\Tasks\desktop.ini
- %TEMP%\1.tmp\2.bat
- %WINDIR%\Tasks\SA.DAT
- <SYSTEM32>\Microsoft\Protect\S-1-5-18\User\e6f631a0-c9d9-44ef-ade9-a07d33e86ced
- <SYSTEM32>\config\systemprofile\Start Menu\Programs\Startup\desktop.ini
- <SYSTEM32>\config\systemprofile\Start Menu\Programs\Accessories\Entertainment\desktop.ini
- <SYSTEM32>\Microsoft\Protect\S-1-5-18\User\4d18a5db-2998-4a57-8195-38a89ba2430f
- <SYSTEM32>\Microsoft\Protect\S-1-5-18\User\744687f4-6740-4539-a722-7f551929bd6c
- <SYSTEM32>\Microsoft\Protect\S-1-5-18\User\60a7b247-3833-43cc-8730-74e1d729cdaf
- <SYSTEM32>\config\systemprofile\Local Settings\History\History.IE5\desktop.ini
- %WINDIR%\pchealth\helpctr\PackageStore\package_3.cab
- %WINDIR%\pchealth\helpctr\PackageStore\package_2.cab
- %WINDIR%\pchealth\helpctr\PackageStore\package_4.cab
- <SYSTEM32>\cdplayer.exe.manifest
- %WINDIR%\repair\ntuser.dat
- %WINDIR%\pchealth\helpctr\PackageStore\package_1.cab
- %WINDIR%\Fonts\vgasysr.fon
- %WINDIR%\Fonts\vgasysg.fon
- %WINDIR%\Fonts\vgasyst.fon
- %WINDIR%\pchealth\helpctr\PackageStore\instance_Professional_32_1033.cab
- %WINDIR%\Offline Web Pages\desktop.ini
- <SYSTEM32>\config\userdiff.LOG
- <SYSTEM32>\config\TempKey.LOG
- <SYSTEM32>\config\systemprofile\Application Data\desktop.ini
- <SYSTEM32>\config\systemprofile\Local Settings\History\desktop.ini
- <SYSTEM32>\config\systemprofile\Local Settings\desktop.ini
- <SYSTEM32>\wuaucpl.cpl.manifest
- <SYSTEM32>\ncpa.cpl.manifest
- <SYSTEM32>\logonui.exe.manifest
- <SYSTEM32>\nwc.cpl.manifest
- <SYSTEM32>\WindowsLogon.manifest
- <SYSTEM32>\sapi.cpl.manifest
- %WINDIR%\Fonts\serifft.fon
- %WINDIR%\Fonts\app775.fon
- %WINDIR%\Fonts\85s1257.fon
- %WINDIR%\Fonts\app850.fon
- %WINDIR%\Fonts\app855.fon
- %WINDIR%\Fonts\app852.fon
- %WINDIR%\Fonts\85f1257.fon
- %WINDIR%\Fonts\8514sysr.fon
- %WINDIR%\Fonts\8514sysg.fon
- %WINDIR%\Fonts\8514syst.fon
- %WINDIR%\Fonts\85855.fon
- %WINDIR%\Fonts\85775.fon
- %WINDIR%\Fonts\cga40869.fon
- %WINDIR%\Fonts\cga40866.fon
- %WINDIR%\Fonts\cga40woa.fon
- %WINDIR%\Fonts\cga80850.fon
- %WINDIR%\Fonts\cga80737.fon
- %WINDIR%\Fonts\cga40857.fon
- %WINDIR%\Fonts\app866.fon
- %WINDIR%\Fonts\app857.fon
- %WINDIR%\Fonts\cga40737.fon
- %WINDIR%\Fonts\cga40852.fon
- %WINDIR%\Fonts\cga40850.fon
- %WINDIR%\Fonts\8514syse.fon
- %WINDIR%\assembly\NativeImages_v2.0.50727_32\indexa6.dat
- %WINDIR%\assembly\NativeImages_v2.0.50727_32\indexa5.dat
- %WINDIR%\assembly\NativeImages_v4.0.30319_32\index1b.dat
- %WINDIR%\Downloaded Program Files\desktop.ini
- %WINDIR%\assembly\NativeImages_v4.0.30319_32\index1c.dat
- %WINDIR%\assembly\pubpol1.dat
- %WINDIR%\winnt.bmp
- %WINDIR%\WindowsShell.Manifest
- %WINDIR%\winnt256.bmp
- %WINDIR%\assembly\PublisherPolicy.tme
- %WINDIR%\assembly\Desktop.ini
- %WINDIR%\Fonts\8514oemg.fon
- %WINDIR%\Fonts\8514oeme.fon
- %WINDIR%\Fonts\8514oemr.fon
- %WINDIR%\Fonts\8514sys.fon
- %WINDIR%\Fonts\8514oemt.fon
- %WINDIR%\Fonts\8514oem.fon
- %WINDIR%\Fonts\8514fixe.fon
- %WINDIR%\Fonts\8514fix.fon
- %WINDIR%\Fonts\8514fixg.fon
- %WINDIR%\Fonts\8514fixt.fon
- %WINDIR%\Fonts\8514fixr.fon
- %WINDIR%\Fonts\cga80852.fon
- %WINDIR%\Fonts\ega80866.fon
- %WINDIR%\Fonts\ega80857.fon
- %WINDIR%\Fonts\ega80869.fon
- %WINDIR%\Fonts\marlett.ttf
- %WINDIR%\Fonts\ega80woa.fon
- %WINDIR%\Fonts\ega80852.fon
- %WINDIR%\Fonts\ega40869.fon
- %WINDIR%\Fonts\ega40866.fon
- %WINDIR%\Fonts\ega40woa.fon
- %WINDIR%\Fonts\ega80850.fon
- %WINDIR%\Fonts\ega80737.fon
- %WINDIR%\Fonts\seriff.fon
- %WINDIR%\Fonts\serifet.fon
- %WINDIR%\Fonts\seriffe.fon
- %WINDIR%\Fonts\seriffr.fon
- %WINDIR%\Fonts\seriffg.fon
- %WINDIR%\Fonts\serifer.fon
- %WINDIR%\Fonts\serf1257.fon
- %WINDIR%\Fonts\sere1257.fon
- %WINDIR%\Fonts\serife.fon
- %WINDIR%\Fonts\serifeg.fon
- %WINDIR%\Fonts\serifee.fon
- %WINDIR%\Fonts\ega40857.fon
- %WINDIR%\Fonts\couree.fon
- %WINDIR%\Fonts\coure.fon
- %WINDIR%\Fonts\coureg.fon
- %WINDIR%\Fonts\couret.fon
- %WINDIR%\Fonts\courer.fon
- %WINDIR%\Fonts\couf1257.fon
- %WINDIR%\Fonts\cga80866.fon
- %WINDIR%\Fonts\cga80857.fon
- %WINDIR%\Fonts\cga80869.fon
- %WINDIR%\Fonts\coue1257.fon
- %WINDIR%\Fonts\cga80woa.fon
- %WINDIR%\Fonts\dosapp.fon
- %WINDIR%\Fonts\dos737.fon
- %WINDIR%\Fonts\ega40737.fon
- %WINDIR%\Fonts\ega40852.fon
- %WINDIR%\Fonts\ega40850.fon
- %WINDIR%\Fonts\desktop.ini
- %WINDIR%\Fonts\courfe.fon
- %WINDIR%\Fonts\courf.fon
- %WINDIR%\Fonts\courfg.fon
- %WINDIR%\Fonts\courft.fon
- %WINDIR%\Fonts\courfr.fon
