Trojan.DownLoader22.63850

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'updaten' = '%ProgramFiles%\Norton Update\Norton Update\Norton System Scan.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'updaten' = '%ProgramFiles%\Norton Update\Norton Update\Norton System Scan.exe'

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\java.job
%WINDIR%\Tasks\updaten.job

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\msiexec.exe' -Embedding 05242E892753BA0085A7C4241B350B30
'<SYSTEM32>\msiexec.exe' -Embedding 296D9663B6DBC090F6A55127A3C18CDF M Global\MSI0000
'<SYSTEM32>\msiexec.exe' /V
'<SYSTEM32>\msiexec.exe' /i "%APPDATA%\Norton Update\Norton Update 1.0.0.4\install\2F55721\Norton Update.msi" AI_SETUPEXEPATH=<Полный путь к файлу> SETUPEXEDIR=<Текущая директория>\ EXE_CMD_LINE="/exenoupdates /exelan...

Изменения в файловой системе:

Создает следующие файлы:

C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.DATA
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING2.MAP
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING1.MAP
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.MAP
%WINDIR%\Installer\MSI8.tmp
%WINDIR%\Installer\MSI7.tmp
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.BTR
%WINDIR%\Installer\1e462.ipi
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\$WinMgmt.CFG
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING.VER
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.MAP
%TEMP%\~DFE88C.tmp
%WINDIR%\Installer\MSI9.tmp
%TEMP%\~DF439C.tmp
%ProgramFiles%\java\java.exe
%ProgramFiles%\Norton Update\Norton Update\Norton System Scan.exe
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\collect.installeranalytics[1].htm
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\collect.installeranalytics[1].htm
%WINDIR%\Installer\MSIF.tmp
%WINDIR%\Installer\MSIC.tmp
%WINDIR%\Installer\MSIB.tmp
C:\Config.Msi\1e463.rbs
%APPDATA%\Norton Update\Norton Update 1.0.0.4\install\2F55721\Norton System Scan.exe
%APPDATA%\Norton Update\Norton Update 1.0.0.4\install\2F55721\ProgramFilesFolder\java\java.exe
%WINDIR%\Installer\MSID.tmp
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\domain.txt
%WINDIR%\Installer\MSI3.tmp
%WINDIR%\Installer\MSI2.tmp
%TEMP%\AdvinstAnalytics\Norton Update\1.0.0.4\{A169446F-B673-47E7-8709-F03248DA01B0}.session
%WINDIR%\Installer\MSI6.tmp
%WINDIR%\Installer\MSI5.tmp
%WINDIR%\Installer\MSI4.tmp
%TEMP%\1e029.msi
%APPDATA%\Norton Update\Norton Update 1.0.0.4\install\2F55721\Norton Update.msi
%APPDATA%\Norton Update\Norton Update 1.0.0.4\install\decoder.dll
%TEMP%\AdvinstAnalytics\Norton Update\1.0.0.4\tracking.ini
%WINDIR%\Installer\MSI1.tmp
%WINDIR%\Installer\1e460.msi
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SOFTWARE
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SECURITY
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_.DEFAULT
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\ComDb.Dat
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SAM
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SYSTEM
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-2052111302-484763869-725345543-1003
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20

Удаляет следующие файлы:

%WINDIR%\Installer\MSIF.tmp
%WINDIR%\Installer\1e460.msi
%TEMP%\AdvinstAnalytics\Norton Update\1.0.0.4\{A169446F-B673-47E7-8709-F03248DA01B0}.session
%WINDIR%\Installer\MSI7.tmp
C:\Config.Msi\1e463.rbs
%WINDIR%\Installer\1e462.ipi
%APPDATA%\Norton Update\Norton Update 1.0.0.4\install\2F55721\Norton System Scan.exe
%APPDATA%\Norton Update\Norton Update 1.0.0.4\install\2F55721\ProgramFilesFolder\java\java.exe
%APPDATA%\Norton Update\Norton Update 1.0.0.4\install\2F55721\Norton Update.msi
%TEMP%\1e029.msi
%APPDATA%\Norton Update\Norton Update 1.0.0.4\install\decoder.dll
%WINDIR%\Installer\MSI4.tmp
%WINDIR%\Installer\MSI5.tmp
%WINDIR%\Installer\MSI3.tmp
%WINDIR%\Installer\MSI1.tmp
%WINDIR%\Installer\MSI2.tmp
%WINDIR%\Installer\MSI6.tmp
%WINDIR%\Installer\MSIC.tmp
%WINDIR%\Installer\MSID.tmp
%WINDIR%\Installer\MSIB.tmp
%WINDIR%\Installer\MSI8.tmp
%WINDIR%\Installer\MSI9.tmp