Trojan.KillProc.47056

Техническая информация

Для обеспечения автозапуска и распространения:

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\RDSessMgr] 'Start' = '00000002'
[<HKLM>\SYSTEM\ControlSet001\Services\RDSessMgr] 'ImagePath' = '%WINDIR%\Help\csrs.exe'

Вредоносные функции:

Создает и запускает на исполнение:

'%WINDIR%\Help\Rar.exe' (загружен из сети Интернет)

Запускает на исполнение:

'<SYSTEM32>\sc.exe' config rdsessmgr binpath= "%WINDIR%\Help\csrs.exe"
'<SYSTEM32>\net.exe' stop sharedacce0x73,0x73
'<SYSTEM32>\cmd.exe' /c net stop sharedacce0x73,0x73
'<SYSTEM32>\cmd.exe' /c sc config rdsessmgr binpath= "%WINDIR%\Help\csrs.exe"
'<SYSTEM32>\cmd.exe' /c sc config rdsessmgr start= auto
'<SYSTEM32>\cmd.exe' /c ""%WINDIR%\Help\2.bat" "
'%WINDIR%\Help\Rar.exe' X %WINDIR%\Help\vvt.part01.rar %WINDIR%\Help\ -p4399
'<SYSTEM32>\cmd.exe' /C @echo %WINDIR%\help\rar X %WINDIR%\Help\vvt.part01.rar %WINDIR%\Help\ -p4399>%WINDIR%\Help\2.bat
'<SYSTEM32>\sc.exe' config rdsessmgr start= auto
'<SYSTEM32>\net1.exe' stop sharedacce0x73,0x73
'<SYSTEM32>\cmd.exe' /c del %WINDIR%\Help\*.htm
'<SYSTEM32>\taskkill.exe' /f /t /im firefox.exe /im alg.exe /im Privoxy.exe
'<SYSTEM32>\cmd.exe' /c del %WINDIR%\Help\*.cnt
'<SYSTEM32>\cmd.exe' /c taskkill /f /t /im firefox.exe /im alg.exe /im Privoxy.exe
'<SYSTEM32>\cmd.exe' /c del %WINDIR%\Help\*.chm
'<SYSTEM32>\cmd.exe' /c del %WINDIR%\Help\config.ini
'<SYSTEM32>\cmd.exe' /c rd /s /q %windir%\help\browser
'<SYSTEM32>\cmd.exe' /c del %WINDIR%\Help\appface.dll
'<SYSTEM32>\cmd.exe' /c del %WINDIR%\Help\*.hlp
'<SYSTEM32>\cmd.exe' /c del %WINDIR%\Help\alg.exe

Завершает или пытается завершить

следующие системные процессы:

<SYSTEM32>\alg.exe

следующие пользовательские процессы:

firefox.exe

Изменения в файловой системе:

Создает следующие файлы:

%WINDIR%\Help\Rar.exe
%WINDIR%\Help\vvt.part03.rar
%WINDIR%\Help\2.bat
%WINDIR%\Help\csrs.exe
%WINDIR%\Help\vvt.part01.rar
%WINDIR%\Help\apps.chm.new
%WINDIR%\Help\vvt.part02.rar
<SYSTEM32>\dllcache\apps.chm.new

Удаляет следующие файлы:

%WINDIR%\Help\supp_ed.chm
%WINDIR%\Help\suptools.chm
%WINDIR%\Help\sysdm.chm
%WINDIR%\Help\spolsconcepts.chm
%WINDIR%\Help\drwtsn32.hlp
%WINDIR%\Help\sr_ui.chm
%WINDIR%\Help\dskquoui.hlp
%WINDIR%\Help\sysrestore.chm
%WINDIR%\Help\system.chm
%WINDIR%\Help\sysmon.chm
%WINDIR%\Help\dsclient.hlp
%WINDIR%\Help\sysprop.chm
%WINDIR%\Help\soundrec.chm
%WINDIR%\Help\sounds.chm
%WINDIR%\Help\diskmgmt.hlp
%WINDIR%\Help\snmpconcepts.chm
%WINDIR%\Help\sol.chm
%WINDIR%\Help\dijoy.hlp
%WINDIR%\Help\speech.chm
%WINDIR%\Help\spider.chm
%WINDIR%\Help\splash.chm
%WINDIR%\Help\spad.chm
%WINDIR%\Help\spconcepts.chm
%WINDIR%\Help\display.hlp
%WINDIR%\Help\wab.chm
%WINDIR%\Help\wbemtest.chm
%WINDIR%\Help\webpub.chm
%WINDIR%\Help\update1.chm
%WINDIR%\Help\usercpl.chm
%WINDIR%\Help\utilmgr.chm
%WINDIR%\Help\wininstl.chm
%WINDIR%\Help\winmine.chm
%WINDIR%\Help\win_dos.chm
%WINDIR%\Help\whatsnew.chm
%WINDIR%\Help\winchat.chm
%WINDIR%\Help\windows.chm
%WINDIR%\Help\els.hlp
%WINDIR%\Help\taskmgr.chm
%WINDIR%\Help\tcpip.chm
%WINDIR%\Help\sys_srv.chm
%WINDIR%\Help\tapi.chm
%WINDIR%\Help\taskbar.chm
%WINDIR%\Help\tshoot.chm
%WINDIR%\Help\evntwin.hlp
%WINDIR%\Help\twclient.chm
%WINDIR%\Help\telnet.chm
%WINDIR%\Help\timesrv.chm
%WINDIR%\Help\eudcedit.hlp
%WINDIR%\Help\regedit.chm
%WINDIR%\Help\regopt.chm
%WINDIR%\Help\conf.hlp
%WINDIR%\Help\reader.chm
%WINDIR%\Help\compstui.hlp
%WINDIR%\Help\recycle.chm
%WINDIR%\Help\connect.hlp
%WINDIR%\Help\rrc.chm
%WINDIR%\Help\cscui.hlp
%WINDIR%\Help\remasst.chm
%WINDIR%\Help\reskit.chm
%WINDIR%\Help\rktools.chm
%WINDIR%\Help\clipbrd.hlp
%WINDIR%\Help\plyr_err.chm
%WINDIR%\Help\printfnd.chm
%WINDIR%\Help\password.chm
%WINDIR%\Help\phowto.chm
%WINDIR%\Help\pinball.chm
%WINDIR%\Help\qosconcepts.chm
%WINDIR%\Help\ratings.chm
%WINDIR%\Help\rdesktop.chm
%WINDIR%\Help\printing.chm
%WINDIR%\Help\comexp.hlp
%WINDIR%\Help\pwrmn.chm
%WINDIR%\Help\secedit.chm
%WINDIR%\Help\dfs.hlp
%WINDIR%\Help\secsetconcepts.chm
%WINDIR%\Help\sceconcepts.chm
%WINDIR%\Help\scm.chm
%WINDIR%\Help\scmconcepts.chm
%WINDIR%\Help\shvl.chm
%WINDIR%\Help\smlogcfg.chm
%WINDIR%\Help\sndvol32.chm
%WINDIR%\Help\secsettings.chm
%WINDIR%\Help\dialer.hlp
%WINDIR%\Help\sendcmsg.chm
%WINDIR%\Help\rsmconcepts.chm
%WINDIR%\Help\rsop.chm
%WINDIR%\Help\rsopsnp.chm
%WINDIR%\Help\rsm.chm
%WINDIR%\Help\ddeshare.hlp
%WINDIR%\Help\defrag.hlp
%WINDIR%\Help\saferconcepts.chm
%WINDIR%\Help\sc.chm
%WINDIR%\Help\sce.chm
%WINDIR%\Help\rvse.chm
%WINDIR%\Help\safer.chm
%WINDIR%\Help\devmgr.hlp
%WINDIR%\Help\sapicpl.hlp
%WINDIR%\Help\scarddlg.hlp
%WINDIR%\Help\secauth.hlp
%WINDIR%\Help\reader.hlp
%WINDIR%\Help\regedit.hlp
%WINDIR%\Help\rsm.hlp
%WINDIR%\Help\signin.hlp
%WINDIR%\Help\sigverif.hlp
%WINDIR%\Help\sndvol32.hlp
%WINDIR%\Help\sendcmsg.hlp
%WINDIR%\Help\sfmmgr.hlp
%WINDIR%\Help\shell.hlp
%WINDIR%\Help\ntbackup.hlp
%WINDIR%\Help\ntshrui.hlp
%WINDIR%\Help\nwdoc.hlp
%WINDIR%\Help\newfeat4.hlp
%WINDIR%\Help\newfeat5.hlp
%WINDIR%\Help\notepad.hlp
%WINDIR%\Help\progman.hlp
%WINDIR%\Help\pwrmn.hlp
%WINDIR%\Help\ratings.hlp
%WINDIR%\Help\objsel.hlp
%WINDIR%\Help\osk.hlp
%WINDIR%\Help\pinball.hlp
%WINDIR%\Help\wab.hlp
%WINDIR%\Help\winchat.hlp
%WINDIR%\Help\windows.hlp
%WINDIR%\Help\users.hlp
%WINDIR%\Help\utilmgr.hlp
%WINDIR%\Help\verifier.hlp
%WINDIR%\Help\wscript.hlp
%WINDIR%\Help\wsecedit.hlp
%WINDIR%\Help\2.bat
%WINDIR%\Help\winhlp32.hlp
%WINDIR%\Help\winmine.hlp
%WINDIR%\Help\wordpad.hlp
%WINDIR%\Help\spider.hlp
%WINDIR%\Help\sysdm.hlp
%WINDIR%\Help\sysmon.hlp
%WINDIR%\Help\snmpsnap.hlp
%WINDIR%\Help\sol.hlp
%WINDIR%\Help\soundrec.hlp
%WINDIR%\Help\tcpmon.hlp
%WINDIR%\Help\telnet.hlp
%WINDIR%\Help\twclient.hlp
%WINDIR%\Help\sysrestore.hlp
%WINDIR%\Help\tapi.hlp
%WINDIR%\Help\taskmgr.hlp
%WINDIR%\Help\freecell.hlp
%WINDIR%\Help\fxsclnt.hlp
%WINDIR%\Help\gpedit.hlp
%WINDIR%\Help\filemgmt.hlp
%WINDIR%\Help\wuauhelp.chm
%WINDIR%\Help\fonts.hlp
%WINDIR%\Help\hypertrm.hlp
%WINDIR%\Help\ident.hlp
%WINDIR%\Help\iexplore.hlp
%WINDIR%\Help\gptext.hlp
%WINDIR%\Help\halftone.hlp
%WINDIR%\Help\hardware.hlp
%WINDIR%\Help\wmplay.chm
%WINDIR%\Help\wmplayer.chm
%WINDIR%\Help\wordpad.chm
%WINDIR%\Help\fde.hlp
%WINDIR%\Help\wmic.chm
%WINDIR%\Help\wmifltr.chm
%WINDIR%\Help\wscript.chm
%WINDIR%\Help\wshconcepts.chm
%WINDIR%\Help\wuau.chm
%WINDIR%\Help\filefold.hlp
%WINDIR%\Help\wpa.chm
%WINDIR%\Help\wschelp.chm
%WINDIR%\Help\msnauth.hlp
%WINDIR%\Help\msoe.hlp
%WINDIR%\Help\msoeacct.hlp
%WINDIR%\Help\mpnetwrk.hlp
%WINDIR%\Help\mqsnap.hlp
%WINDIR%\Help\mshearts.hlp
%WINDIR%\Help\newfeat1.hlp
%WINDIR%\Help\newfeat2.hlp
%WINDIR%\Help\newfeat3.hlp
%WINDIR%\Help\mspaint.hlp
%WINDIR%\Help\mstask.hlp
%WINDIR%\Help\netcfg.hlp
%WINDIR%\Help\ixhelp.hlp
%WINDIR%\Help\localsec.hlp
%WINDIR%\Help\magnify.hlp
%WINDIR%\Help\infrared.hlp
%WINDIR%\Help\input.hlp
%WINDIR%\Help\ipsecsnp.hlp
%WINDIR%\Help\modem.hlp
%WINDIR%\Help\mouse.hlp
%WINDIR%\Help\mplayer2.hlp
%WINDIR%\Help\mfcuix.hlp
%WINDIR%\Help\mmc_dlg.hlp
%WINDIR%\Help\mobsync.hlp
%WINDIR%\Help\chooser.hlp
%WINDIR%\Help\drwtsn32.chm
%WINDIR%\Help\dskquoui.chm
%WINDIR%\Help\ade.hlp
%WINDIR%\Help\display.chm
%WINDIR%\Help\dkconcepts.chm
%WINDIR%\Help\drvvfp.chm
%WINDIR%\Help\encrypt.chm
%WINDIR%\Help\agt0405.hlp
%WINDIR%\Help\eudcedit.chm
%WINDIR%\Help\dxdiag.chm
%WINDIR%\Help\adprop.hlp
%WINDIR%\Help\els.chm
%WINDIR%\Help\ddeshare.chm
%WINDIR%\Help\defrag.chm
%WINDIR%\Help\devmgr.chm
%WINDIR%\Help\migwiz.htm
%WINDIR%\Help\migwiz2.htm
%WINDIR%\Help\datetime.chm
%WINDIR%\Help\digiras.chm
%WINDIR%\Help\aclui.hlp
%WINDIR%\Help\diskmgmt.chm
%WINDIR%\Help\diagboot.chm
%WINDIR%\Help\dialer.chm
%WINDIR%\Help\access.hlp
%WINDIR%\Help\gpedit.chm
%WINDIR%\Help\hardware.chm
%WINDIR%\Help\agt0409.hlp
%WINDIR%\Help\fxsshare.chm
%WINDIR%\Help\gen.chm
%WINDIR%\Help\Glossary.chm
%WINDIR%\Help\hschelp.chm
%WINDIR%\Help\hypertrm.chm
%WINDIR%\Help\icwdial.chm
%WINDIR%\Help\howto.chm
%WINDIR%\Help\hrtz.chm
%WINDIR%\Help\hs.chm
%WINDIR%\Help\file_srv.chm
%WINDIR%\Help\agt0407.hlp
%WINDIR%\Help\find.chm
%WINDIR%\Help\evconcepts.chm
%WINDIR%\Help\agt0406.hlp
%WINDIR%\Help\filefold.chm
%WINDIR%\Help\agt0408.hlp
%WINDIR%\Help\fxsclnt.chm
%WINDIR%\Help\fxscover.chm
%WINDIR%\Help\folderop.chm
%WINDIR%\Help\fonts.chm
%WINDIR%\Help\freecell.chm
%WINDIR%\Help\addremov.chm
%WINDIR%\Help\admtools.chm
%WINDIR%\Help\apps.chm
%WINDIR%\Help\accessib.chm
%WINDIR%\Help\acc_dis.chm
%WINDIR%\Help\aclui.chm
%WINDIR%\Help\audit.chm
%WINDIR%\Help\bckg.chm
%WINDIR%\Help\blurbs.chm
%WINDIR%\Help\apps_sp.chm
%WINDIR%\Help\article.chm
%WINDIR%\Help\atm.chm
%WINDIR%\Help\mshearts.cnt
%WINDIR%\Help\msnauth.cnt
%WINDIR%\Help\nocontnt.cnt
%WINDIR%\Help\conf.cnt
%WINDIR%\Help\connect.cnt
%WINDIR%\Help\mplayer2.cnt
%WINDIR%\Help\windows.cnt
%WINDIR%\Help\winhlp32.cnt
%WINDIR%\Help\access.chm
%WINDIR%\Help\progman.cnt
%WINDIR%\Help\ratings.cnt
%WINDIR%\Help\update.cnt
%WINDIR%\Help\compmgmt.chm
%WINDIR%\Help\conf.chm
%WINDIR%\Help\conf1.chm
%WINDIR%\Help\comexp.chm
%WINDIR%\Help\common.chm
%WINDIR%\Help\compfldr.chm
%WINDIR%\Help\cyzcoins.chm
%WINDIR%\Help\ciquery.htm
%WINDIR%\Help\ixqlang.htm
%WINDIR%\Help\cpanel.chm
%WINDIR%\Help\ciadmin.htm
%WINDIR%\Help\cyycoins.chm
%WINDIR%\Help\calc.chm
%WINDIR%\Help\camera.chm
%WINDIR%\Help\cdmedia.chm
%WINDIR%\Help\blutooth.chm
%WINDIR%\Help\bootcons.chm
%WINDIR%\Help\brief.chm
%WINDIR%\Help\clipbrd.chm
%WINDIR%\Help\cmconcepts.chm
%WINDIR%\Help\colormgt.chm
%WINDIR%\Help\certmgr.chm
%WINDIR%\Help\charmap.chm
%WINDIR%\Help\chkr.chm
%WINDIR%\Help\newfeat1.chm
%WINDIR%\Help\agt0c0a.hlp
%WINDIR%\Help\newfeat2.chm
%WINDIR%\Help\netcfg.chm
%WINDIR%\Help\network.chm
%WINDIR%\Help\agt0816.hlp
%WINDIR%\Help\newfeat5.chm
%WINDIR%\Help\nmchat.chm
%WINDIR%\Help\calc.hlp
%WINDIR%\Help\newfeat3.chm
%WINDIR%\Help\audiocdc.hlp
%WINDIR%\Help\newfeat4.chm
%WINDIR%\Help\msmq.chm
%WINDIR%\Help\msmqconcepts.chm
%WINDIR%\Help\msoe.chm
%WINDIR%\Help\agt0419.hlp
%WINDIR%\Help\mshearts.chm
%WINDIR%\Help\msinfo32.chm
%WINDIR%\Help\agt041f.hlp
%WINDIR%\Help\mstask.chm
%WINDIR%\Help\mstsc.chm
%WINDIR%\Help\agt041d.hlp
%WINDIR%\Help\msorcl32.chm
%WINDIR%\Help\mspaint.chm
%WINDIR%\Help\nusrmgr.chm
%WINDIR%\Help\nwdoc.chm
%WINDIR%\Help\odbcinst.chm
%WINDIR%\Help\chnscsvr.hlp
%WINDIR%\Help\nthelp.chm
%WINDIR%\Help\ntshared.chm
%WINDIR%\Help\omc.chm
%WINDIR%\Help\osk.chm
%WINDIR%\Help\packager.chm
%WINDIR%\Help\odbcjet.chm
%WINDIR%\Help\oe_msgr.chm
%WINDIR%\Help\offlinefolders.chm
%WINDIR%\Help\notepad.chm
%WINDIR%\Help\ntart.chm
%WINDIR%\Help\cdmedia.hlp
%WINDIR%\Help\camera.hlp
%WINDIR%\Help\nmwhiteb.chm
%WINDIR%\Help\nofts.chm
%WINDIR%\Help\ntcmds.chm
%WINDIR%\Help\charmap.hlp
%WINDIR%\Help\ntdef.chm
%WINDIR%\Help\ntbackup.chm
%WINDIR%\Help\certmgr.hlp
%WINDIR%\Help\ntchowto.chm
%WINDIR%\Help\intellimirror.chm
%WINDIR%\Help\agt040e.hlp
%WINDIR%\Help\agt0410.hlp
%WINDIR%\Help\agt040c.hlp
%WINDIR%\Help\infrared.chm
%WINDIR%\Help\input.chm
%WINDIR%\Help\is.chm
%WINDIR%\Help\isconcepts.chm
%WINDIR%\Help\joy.chm
%WINDIR%\Help\ipsecconcepts.chm
%WINDIR%\Help\ipsecsnp.chm
%WINDIR%\Help\Ipv6.chm
%WINDIR%\Help\ieshared.chm
%WINDIR%\Help\iesupp.chm
%WINDIR%\Help\iewebhlp.chm
%WINDIR%\Help\ieakmmc.chm
%WINDIR%\Help\ieeula.chm
%WINDIR%\Help\ieos.chm
%WINDIR%\Help\agt040b.hlp
%WINDIR%\Help\imgprev.chm
%WINDIR%\Help\inetres.chm
%WINDIR%\Help\iexplore.chm
%WINDIR%\Help\iis.chm
%WINDIR%\Help\iismmc.chm
%WINDIR%\Help\agt0415.hlp
%WINDIR%\Help\mmc.chm
%WINDIR%\Help\agt0416.hlp
%WINDIR%\Help\mail.chm
%WINDIR%\Help\misc.chm
%WINDIR%\Help\mls_trb.chm
%WINDIR%\Help\mpconcepts.chm
%WINDIR%\Help\msconfig.chm
%WINDIR%\Help\msdasc.chm
%WINDIR%\Help\mobsync.chm
%WINDIR%\Help\mode.chm
%WINDIR%\Help\mouse.chm
%WINDIR%\Help\keyshort.chm
%WINDIR%\Help\agt0414.hlp
%WINDIR%\Help\lang.chm
%WINDIR%\Help\agt0413.hlp
%WINDIR%\Help\key.chm
%WINDIR%\Help\keyb.chm
%WINDIR%\Help\lpe.chm
%WINDIR%\Help\lpeconcepts.chm
%WINDIR%\Help\magnify.chm
%WINDIR%\Help\langbar.chm
%WINDIR%\Help\license.chm
%WINDIR%\Help\localsec.chm

Сетевая активность:

Подключается к:

'www.lc##t.net':80
'localhost':1035

TCP:

Запросы HTTP GET:

http://www.lc##t.net/ewebedit/UploadFile/Rar.exe
http://www.lc##t.net/ewebedit/UploadFile/csrs.exe
http://www.lc##t.net/ewebedit/UploadFile/vvt.part03.rar
http://www.lc##t.net/ewebedit/UploadFile/vvt.part01.rar
http://www.lc##t.net/ewebedit/UploadFile/vvt.part02.rar

UDP:

DNS ASK www.lc##t.net

Другое:

Ищет следующие окна:

ClassName: '' WindowName: ''

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней