Техническая информация
Для обеспечения автозапуска и распространения:
Подменяет следующие исполняемые системные файлы:
- %WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll
- %WINDIR%\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll
- %WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Configuration\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.configuration.dll
- %WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Xml\v4.0_4.0.0.0__b77a5c561934e089\System.XML.dll
- %WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
- %WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll
- %WINDIR%\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll
- %WINDIR%\Microsoft.NET\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.dll
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreeis.dll
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
Вредоносные функции:
Запускает на исполнение:
- '%WINDIR%\EasyBCD.exe'
Изменения в файловой системе:
Создает следующие файлы:
- %WINDIR%\bin\bcdboot.exe
- %WINDIR%\profiles\nst_mac.mbr
- %WINDIR%\bin\BootGrabber.exe
- %WINDIR%\bin\bcdedit.exe
- %WINDIR%\profiles\grldr.mbr
- %WINDIR%\profiles\ntdetect.com
- %WINDIR%\profiles\menu.txt
- %WINDIR%\EasyBCD.exe.config
- %WINDIR%\profiles\NeoSmart.bcd
- %WINDIR%\bin\bootsect.exe
- %WINDIR%\bin\udefrag-kernel.dll
- %WINDIR%\NeoSmart.Localization.dll
- %WINDIR%\bin\zenwinx.dll
- %WINDIR%\bin\udefrag.dll
- %WINDIR%\bin\UtfRedirect.exe
- %WINDIR%\bin\NetTest.exe
- %WINDIR%\EasyBCD.exe
- %WINDIR%\bin\udefrag.exe
- %WINDIR%\bin\NST Downloader.exe
- %WINDIR%\lang\en-US\SdiMaker.xml
- %WINDIR%\profiles\plop.iso
- %WINDIR%\profiles\nst_mac.iso
- %WINDIR%\lang\en-US\BcdLibrary.xml
- %WINDIR%\lang\en-US\AboutBox.xml
- %WINDIR%\profiles\pmbr
- %WINDIR%\profiles\easyldr
- %WINDIR%\profiles\boot0
- %WINDIR%\LICENSE
- %WINDIR%\profiles\grldr
- %WINDIR%\lang\en-US\DefragDialog.xml
- %WINDIR%\lang\en-US\OptionsDialog.xml
- %WINDIR%\lang\en-US\MainUI.xml
- %WINDIR%\lang\en-US\properties.xml
- %WINDIR%\lang\en-US\ProgressDialog.xml
- %WINDIR%\lang\en-US\LicenseDialog.xml
- %WINDIR%\lang\en-US\DriveSelect.xml
- %WINDIR%\lang\en-US\DonationDialog.xml
- %WINDIR%\lang\en-US\LanguageDialog.xml
- %WINDIR%\lang\en-US\EasyBCD.xml
Удаляет следующие файлы:
- %WINDIR%\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll
- %WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Configuration\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.configuration.dll
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll
- %WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll
- %WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Xml\v4.0_4.0.0.0__b77a5c561934e089\System.XML.dll
- %WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
- %WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll
- %WINDIR%\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\Config\machine.config
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll
- %WINDIR%\Microsoft.NET\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.dll
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreeis.dll
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
