Trojan.AVKill.24760

Техническая информация

Вредоносные функции:

Создает и запускает на исполнение:

%TEMP%\1.tmp <Текущая директория>

Запускает на исполнение:

<SYSTEM32>\tskill.exe "NMAIN"
<SYSTEM32>\tskill.exe "NORMIST"
<SYSTEM32>\tskill.exe "NUPGRADE"
<SYSTEM32>\tskill.exe "NISUM"
<SYSTEM32>\tskill.exe "NAVNT"
<SYSTEM32>\tskill.exe "NAVW32"
<SYSTEM32>\tskill.exe "NAVWNT"
<SYSTEM32>\tskill.exe "PAVSCHED"
<SYSTEM32>\tskill.exe "PAVW"
<SYSTEM32>\tskill.exe "PCCWIN98"
<SYSTEM32>\tskill.exe "PAVCL"
<SYSTEM32>\tskill.exe "NVC95"
<SYSTEM32>\tskill.exe "OUTPOST"
<SYSTEM32>\tskill.exe "PADMIN"
<SYSTEM32>\tskill.exe "IOMON98"
<SYSTEM32>\tskill.exe "JEDI"
<SYSTEM32>\tskill.exe "LOCKDOWN2000"
<SYSTEM32>\tskill.exe "IFACE"
<SYSTEM32>\tskill.exe "ICMON"
<SYSTEM32>\tskill.exe "ICSUPP95"
<SYSTEM32>\tskill.exe "ICSUPPNT"
<SYSTEM32>\tskill.exe "N32SCANW"
<SYSTEM32>\tskill.exe "NAVAPW32"
<SYSTEM32>\tskill.exe "NAVLU32"
<SYSTEM32>\tskill.exe "MPFTRAY"
<SYSTEM32>\tskill.exe "LOOKOUT"
<SYSTEM32>\tskill.exe "LUALL"
<SYSTEM32>\tskill.exe "MOOLIVE"
<SYSTEM32>\tskill.exe "TDS2-NT"
<SYSTEM32>\tskill.exe "VET95"
<SYSTEM32>\tskill.exe "VETTRAY"
<SYSTEM32>\tskill.exe "TDS2-98"
<SYSTEM32>\tskill.exe "SWEEP95"
<SYSTEM32>\tskill.exe "TBSCAN"
<SYSTEM32>\tskill.exe "TCA"
<SYSTEM32>\tskill.exe "WEBSCANX"
<SYSTEM32>\tskill.exe "WFINDV32"
<SYSTEM32>\tskill.exe "ZONEALARM"
<SYSTEM32>\tskill.exe "VSSTAT"
<SYSTEM32>\tskill.exe "VSCAN40"
<SYSTEM32>\tskill.exe "VSECOMR"
<SYSTEM32>\tskill.exe "VSHWIN32"
<SYSTEM32>\tskill.exe "REGEDIT.EXE
<SYSTEM32>\tskill.exe "RESCUE"
<SYSTEM32>\tskill.exe "SAFEWEB"
<SYSTEM32>\tskill.exe "RAV7WIN"
<SYSTEM32>\tskill.exe "PCFWALLICON"
<SYSTEM32>\tskill.exe "PERSFW"
<SYSTEM32>\tskill.exe "RAV7"
<SYSTEM32>\tskill.exe "SERV95"
<SYSTEM32>\tskill.exe "SMC"
<SYSTEM32>\tskill.exe "SPHINX"
<SYSTEM32>\tskill.exe "SCRSCAN"
<SYSTEM32>\tskill.exe "SCAN32"
<SYSTEM32>\tskill.exe "SCAN95"
<SYSTEM32>\tskill.exe "SCANPM"
<SYSTEM32>\tskill.exe "AVP32"
<SYSTEM32>\tskill.exe "AVPCC"
<SYSTEM32>\tskill.exe "AVPDOS32"
<SYSTEM32>\tskill.exe "AVP"
<SYSTEM32>\tskill.exe "AVGCTRL"
<SYSTEM32>\tskill.exe "AVKSERV"
<SYSTEM32>\tskill.exe "AVNT"
<SYSTEM32>\tskill.exe "AVWIN95"
<SYSTEM32>\tskill.exe "AVWUPD32"
<SYSTEM32>\tskill.exe "BLACKD"
<SYSTEM32>\tskill.exe "AVSCHED32"
<SYSTEM32>\tskill.exe "AVPM"
<SYSTEM32>\tskill.exe "AVPTC32"
<SYSTEM32>\tskill.exe "AVPUPD"
<SYSTEM32>\attrib.exe +h +s +a +r "<Текущая директория>\pp32.exe"
<SYSTEM32>\attrib.exe +h +s +a +r "<Текущая директория>\*.*"
<SYSTEM32>\tskill.exe "_AVPCC.EXE"
<SYSTEM32>\reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "winhost" /t REG_DWORD /d "%WINDIR%\pp33.exe" /f
<SYSTEM32>\cmd.exe /c ""%TEMP%\tmpfile0.bat" "
<SYSTEM32>\reg.exe add "HKCU\Software\Kazaa\LocalContent" /v "DisableSharing" /t REG_DWORD /d 0 /f
<SYSTEM32>\reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Parxy" /t REG_DWORD /d "%WINDIR%\pp32.exe" /f
<SYSTEM32>\tskill.exe "AUTODOWN"
<SYSTEM32>\tskill.exe "AVCONSOL"
<SYSTEM32>\tskill.exe "AVE32"
<SYSTEM32>\tskill.exe "APVXDWIN"
<SYSTEM32>\tskill.exe "_AVPM.EXE"
<SYSTEM32>\tskill.exe "ACKWIN32"
<SYSTEM32>\tskill.exe "ANTI-TROJAN"
<SYSTEM32>\tskill.exe "FINDVIRU"
<SYSTEM32>\tskill.exe "FP-WIN"
<SYSTEM32>\tskill.exe "FPROT"
<SYSTEM32>\tskill.exe "F-STOPW"
<SYSTEM32>\tskill.exe "F-AGNT95"
<SYSTEM32>\tskill.exe "F-PROT"
<SYSTEM32>\tskill.exe "F-PROT95"
<SYSTEM32>\tskill.exe "IBMAVSP"
<SYSTEM32>\tskill.exe "ICLOAD95"
<SYSTEM32>\tskill.exe "ICLOADNT"
<SYSTEM32>\tskill.exe "IBMASN"
<SYSTEM32>\tskill.exe "FRW"
<SYSTEM32>\tskill.exe "IAMAPP"
<SYSTEM32>\tskill.exe "IAMSERV"
<SYSTEM32>\tskill.exe "CFINET32"
<SYSTEM32>\tskill.exe "CLAW95"
<SYSTEM32>\tskill.exe "CLAW95CF"
<SYSTEM32>\tskill.exe "CFINET"
<SYSTEM32>\tskill.exe "BLACKICE"
<SYSTEM32>\tskill.exe "CFIADMIN"
<SYSTEM32>\tskill.exe "CFIAUDIT"
<SYSTEM32>\tskill.exe "ECENGINE"
<SYSTEM32>\tskill.exe "ESAFE"
<SYSTEM32>\tskill.exe "ESPWATCH"
<SYSTEM32>\tskill.exe "DVP95_0"
<SYSTEM32>\tskill.exe "CLEANER"
<SYSTEM32>\tskill.exe "CLEANER3"
<SYSTEM32>\tskill.exe "DVP95"