Trojan.KillProc.22540

Техническая информация

Вредоносные функции:

Создает и запускает на исполнение:

'%HOMEPATH%\Portal\RAM Saver Professional\ramsaverpro.exe'
'%TEMP%\RarSFX0\RUN.exe'
'%TEMP%\RarSFX0\RAM.exe'

Запускает на исполнение:

'<SYSTEM32>\taskkill.exe' /f /im moncpu.exe
'<SYSTEM32>\taskkill.exe' /f /im killproc.exe
'<SYSTEM32>\taskkill.exe' /f /im comboost.exe
'<SYSTEM32>\taskkill.exe' /f /im monram.exe
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\RarSFX0\x.bat" "
'<SYSTEM32>\taskkill.exe' /f /im ramsavercp.exe
'<SYSTEM32>\taskkill.exe' /f /im ramsaverpro.exe

Изменения в файловой системе:

Создает следующие файлы:

%HOMEPATH%\Portal\RAM Saver Professional\Lang\serbian.lng
%HOMEPATH%\Portal\RAM Saver Professional\Lang\spanish.lng
%HOMEPATH%\Portal\RAM Saver Professional\Lang\russian.lng
%HOMEPATH%\Portal\RAM Saver Professional\Lang\schinese.lng
%HOMEPATH%\Portal\RAM Saver Professional\Lang\thai.lng
%HOMEPATH%\Portal\RAM Saver Professional\Lang\turkish.lng
%HOMEPATH%\Portal\RAM Saver Professional\Lang\swedish.lng
%HOMEPATH%\Portal\RAM Saver Professional\Lang\taiwan.lng
%HOMEPATH%\Portal\RAM Saver Professional\Lang\german.lng
%HOMEPATH%\Portal\RAM Saver Professional\Lang\hungarian.lng
%HOMEPATH%\Portal\RAM Saver Professional\Lang\espanol.lng
%HOMEPATH%\Portal\RAM Saver Professional\Lang\french.lng
%HOMEPATH%\Portal\RAM Saver Professional\Lang\polish.lng
%HOMEPATH%\Portal\RAM Saver Professional\Lang\portugues_br.lng
%HOMEPATH%\Portal\RAM Saver Professional\Lang\italiano.lng
%HOMEPATH%\Portal\RAM Saver Professional\Lang\kazakh.lng
%HOMEPATH%\Portal\RAM Saver Professional\Help\spanish.chm
%TEMP%\RarSFX1\Readme.vbs
%HOMEPATH%\Portal\RAM Saver Professional\Help\english.chm
%HOMEPATH%\Portal\RAM Saver Professional\Help\russian.chm
%TEMP%\RarSFX1\zone-it.com.url
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\zone-it[1]
%TEMP%\RarSFX1\zone-it.com.nfo
%TEMP%\RarSFX1\ramsaverproX.lnk
%HOMEPATH%\Portal\RAM Saver Professional\moreapps.url
%HOMEPATH%\Portal\RAM Saver Professional\officialsite.url
%HOMEPATH%\Portal\RAM Saver Professional\Lang\ukrainian.lng
%HOMEPATH%\Portal\RAM Saver Professional\Lang\vietnamese.lng
%HOMEPATH%\Portal\RAM Saver Professional\thaiflag1.gif
%HOMEPATH%\Portal\RAM Saver Professional\logo2010.png
%HOMEPATH%\Portal\RAM Saver Professional\orderpage.url
%HOMEPATH%\Portal\RAM Saver Professional\zone-it.com.url
%HOMEPATH%\Portal\RAM Saver Professional\เครดิต.txt
%HOMEPATH%\Portal\RAM Saver Professional\license.txt
%HOMEPATH%\Portal\RAM Saver Professional\Readme.vbs
%HOMEPATH%\Portal\RAM Saver Professional\zone-it.com.nfo
%HOMEPATH%\Portal\RAM Saver Professional\ramsaverpro.ini
%HOMEPATH%\Portal\RAM Saver Professional\Data\USB\compress.bat
%HOMEPATH%\Portal\RAM Saver Professional\ramsaverpro.xml
%HOMEPATH%\Portal\RAM Saver Professional\killproc.ini
%TEMP%\RarSFX0\x.bat
%TEMP%\RarSFX0\RAM.exe
%TEMP%\RarSFX0\Readme.vbs
%TEMP%\RarSFX0\zone-it.com.nfo
%HOMEPATH%\Portal\RAM Saver Professional\file_id.diz
%HOMEPATH%\Portal\RAM Saver Professional\readme.txt
%TEMP%\RarSFX0\RUN.exe
%TEMP%\RarSFX0\zone-it.com.url
%HOMEPATH%\Portal\RAM Saver Professional\Lang\belarusian.lng
%HOMEPATH%\Portal\RAM Saver Professional\Lang\croatian.lng
%HOMEPATH%\Portal\RAM Saver Professional\Thumbs.db
%HOMEPATH%\Portal\RAM Saver Professional\Lang\arabic.lng
%HOMEPATH%\Portal\RAM Saver Professional\Lang\dutch.lng
%HOMEPATH%\Portal\RAM Saver Professional\Lang\english.lng
%HOMEPATH%\Portal\RAM Saver Professional\Lang\czech.lng
%HOMEPATH%\Portal\RAM Saver Professional\Lang\default.lng
%HOMEPATH%\Portal\RAM Saver Professional\language.exe
%HOMEPATH%\Portal\RAM Saver Professional\moncpu.exe
%HOMEPATH%\Portal\RAM Saver Professional\comboost.exe
%HOMEPATH%\Portal\RAM Saver Professional\killproc.exe
%HOMEPATH%\Portal\RAM Saver Professional\ramsaverpro.exe
%HOMEPATH%\Portal\RAM Saver Professional\Data\USB\upx.exe
%HOMEPATH%\Portal\RAM Saver Professional\monram.exe
%HOMEPATH%\Portal\RAM Saver Professional\ramsavercp.exe