Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'sys32ex' = '<SYSTEM32>\NTLDR.exe'
Вредоносные функции:
Для затруднения выявления своего присутствия в системе
блокирует отображение:
- скрытых файлов
- расширений файлов
блокирует запуск следующих системных утилит:
- Диспетчера задач (Taskmgr)
- Редактора реестра (RegEdit)
блокирует:
- Компонент восстановления системы (SR)
изменяет следующие системные настройки:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoClose' = '00000001'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer] 'NoRun' = '00000001'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer] 'NoFolderOptions' = '00000001'
Изменения в файловой системе:
Создает следующие файлы:
- C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat.exe
- C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat.exe
- C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat.exe
- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.exe
- %HOMEPATH%\NTUSER.DAT.exe
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\pluginreg.dat.exe
- C:\Documents and Settings\NetworkService\NTUSER.DAT.exe
- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.exe
- C:\Documents and Settings\LocalService\Cookies\index.dat.exe
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Winter.jpg.exe
- C:\Documents and Settings\Default User\NTUSER.DAT.exe
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Sunset.jpg.exe
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Water lilies.jpg.exe
- C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\index.dat.exe
- C:\Documents and Settings\LocalService\NTUSER.DAT.exe
- C:\Documents and Settings\Default User\Cookies\index.dat.exe
- C:\Documents and Settings\Default User\Local Settings\History\History.IE5\index.dat.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\Nature Bkgrd.jpg.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\Pie Charts Bkgrd.jpg.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\Leaves Bkgrd.jpg.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\Maize Bkgrd.jpg.exe
- %CommonProgramFiles%\Services\verisign.bmp.exe
- %CommonProgramFiles%\Services\whowhere.bmp.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\Sunflower Bkgrd.jpg.exe
- %CommonProgramFiles%\Services\bigfoot.bmp.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\Glacier Bkgrd.jpg.exe
- <LS_APPDATA>\Microsoft\Windows\UsrClass.dat.exe
- <LS_APPDATA>\VMware\hgfs.dat.exe
- %HOMEPATH%\Cookies\index.dat.exe
- <LS_APPDATA>\GDIPFONTCACHEV1.DAT.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\Clear Day Bkgrd.jpg.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\Fiesta Bkgrd.jpg.exe
- %HOMEPATH%\Local Settings\History\History.IE5\index.dat.exe
- %HOMEPATH%\Local Settings\History\History.IE5\MSHist012011111020111111\index.dat.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\astronaut.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\ball.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\%USERNAME%.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\airplane.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\car.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\cat.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\beach.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\butterfly.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\guest.bmp.exe
- <SYSTEM32>\NTLDR.exe
- C:\Diperkosa.flv.exe
- %TEMP%\~DFA749.tmp
- %WINDIR%\system manager.sys.EXE
- <SYSTEM32>\readme.txt
- C:\gadis cantik ABG.flv.exe
- C:\readme.txt
- %WINDIR%\windows.txt
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\palm tree.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\pink flower.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\kick.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\lift-off.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\snowflake.bmp.exe
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Blue hills.jpg.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\red flower.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\skater.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\horses.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\dog.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\drip.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\chess.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\dirt bike.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\frog.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\guitar.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\duck.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\fish.bmp.exe
