Техническая информация
Вредоносные функции:
Создает и запускает на исполнение:
- '%TEMP%\nsv3.tmp\ns4.tmp' %WINDIR%\temp\000.cmd
- '%WINDIR%\Temp\RUNEXE.EXE'
Запускает на исполнение:
- '<SYSTEM32>\cacls.exe' <SYSTEM32>\wldoor0.dll /d everyone
- '<SYSTEM32>\cacls.exe' <SYSTEM32>\ztfree0.dll /d everyone
- '<SYSTEM32>\cacls.exe' <SYSTEM32>\wgdoor0.dll /d everyone
- '<SYSTEM32>\cacls.exe' <SYSTEM32>\mhdoor0.dll /d everyone
- '<SYSTEM32>\cacls.exe' <SYSTEM32>\dadoor0.dll /d everyone
- '<SYSTEM32>\attrib.exe' +s +h +r %PROGRAM_FILES%\Internet Explorer\OnlO0r.dll
- '<SYSTEM32>\attrib.exe' +s +h +r %CommonProgramFiles%\svchost.exe
- '<SYSTEM32>\attrib.exe' +s +h +r %PROGRAM_FILES%\Internet Explorer\OnlO0r.bak
- '<SYSTEM32>\cacls.exe' <SYSTEM32>\wodoor0.dll /d everyone
- '<SYSTEM32>\attrib.exe' +s +h +r %PROGRAM_FILES%\Internet Explorer\OnlO0r.obk
- '<SYSTEM32>\cacls.exe' <SYSTEM32>\mydoor0.dll /d everyone
- '<SYSTEM32>\cacls.exe' <SYSTEM32>\wddoor0.dll /d everyone
- '<SYSTEM32>\cacls.exe' <SYSTEM32>\qhdoor0.dll /d everyone
- '<SYSTEM32>\cacls.exe' %CommonProgramFiles%\fjOs0r.dll /d everyone
- '<SYSTEM32>\cacls.exe' <SYSTEM32>\cqdoor0.dll /d everyone
- '<SYSTEM32>\cacls.exe' <SYSTEM32>\qjdoor0.dll /d everyone
- '<SYSTEM32>\cacls.exe' <SYSTEM32>\dh3oor0.dll /d everyone
- '<SYSTEM32>\cacls.exe' <SYSTEM32>\rxdoor0.dll /d everyone
- '<SYSTEM32>\cacls.exe' <SYSTEM32>\tldoor0.dll /d everyone
- '<SYSTEM32>\cacls.exe' <SYSTEM32>\zxdoor0.dll /d everyone
- '<SYSTEM32>\attrib.exe' +s +h +r <SYSTEM32>\wldoor0.dll
- '<SYSTEM32>\attrib.exe' +s +h +r <SYSTEM32>\ztfree0.dll
- '<SYSTEM32>\attrib.exe' +s +h +r <SYSTEM32>\wgdoor0.dll
- '<SYSTEM32>\attrib.exe' +s +h +r <SYSTEM32>\mhdoor0.dll
- '<SYSTEM32>\attrib.exe' +s +h +r <SYSTEM32>\dadoor0.dll
- '<SYSTEM32>\attrib.exe' +s +h +r %CommonProgramFiles%\M1.exe
- '<SYSTEM32>\cmd.exe' /c %WINDIR%\temp\000.cmd
- '<SYSTEM32>\attrib.exe' +s +h +r %CommonProgramFiles%\M2.exe
- '<SYSTEM32>\attrib.exe' +s +h +r <SYSTEM32>\wodoor0.dll
- '<SYSTEM32>\attrib.exe' +s +h +r %CommonProgramFiles%\win.exe
- '<SYSTEM32>\attrib.exe' +s +h +r <SYSTEM32>\mydoor0.dll
- '<SYSTEM32>\attrib.exe' +s +h +r <SYSTEM32>\wddoor0.dll
- '<SYSTEM32>\attrib.exe' +s +h +r <SYSTEM32>\qhdoor0.dll
- '<SYSTEM32>\attrib.exe' +s +h +r %CommonProgramFiles%\fjOs0r.dll
- '<SYSTEM32>\attrib.exe' +s +h +r <SYSTEM32>\cqdoor0.dll
- '<SYSTEM32>\attrib.exe' +s +h +r <SYSTEM32>\qjdoor0.dll
- '<SYSTEM32>\attrib.exe' +s +h +r <SYSTEM32>\dh3oor0.dll
- '<SYSTEM32>\attrib.exe' +s +h +r <SYSTEM32>\rxdoor0.dll
- '<SYSTEM32>\attrib.exe' +s +h +r <SYSTEM32>\tldoor0.dll
- '<SYSTEM32>\attrib.exe' +s +h +r <SYSTEM32>\zxdoor0.dll
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\temp.ini
- %TEMP%\nsv3.tmp\System.dll
- %TEMP%\nsp2.tmp
- %TEMP%\nsv3.tmp\ns4.tmp
- %TEMP%\nsv3.tmp\nsExec.dll
- %TEMP%\uninst.exe
- %WINDIR%\Temp\RUNEXE.EXE
- %WINDIR%\Temp\000.cmd
- %WINDIR%\Temp\Command.ini
- %WINDIR%\Temp\zjy.ini
- %WINDIR%\Temp\Netbar.dll
- %WINDIR%\Temp\svchost.exe
Другое:
Ищет следующие окна:
- ClassName: '#32770' WindowName: '(null)'
- ClassName: 'SysListView32' WindowName: '(null)'
- ClassName: 'EDIT' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
