Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'SVCHOST' = 'svchost.com'
Вредоносные функции:
Для затруднения выявления своего присутствия в системе
блокирует запуск следующих системных утилит:
- Диспетчера задач (Taskmgr)
- Редактора реестра (RegEdit)
Завершает или пытается завершить
следующие пользовательские процессы:
- NAVAPW32.EXE
- nod32.exe
- outpost.exe
- lotroclient.exe
- magent.exe
- MCAGENT.EXE
- zapro.exe
- zlclient.exe
- ZONEALARM.EXE
- smc.exe
- sro_client.exe
- ybclient.exe
- GUARD.EXE
- AVSYNMGR.EXE
- bdagent.exe
- drweb.exe
- ash.exe
- ashAvast.exe
- ashAvSrv.exe
- fsav32.exe
- fsavaui.exe
- fsavgui.exe
- drweb386.exe
- elementclient.exe
- fsav.exe
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\Microsoft Shared\Stationery\Command & Conquer - Generals no cd crack.exe
- %CommonProgramFiles%\Microsoft Shared\Speech\RCXD.tmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\RCXE.tmp
- %CommonProgramFiles%\Microsoft Shared\TextConv\RCXF.tmp
- %CommonProgramFiles%\Microsoft Shared\TextConv\Final Fantasy XI - USA no cd crack.exe
- %CommonProgramFiles%\Microsoft Shared\DW\RCXB.tmp
- %CommonProgramFiles%\Microsoft Shared\DW\Anti-Trojan 4.0.exe
- %CommonProgramFiles%\Microsoft Shared\MSInfo\dMSN mercury messenger 1.7.0.6.exe
- %CommonProgramFiles%\Microsoft Shared\Speech\Adobe Illustrator v10.0 Time Limit Crack.exe
- %CommonProgramFiles%\Microsoft Shared\MSInfo\RCXC.tmp
- %CommonProgramFiles%\Microsoft Shared\Triedit\Besieger DreamCatcher Interactive crack.exe
- %CommonProgramFiles%\Microsoft Shared\Web Folders\RCX13.tmp
- %CommonProgramFiles%\Microsoft Shared\Web Folders\Deus Ex Invisible War NO CD Crack.exe
- %CommonProgramFiles%\Microsoft Shared\web server extensions\Full Spectrum Warrior crack.exe
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\fifo.log
- %CommonProgramFiles%\Microsoft Shared\web server extensions\RCX14.tmp
- %CommonProgramFiles%\Microsoft Shared\VC\Drug Wars - Underworld 1.3.exe
- %CommonProgramFiles%\Microsoft Shared\Triedit\RCX10.tmp
- %CommonProgramFiles%\Microsoft Shared\VC\RCX11.tmp
- %CommonProgramFiles%\Microsoft Shared\VGX\RCX12.tmp
- %CommonProgramFiles%\Microsoft Shared\VGX\Icewind Dale 2 no cd crack.exe
- %CommonProgramFiles%\Microsoft Shared\XP Slipstreamer v1.0 Crack.exe
- %WINDIR%\Downloaded Program Files\RCX3.tmp
- %CommonProgramFiles%\Microsoft Shared\RCX4.tmp
- %PROGRAM_FILES%\Movie Maker\Shared\City of Heroes NCsoft crack.exe
- %WINDIR%\system\SystemRunInternet.dll
- <SYSTEM32>\ClubxXx.exe
- <SYSTEM32>\svchost.com
- %WINDIR%\system\SystemNetBBS.dll
- %WINDIR%\Downloaded Program Files\windows xp key generator.exe
- <Служебный элемент>
- %PROGRAM_FILES%\Movie Maker\Shared\RCX5.tmp
- %HOMEPATH%\My Documents\My Received Files\Magix Video Deluxe 5 beta.exe
- %HOMEPATH%\My Documents\Downloads\RCX8.tmp
- %HOMEPATH%\My Documents\My Received Files\RCX9.tmp
- %CommonProgramFiles%\Microsoft Shared\DAO\RCXA.tmp
- %CommonProgramFiles%\Microsoft Shared\DAO\WinZip Self-Extractor v2.2 keygen.exe
- %WINDIR%\ime\shared\RCX6.tmp
- %WINDIR%\ime\shared\Porno Screensaver.exe
- %WINDIR%\SoftwareDistribution\Download\warcraft 3 maphack.exe
- %HOMEPATH%\My Documents\Downloads\winzip full version key generator.exe
- %WINDIR%\SoftwareDistribution\Download\RCX7.tmp
Удаляет следующие файлы:
- %CommonProgramFiles%\Microsoft Shared\Stationery\Command & Conquer - Generals no cd crack.exe
- %CommonProgramFiles%\Microsoft Shared\TextConv\Final Fantasy XI - USA no cd crack.exe
- %CommonProgramFiles%\Microsoft Shared\MSInfo\dMSN mercury messenger 1.7.0.6.exe
- %CommonProgramFiles%\Microsoft Shared\Speech\Adobe Illustrator v10.0 Time Limit Crack.exe
- %CommonProgramFiles%\Microsoft Shared\Triedit\Besieger DreamCatcher Interactive crack.exe
- %CommonProgramFiles%\Microsoft Shared\Web Folders\Deus Ex Invisible War NO CD Crack.exe
- %CommonProgramFiles%\Microsoft Shared\web server extensions\Full Spectrum Warrior crack.exe
- %CommonProgramFiles%\Microsoft Shared\VC\Drug Wars - Underworld 1.3.exe
- %CommonProgramFiles%\Microsoft Shared\VGX\Icewind Dale 2 no cd crack.exe
- %CommonProgramFiles%\Microsoft Shared\DW\Anti-Trojan 4.0.exe
- %CommonProgramFiles%\Microsoft Shared\XP Slipstreamer v1.0 Crack.exe
- %PROGRAM_FILES%\Movie Maker\Shared\City of Heroes NCsoft crack.exe
- <Служебный элемент>
- %WINDIR%\Downloaded Program Files\windows xp key generator.exe
- %WINDIR%\ime\shared\Porno Screensaver.exe
- %HOMEPATH%\My Documents\My Received Files\Magix Video Deluxe 5 beta.exe
- %CommonProgramFiles%\Microsoft Shared\DAO\WinZip Self-Extractor v2.2 keygen.exe
- %WINDIR%\SoftwareDistribution\Download\warcraft 3 maphack.exe
- %HOMEPATH%\My Documents\Downloads\winzip full version key generator.exe
Перемещает следующие файлы:
- %CommonProgramFiles%\Microsoft Shared\Stationery\RCXE.tmp в %CommonProgramFiles%\Microsoft Shared\Stationery\Command & Conquer - Generals no cd crack.exe
- %CommonProgramFiles%\Microsoft Shared\TextConv\RCXF.tmp в %CommonProgramFiles%\Microsoft Shared\TextConv\Final Fantasy XI - USA no cd crack.exe
- %CommonProgramFiles%\Microsoft Shared\MSInfo\RCXC.tmp в %CommonProgramFiles%\Microsoft Shared\MSInfo\dMSN mercury messenger 1.7.0.6.exe
- %CommonProgramFiles%\Microsoft Shared\Speech\RCXD.tmp в %CommonProgramFiles%\Microsoft Shared\Speech\Adobe Illustrator v10.0 Time Limit Crack.exe
- %CommonProgramFiles%\Microsoft Shared\Triedit\RCX10.tmp в %CommonProgramFiles%\Microsoft Shared\Triedit\Besieger DreamCatcher Interactive crack.exe
- %CommonProgramFiles%\Microsoft Shared\Web Folders\RCX13.tmp в %CommonProgramFiles%\Microsoft Shared\Web Folders\Deus Ex Invisible War NO CD Crack.exe
- %CommonProgramFiles%\Microsoft Shared\web server extensions\RCX14.tmp в %CommonProgramFiles%\Microsoft Shared\web server extensions\Full Spectrum Warrior crack.exe
- %CommonProgramFiles%\Microsoft Shared\VC\RCX11.tmp в %CommonProgramFiles%\Microsoft Shared\VC\Drug Wars - Underworld 1.3.exe
- %CommonProgramFiles%\Microsoft Shared\VGX\RCX12.tmp в %CommonProgramFiles%\Microsoft Shared\VGX\Icewind Dale 2 no cd crack.exe
- %CommonProgramFiles%\Microsoft Shared\DW\RCXB.tmp в %CommonProgramFiles%\Microsoft Shared\DW\Anti-Trojan 4.0.exe
- %CommonProgramFiles%\Microsoft Shared\RCX4.tmp в %CommonProgramFiles%\Microsoft Shared\XP Slipstreamer v1.0 Crack.exe
- %PROGRAM_FILES%\Movie Maker\Shared\RCX5.tmp в %PROGRAM_FILES%\Movie Maker\Shared\City of Heroes NCsoft crack.exe
- <Служебный элемент> в <Служебный элемент>
- %WINDIR%\Downloaded Program Files\RCX3.tmp в %WINDIR%\Downloaded Program Files\windows xp key generator.exe
- %WINDIR%\ime\shared\RCX6.tmp в %WINDIR%\ime\shared\Porno Screensaver.exe
- %HOMEPATH%\My Documents\My Received Files\RCX9.tmp в %HOMEPATH%\My Documents\My Received Files\Magix Video Deluxe 5 beta.exe
- %CommonProgramFiles%\Microsoft Shared\DAO\RCXA.tmp в %CommonProgramFiles%\Microsoft Shared\DAO\WinZip Self-Extractor v2.2 keygen.exe
- %WINDIR%\SoftwareDistribution\Download\RCX7.tmp в %WINDIR%\SoftwareDistribution\Download\warcraft 3 maphack.exe
- %HOMEPATH%\My Documents\Downloads\RCX8.tmp в %HOMEPATH%\My Documents\Downloads\winzip full version key generator.exe
Другое:
Ищет следующие окна:
- ClassName: 'Indicator' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
