Trojan.DownLoader1.49694

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices] '<Имя вируса>' = '<Полный путь к вирусу>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '<Имя вируса>' = '<Полный путь к вирусу>'

Изменения в файловой системе:

Создает следующие файлы:

%PROGRAM_FILES%\MSN\MSNCoreFiles\OOBE\MicrosoftRSystem.exe
%PROGRAM_FILES%\Windows Media Player\PlayerNpdsplay.exe
%CommonProgramFiles%\SpeechEngines\Microsoft\SpeechEngine.exe
%PROGRAM_FILES%\Reference Assemblies\Microsoft\Framework\v3.5\FrameworkMicrosoft.exe
%PROGRAM_FILES%\NetMeeting\Windowsnmas5.1.2600.2180.exe
%CommonProgramFiles%\System\msadc\msaddsrData.exe
%CommonProgramFiles%\Microsoft Shared\TextConv\Documentmsconv97.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\getfile[1].php
%CommonProgramFiles%\Microsoft Shared\DW\1031\ApplicationError11.0.5510.exe
%CommonProgramFiles%\Microsoft Shared\Triedit\ComponentDHTML.exe
%PROGRAM_FILES%\Internet Explorer\WindowsSystem.exe
%PROGRAM_FILES%\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationProviderPresentationFramework.exe
%CommonProgramFiles%\<Служебное имя>\Drivers\Virtual Printer\TPOGPS\i386\GatewayThinPrint.exe
%CommonProgramFiles%\SpeechEngines\Microsoft\TTS\1033\SAPI5WindowsTM.exe
%PROGRAM_FILES%\Windows NT\Pinball\PINBALLPinball.exe
%CommonProgramFiles%\System\MicrosoftSystem6.00.2900.21802.0408032158.exe
%CommonProgramFiles%\Microsoft Shared\Speech\WindowsTMWindowsTM5.1.4111.00.exe
%PROGRAM_FILES%\FireFox\uninstall\helperTumucumaque.exe
%CommonProgramFiles%\Microsoft Shared\DAO\MicrosoftDAO36003.60.8618.0.exe
%PROGRAM_FILES%\Internet Explorer\Connection Wizard\Windowsicwconn1.exe
%CommonProgramFiles%\System\Ole DB\msdascmsdaosp2.81.1117.0.exe
%CommonProgramFiles%\Microsoft Shared\MSInfo\WindowsOperating5.1.2600.0.exe
%PROGRAM_FILES%\Internet Explorer\MUI\0409\mscorierMicrosoft.exe
%PROGRAM_FILES%\Messenger\msmsgsmsgslang.exe
%PROGRAM_FILES%\Windows NT\SystemHYPERTRM.exe
%CommonProgramFiles%\<Служебное имя>\Drivers\Virtual Printer\TPOG3\i386\ThinPrintThinPrint782095.exe
%PROGRAM_FILES%\MSN\MSNCoreFiles\Install\MicrosoftRWindows.exe
%CommonProgramFiles%\Microsoft Shared\DW\1025\ApplicationReporting.exe
%PROGRAM_FILES%\MSN\MSNCoreFiles\Install\MSN9Components\WindowsMicrosoftR5.50.4134.600.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\google[1]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\v=78&step=2&hostid=8AFBDC759981BCFBF46C93C81128BB94[1]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\getfile[1].php
<Служебный элемент>
%CommonProgramFiles%\Microsoft Shared\DW\1042\DWIntl20Reporting.exe
%CommonProgramFiles%\MSSoap\Binaries\Resources\1033\SoapMSSOAPR1.02.814.0.exe
%PROGRAM_FILES%\Windows NT\Accessories\wordpadSystem.exe
%PROGRAM_FILES%\MSN Gaming Zone\Windows\zonelibZone1.2.626.1.exe
%PROGRAM_FILES%\Movie Maker\WindowsWMM2RES2.exe
%CommonProgramFiles%\Microsoft Shared\DW\3082\DWIntl20Reporting11.0.5510.exe
%CommonProgramFiles%\System\ado\ADORH15Access.exe
%CommonProgramFiles%\Microsoft Shared\DW\1028\MicrosoftReporting.exe
%PROGRAM_FILES%\Outlook Express\WindowsMicrosoft.exe
%CommonProgramFiles%\Microsoft Shared\DW\1036\DWIntl20Application.exe
%PROGRAM_FILES%\FireFox\components\browsercompsTumucumaque2.0.2.exe
%PROGRAM_FILES%\Online Services\ServiceRefer15269.exe

Удаляет следующие файлы:

%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\v=78&step=2&hostid=8AFBDC759981BCFBF46C93C81128BB94[1]

Сетевая активность:

Подключается к:

'74.##5.232.51':80
'ht####bsearch.info':80
'localhost':1038

TCP:

Запросы HTTP GET:

ht####bsearch.info/getfile.php?r=##############################################################################################
ht####bsearch.info/getfile.php?r=#############################################################################################
ht####bsearch.info/httpss/v=78&step=2&hostid=8AFBDC759981BCFBF46C93C81128BB94
74.##5.232.51/

UDP: