Техническая информация
Вредоносные функции:
Создает и запускает на исполнение:
- %PROGRAM_FILES%\nSohbet\mirc\mIRC.exe
Запускает на исполнение:
- %WINDIR%\msagent\agentsvr.exe -Embedding
Изменения в файловой системе:
Создает следующие файлы:
- %PROGRAM_FILES%\nSohbet\mirc\servers.ini
- %PROGRAM_FILES%\nSohbet\mirc\sifre.txt
- %PROGRAM_FILES%\nSohbet\mirc\popups.ini
- %PROGRAM_FILES%\nSohbet\mirc\notify\SETTINGS.INI
- %PROGRAM_FILES%\nSohbet\mirc\notify\sounds\online.wav
- %PROGRAM_FILES%\nSohbet\mirc\sys\1.mrc
- %PROGRAM_FILES%\nSohbet\mirc\sys\2.txt
- %PROGRAM_FILES%\nSohbet\mirc\sys\3.ttf
- %PROGRAM_FILES%\nSohbet\mirc\sys\2.ttf
- %PROGRAM_FILES%\nSohbet\mirc\sys\1.ttf
- %PROGRAM_FILES%\nSohbet\mirc\sys\2.mrc
- %PROGRAM_FILES%\nSohbet\mirc\notify\icons\Notify.ico
- %PROGRAM_FILES%\nSohbet\mirc\notify\icons\offline.ico
- %PROGRAM_FILES%\nSohbet\mirc\notify\icons\msn.ico
- %PROGRAM_FILES%\nSohbet\mirc\notify\icons\del.ICO
- %PROGRAM_FILES%\nSohbet\mirc\notify\icons\MSN.icl
- %PROGRAM_FILES%\nSohbet\mirc\notify\icons\online.ico
- %PROGRAM_FILES%\nSohbet\mirc\notify\icons\whois.ICO
- %PROGRAM_FILES%\nSohbet\mirc\notify\notify.mrc
- %PROGRAM_FILES%\nSohbet\mirc\notify\icons\Thumbs.db
- %PROGRAM_FILES%\nSohbet\mirc\notify\icons\Query.ico
- %PROGRAM_FILES%\nSohbet\mirc\notify\icons\refresh.ico
- %PROGRAM_FILES%\nSohbet\mirc\sys\4.ttf
- %PROGRAM_FILES%\nSohbet\mirc\sys\script1.txt
- %PROGRAM_FILES%\nSohbet\mirc\sys\script3.ttf
- %PROGRAM_FILES%\nSohbet\mirc\sys\script1.ttf
- %PROGRAM_FILES%\nSohbet\mirc\sys\POPQ.TTF
- %PROGRAM_FILES%\nSohbet\mirc\sys\POPS.TTF
- %PROGRAM_FILES%\nSohbet\mirc\sys\veriables.ttf
- %HOMEPATH%\Desktop\nSohbet mIRC Script.lnk
- %PROGRAM_FILES%\nSohbet\mirc\Uninstall.ini
- %PROGRAM_FILES%\nSohbet\mirc\Uninstall.exe
- %PROGRAM_FILES%\nSohbet\mirc\sys\x1.ttf
- %PROGRAM_FILES%\nSohbet\mirc\urls.ini
- %PROGRAM_FILES%\nSohbet\mirc\sys\8.ttf
- %PROGRAM_FILES%\nSohbet\mirc\sys\9.ttf
- %PROGRAM_FILES%\nSohbet\mirc\sys\7.ttf
- %PROGRAM_FILES%\nSohbet\mirc\sys\4.txt
- %PROGRAM_FILES%\nSohbet\mirc\sys\5.ttf
- %PROGRAM_FILES%\nSohbet\mirc\sys\mp3.ini
- %PROGRAM_FILES%\nSohbet\mirc\sys\POPM.TTF
- %PROGRAM_FILES%\nSohbet\mirc\sys\POPN.TTF
- %PROGRAM_FILES%\nSohbet\mirc\sys\POPC.TTF
- %PROGRAM_FILES%\nSohbet\mirc\sys\optnx.ini
- %PROGRAM_FILES%\nSohbet\mirc\sys\ping.txt
- %PROGRAM_FILES%\nSohbet\mirc\Help.html
- %PROGRAM_FILES%\nSohbet\mirc\Help_dosyalar\colorschememapping.xml
- %PROGRAM_FILES%\nSohbet\mirc\dlls\views.mdx
- %PROGRAM_FILES%\nSohbet\mirc\dlls\out_wave.dll
- %PROGRAM_FILES%\nSohbet\mirc\dlls\RebaR.dll
- %PROGRAM_FILES%\nSohbet\mirc\Help_dosyalar\filelist.xml
- %PROGRAM_FILES%\nSohbet\mirc\img\team\ask.jpg
- %PROGRAM_FILES%\nSohbet\mirc\img\team\besiktas.jpg
- %PROGRAM_FILES%\nSohbet\mirc\img\Sohbet.ico
- %PROGRAM_FILES%\nSohbet\mirc\Help_dosyalar\themedata.thmx
- %PROGRAM_FILES%\nSohbet\mirc\img\2.ico
- %PROGRAM_FILES%\nSohbet\mirc\aliases1.ini
- %PROGRAM_FILES%\nSohbet\mirc\control.ini
- %PROGRAM_FILES%\nSohbet\mirc\aliases.ini
- %TEMP%\$inst\2.tmp
- %TEMP%\$inst\temp_0.tmp
- %PROGRAM_FILES%\nSohbet\mirc\dlls\amp_in.dll
- %PROGRAM_FILES%\nSohbet\mirc\dlls\mdx.dll
- %PROGRAM_FILES%\nSohbet\mirc\dlls\mOTFv3.dll
- %PROGRAM_FILES%\nSohbet\mirc\dlls\in_mp3.dll
- %PROGRAM_FILES%\nSohbet\mirc\dlls\bars.mdx
- %PROGRAM_FILES%\nSohbet\mirc\dlls\hdock.dll
- %PROGRAM_FILES%\nSohbet\mirc\img\team\deviL.jpg
- %PROGRAM_FILES%\nSohbet\mirc\nHTMLn_2.95.dll
- %PROGRAM_FILES%\nSohbet\mirc\notify\dll\dialog.mdx
- %PROGRAM_FILES%\nSohbet\mirc\mirc.ini
- %PROGRAM_FILES%\nSohbet\mirc\Kayэt.reg
- %PROGRAM_FILES%\nSohbet\mirc\mIRC.exe
- %PROGRAM_FILES%\nSohbet\mirc\notify\dll\mdx.dll
- %PROGRAM_FILES%\nSohbet\mirc\notify\icons\add.ICO
- %PROGRAM_FILES%\nSohbet\mirc\notify\icons\chat.ICO
- %PROGRAM_FILES%\nSohbet\mirc\notify\icons\about.ico
- %PROGRAM_FILES%\nSohbet\mirc\notify\dll\POPUPS.DLL
- %PROGRAM_FILES%\nSohbet\mirc\notify\dll\VIEWS.MDX
- %PROGRAM_FILES%\nSohbet\mirc\img\team\oyun.jpg
- %PROGRAM_FILES%\nSohbet\mirc\img\team\radyo.jpg
- %PROGRAM_FILES%\nSohbet\mirc\img\team\mirc.jpg
- %PROGRAM_FILES%\nSohbet\mirc\img\team\fenerbahce.jpg
- %PROGRAM_FILES%\nSohbet\mirc\img\team\galatasaray.jpg
- %PROGRAM_FILES%\nSohbet\mirc\img\team\sex.jpg
- %PROGRAM_FILES%\nSohbet\mirc\img\ust.gif
- %PROGRAM_FILES%\nSohbet\mirc\img\yan.gif
- %PROGRAM_FILES%\nSohbet\mirc\img\team\yardim.jpg
- %PROGRAM_FILES%\nSohbet\mirc\img\team\Thumbs.db
- %PROGRAM_FILES%\nSohbet\mirc\img\team\Turk.jpg
Присваивает атрибут 'скрытый' для следующих файлов:
- %PROGRAM_FILES%\nSohbet\mirc\notify\icons\Thumbs.db
- %PROGRAM_FILES%\nSohbet\mirc\img\team\Thumbs.db
Удаляет следующие файлы:
- %TEMP%\$inst\2.tmp
- %TEMP%\$inst\temp_0.tmp
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
