Trojan.DownLoader5.13654

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'DefenseVirusMain' = '"%PROGRAM_FILES%\DefenseVirus\DefenseVirus.exe" /Boot'

Вредоносные функции:

Создает и запускает на исполнение:

<SYSTEM32>\defensevirus_liveon.exe /S

Запускает на исполнение:

<SYSTEM32>\cmd.exe /c \DelUS.bat

Изменения в файловой системе:

Создает следующие файлы:

%PROGRAM_FILES%\DefenseVirus\etc\DVmonRemote.dll
%PROGRAM_FILES%\DefenseVirus\etc\DVFilterDriver.SYS
%PROGRAM_FILES%\DefenseVirus\etc\dvMon.exe
%PROGRAM_FILES%\DefenseVirus\Lang\kr.xml
%PROGRAM_FILES%\DefenseVirus\etc\dvReg.exe
%PROGRAM_FILES%\DefenseVirus\db\vsdb.dat
%PROGRAM_FILES%\DefenseVirus\db\avmon.dat
%PROGRAM_FILES%\DefenseVirus\db\adtc.dat
%PROGRAM_FILES%\DefenseVirus\db\filter.dll
%PROGRAM_FILES%\DefenseVirus\db\pwdb.dat
%PROGRAM_FILES%\DefenseVirus\db\inter.dll
%PROGRAM_FILES%\DefenseVirus\skin\default.avs
%TEMP%\nsm4.tmp\IEFunctions.dll
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\DefenseVirus.lnk
%TEMP%\nsm4.tmp\DLLWebCount_new.dll
%TEMP%\nsm4.tmp\SelfDelete.dll
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\inst_nor[1].php
%HOMEPATH%\Start Menu\DefenseVirus.lnk
%PROGRAM_FILES%\DefenseVirus\partner.ini
%TEMP%\nsm4.tmp\processes_second.dll
%PROGRAM_FILES%\DefenseVirus\Uninstall.exe
%HOMEPATH%\Start Menu\Programs\DefenseVirus\DefenseVirus Б¦°Е.lnk
%HOMEPATH%\Start Menu\Programs\DefenseVirus\DefenseVirus.lnk
%TEMP%\nsm4.tmp\IsVista.dll
%TEMP%\temppage.ini
%TEMP%\nsm4.tmp\Ischeck.dll
%TEMP%\instpage.ini
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\defensevirus_instchk2[1].php
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\pcroomchk[1].php
%TEMP%\nsx2.tmp\SelfDelete.dll
<SYSTEM32>\defensevirus_liveon.exe
C:\DelUS.bat
%TEMP%\nsm4.tmp\ChkClient.dll
%TEMP%\nsm4.tmp\stack.dll
%TEMP%\nsm4.tmp\DefenseVirusMsg.dll
%PROGRAM_FILES%\DefenseVirus\SoDVUpdateServer.dat
%PROGRAM_FILES%\DefenseVirus\Ep.dat
%PROGRAM_FILES%\DefenseVirus\conf.ini
%PROGRAM_FILES%\DefenseVirus\db\adsub.dat
%PROGRAM_FILES%\DefenseVirus\db\addb.dat
%PROGRAM_FILES%\DefenseVirus\DefenseVirus.exe
%TEMP%\nsm4.tmp\DLLWaitForKillProgram.dll
%TEMP%\nsm4.tmp\KillProcDLL.dll
%PROGRAM_FILES%\DefenseVirus\DVAutoUpdate.exe
%PROGRAM_FILES%\DefenseVirus\DVUpdateServer.dat
%PROGRAM_FILES%\DefenseVirus\DVEngine.dll

Удаляет следующие файлы:

%TEMP%\nsm4.tmp\IsVista.dll
%TEMP%\nsm4.tmp\KillProcDLL.dll
%TEMP%\nsm4.tmp\IEFunctions.dll
%TEMP%\nsm4.tmp\Ischeck.dll
%TEMP%\nsm4.tmp\stack.dll
<SYSTEM32>\defensevirus_liveon.exe
%TEMP%\nsm4.tmp\processes_second.dll
%TEMP%\nsm4.tmp\SelfDelete.dll
%TEMP%\instpage.ini
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\inst_nor[1].php
%TEMP%\nsx2.tmp\SelfDelete.dll
%TEMP%\temppage.ini
%TEMP%\nsm4.tmp\DLLWaitForKillProgram.dll
%TEMP%\nsm4.tmp\DLLWebCount_new.dll
%TEMP%\nsm4.tmp\ChkClient.dll
%TEMP%\nsm4.tmp\DefenseVirusMsg.dll