Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %ALLUSERSPROFILE%\Start Menu\Programs\Startup\lpk.dll
Вредоносные функции:
Ищет следующие окна с целью
обнаружения утилит для анализа:
- ClassName: '' WindowName: 'Process Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'PROCMON_WINDOW_CLASS' WindowName: ''
- ClassName: '' WindowName: 'Registry Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'RegmonClass' WindowName: ''
- ClassName: '' WindowName: 'File Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'GBDYLLO' WindowName: ''
- ClassName: 'OLLYDBG' WindowName: ''
- ClassName: 'FilemonClass' WindowName: ''
- ClassName: 'pediy06' WindowName: ''
Изменения в файловой системе:
Создает следующие файлы:
- %ALLUSERSPROFILE%\Templates\lpk.dll
- %ALLUSERSPROFILE%\Start Menu\Programs\Games\lpk.dll
- %ALLUSERSPROFILE%\Start Menu\Programs\Administrative Tools\lpk.dll
- C:\Documents and Settings\Default User\lpk.dll
- C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\lpk.dll
- C:\Documents and Settings\Default User\Application Data\Microsoft\lpk.dll
- C:\Documents and Settings\Default User\Application Data\lpk.dll
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\System Tools\lpk.dll
- %ALLUSERSPROFILE%\Start Menu\Programs\lpk.dll
- %ALLUSERSPROFILE%\Start Menu\lpk.dll
- %ALLUSERSPROFILE%\Favorites\lpk.dll
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\lpk.dll
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Entertainment\lpk.dll
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Communications\lpk.dll
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Accessibility\lpk.dll
- C:\Documents and Settings\Default User\Application Data\Microsoft\Media Player\lpk.dll
- C:\Documents and Settings\Default User\Local Settings\Application Data\lpk.dll
- C:\Documents and Settings\Default User\Local Settings\lpk.dll
- C:\Documents and Settings\Default User\Favorites\lpk.dll
- C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\lpk.dll
- C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\lpk.dll
- C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\lpk.dll
- C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Media Player\lpk.dll
- C:\Documents and Settings\Default User\Desktop\lpk.dll
- C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\Certificates\lpk.dll
- C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\lpk.dll
- C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\lpk.dll
- C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CRLs\lpk.dll
- C:\Documents and Settings\Default User\Cookies\lpk.dll
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\down[1].txt
- C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CTLs\lpk.dll
- %ALLUSERSPROFILE%\DRM\lpk.dll
- %ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\S-1-5-18\lpk.dll
- %ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\MachineKeys\lpk.dll
- %ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\lpk.dll
- %ALLUSERSPROFILE%\Application Data\Microsoft\Dr Watson\lpk.dll
- %ALLUSERSPROFILE%\Application Data\Microsoft\Media Player\lpk.dll
- %ALLUSERSPROFILE%\Application Data\Microsoft\Media Index\lpk.dll
- %ALLUSERSPROFILE%\Application Data\Microsoft\HTML Help\lpk.dll
- %ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\DSS\MachineKeys\lpk.dll
- %ALLUSERSPROFILE%\lpk.dll
- C:\Documents and Settings\lpk.dll
- %TEMP%\101093_res.tmp
- %ALLUSERSPROFILE%\Application Data\lpk.dll
- %ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\DSS\lpk.dll
- %ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\lpk.dll
- %ALLUSERSPROFILE%\Application Data\Microsoft\lpk.dll
- %ALLUSERSPROFILE%\Application Data\Microsoft\Network\lpk.dll
- %ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\lpk.dll
- %ALLUSERSPROFILE%\Documents\My Music\Sample Music\lpk.dll
- %ALLUSERSPROFILE%\Documents\My Music\My Playlists\lpk.dll
- %ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\0338E140\lpk.dll
- %ALLUSERSPROFILE%\Documents\My Videos\lpk.dll
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\lpk.dll
- %ALLUSERSPROFILE%\Documents\My Pictures\lpk.dll
- %ALLUSERSPROFILE%\Documents\My Music\lpk.dll
- %ALLUSERSPROFILE%\Application Data\Microsoft\Network\Connections\Pbk\lpk.dll
- %ALLUSERSPROFILE%\Application Data\Microsoft\Network\Connections\Cm\lpk.dll
- %ALLUSERSPROFILE%\Application Data\Microsoft\Network\Connections\lpk.dll
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\lpk.dll
- %ALLUSERSPROFILE%\Documents\lpk.dll
- %ALLUSERSPROFILE%\Desktop\lpk.dll
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\lpk.dll
Присваивает атрибут 'скрытый' для следующих файлов:
- %ALLUSERSPROFILE%\Start Menu\Programs\Startup\lpk.dll
- %ALLUSERSPROFILE%\Start Menu\Programs\Games\lpk.dll
- %ALLUSERSPROFILE%\Start Menu\Programs\Administrative Tools\lpk.dll
- %ALLUSERSPROFILE%\Templates\lpk.dll
- C:\Documents and Settings\Default User\Application Data\Microsoft\lpk.dll
- C:\Documents and Settings\Default User\Application Data\lpk.dll
- C:\Documents and Settings\Default User\lpk.dll
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\System Tools\lpk.dll
- %ALLUSERSPROFILE%\Start Menu\Programs\lpk.dll
- %ALLUSERSPROFILE%\Start Menu\lpk.dll
- %ALLUSERSPROFILE%\Favorites\lpk.dll
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\lpk.dll
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Entertainment\lpk.dll
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Communications\lpk.dll
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Accessibility\lpk.dll
- C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\lpk.dll
- C:\Documents and Settings\Default User\Local Settings\Application Data\lpk.dll
- C:\Documents and Settings\Default User\Local Settings\lpk.dll
- C:\Documents and Settings\Default User\Favorites\lpk.dll
- C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\lpk.dll
- C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\lpk.dll
- C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\lpk.dll
- C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Media Player\lpk.dll
- C:\Documents and Settings\Default User\Desktop\lpk.dll
- C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\lpk.dll
- C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\lpk.dll
- C:\Documents and Settings\Default User\Application Data\Microsoft\Media Player\lpk.dll
- C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\Certificates\lpk.dll
- C:\Documents and Settings\Default User\Cookies\lpk.dll
- C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CTLs\lpk.dll
- C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CRLs\lpk.dll
- %ALLUSERSPROFILE%\Application Data\Microsoft\Dr Watson\lpk.dll
- %ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\S-1-5-18\lpk.dll
- %ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\MachineKeys\lpk.dll
- %ALLUSERSPROFILE%\Application Data\Microsoft\HTML Help\lpk.dll
- %ALLUSERSPROFILE%\Application Data\Microsoft\Network\lpk.dll
- %ALLUSERSPROFILE%\Application Data\Microsoft\Media Player\lpk.dll
- %ALLUSERSPROFILE%\Application Data\Microsoft\Media Index\lpk.dll
- %ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\lpk.dll
- %ALLUSERSPROFILE%\Application Data\lpk.dll
- %ALLUSERSPROFILE%\lpk.dll
- C:\Documents and Settings\lpk.dll
- %ALLUSERSPROFILE%\Application Data\Microsoft\lpk.dll
- %ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\DSS\MachineKeys\lpk.dll
- %ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\DSS\lpk.dll
- %ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\lpk.dll
- %ALLUSERSPROFILE%\Application Data\Microsoft\Network\Connections\lpk.dll
- %ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\0338E140\lpk.dll
- %ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\lpk.dll
- %ALLUSERSPROFILE%\Documents\My Music\Sample Music\lpk.dll
- %ALLUSERSPROFILE%\Documents\My Pictures\lpk.dll
- %ALLUSERSPROFILE%\DRM\lpk.dll
- %ALLUSERSPROFILE%\Documents\My Videos\lpk.dll
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\lpk.dll
- %ALLUSERSPROFILE%\Documents\My Music\My Playlists\lpk.dll
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\lpk.dll
- %ALLUSERSPROFILE%\Application Data\Microsoft\Network\Connections\Pbk\lpk.dll
- %ALLUSERSPROFILE%\Application Data\Microsoft\Network\Connections\Cm\lpk.dll
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\lpk.dll
- %ALLUSERSPROFILE%\Documents\My Music\lpk.dll
- %ALLUSERSPROFILE%\Documents\lpk.dll
- %ALLUSERSPROFILE%\Desktop\lpk.dll
Сетевая активность:
Подключается к:
- 'www.qq##85.com':80
- 'localhost':1035
TCP:
Запросы HTTP GET:
- www.qq##85.com/down.txt
- www.qq##85.com/count.asp?ma#######################
UDP:
- DNS ASK www.qq##85.com
- '<IP-адрес в локальной сети>':1036
Другое:
Ищет следующие окна:
- ClassName: '18467-41' WindowName: ''
