Trojan.Siggen18.50429

Technical Information

To ensure autorun and distribution

Sets the following service settings

[<HKLM>\System\CurrentControlSet\Services\ProcMon] 'ImagePath' = '<SYSTEM32>\ProcMon.sys'

Creates the following services

'ProcMon' <SYSTEM32>\ProcMon.sys

Modifies file system

Creates the following files

%TEMP%\0011bcf8
%ProgramFiles%\beauview\managelanc\skin\riant\res_focu.bmp
%TEMP%\res_norm.bmp
%ProgramFiles%\beauview\managelanc\skin\riant\res_norm.bmp
%TEMP%\rightarrow.bmp
%ProgramFiles%\beauview\managelanc\skin\riant\rightarrow.bmp
%TEMP%\scrollbarbk.bmp
%ProgramFiles%\beauview\managelanc\skin\riant\scrollbarbk.bmp
%TEMP%\skin.ini
%TEMP%\tabright.bmp
%TEMP%\res_focu.bmp
%ProgramFiles%\beauview\managelanc\skin\riant\res_down.bmp
%TEMP%\tableft.bmp
%ProgramFiles%\beauview\managelanc\skin\riant\tableft.bmp
%TEMP%\tableftsel.bmp
%ProgramFiles%\beauview\managelanc\skin\riant\tableftsel.bmp
%TEMP%\tabmid.bmp
%ProgramFiles%\beauview\managelanc\skin\riant\tabmid.bmp
%TEMP%\tabmidsel.bmp
%ProgramFiles%\beauview\managelanc\skin\riant\tabmidsel.bmp
%ProgramFiles%\beauview\managelanc\skin\riant\skin.ini
%ProgramFiles%\beauview\managelanc\skin\riant\statusbarback.bmp
%ProgramFiles%\beauview\managelanc\skin\riant\max_focu.bmp
%TEMP%\statusbarback.bmp
%TEMP%\menuitemdown.bmp
%ProgramFiles%\beauview\managelanc\skin\riant\max_norm.bmp
%TEMP%\menuback.bmp
%ProgramFiles%\beauview\managelanc\skin\riant\menuback.bmp
%TEMP%\menudown.bmp
%ProgramFiles%\beauview\managelanc\skin\riant\menudown.bmp
%TEMP%\menufocus.bmp
%ProgramFiles%\beauview\managelanc\skin\riant\menufocus.bmp
%TEMP%\menuitemback.bmp
%TEMP%\min_norm.bmp
%TEMP%\res_down.bmp
%ProgramFiles%\beauview\managelanc\skin\riant\min_norm.bmp
%TEMP%\menuitemfocus.bmp
%ProgramFiles%\beauview\managelanc\skin\riant\menuitemfocus.bmp
%TEMP%\menuitemslider.bmp
%ProgramFiles%\beauview\managelanc\skin\riant\menuitemslider.bmp
%TEMP%\min_down.bmp
%ProgramFiles%\beauview\managelanc\skin\riant\min_down.bmp
%TEMP%\min_focu.bmp
%ProgramFiles%\beauview\managelanc\skin\riant\min_focu.bmp
%ProgramFiles%\beauview\managelanc\skin\riant\menuitemback.bmp
%ProgramFiles%\beauview\managelanc\skin\riant\menuitemdown.bmp
%TEMP%\max_norm.bmp
%ProgramFiles%\beauview\managelanc\skin\riant\tabright.bmp
%TEMP%\toolbarback.bmp
%ProgramFiles%\beauview\managelanc\vsetup.exe
%TEMP%\webmail.pl
%WINDIR%\syswow64\webmail.pl
%TEMP%\winmon.dll
%WINDIR%\syswow64\winmon.dll
%TEMP%\wni.dat
%WINDIR%\syswow64\wni.dat
%TEMP%\xfmainth.dll
%ProgramFiles%\beauview\managelanc\viewc.dll
%TEMP%\vsetup.exe
%ProgramFiles%\beauview\managelanc\xfmainth.dll
%TEMP%\xfstorefile.dll
%WINDIR%\syswow64\xfstorefile.dll
%TEMP%\xfsvc.exe
%ProgramFiles%\beauview\managelanc\xfsvc.exe
%TEMP%\xfsvc.pdb
%ProgramFiles%\beauview\managelanc\xfsvc.pdb
%TEMP%\zip.dll
%ProgramFiles%\beauview\managelanc\zip.dll
%TEMP%\xfnet.dll
%WINDIR%\syswow64\xfnet.dll
%ProgramFiles%\beauview\managelanc\skin\riant\tabrightsel.bmp
%TEMP%\tabrightsel.bmp
%TEMP%\vgwdrv.sys
%ProgramFiles%\beauview\managelanc\skin\riant\toolbarback.bmp
%TEMP%\viewbk.bmp
%ProgramFiles%\beauview\managelanc\skin\riant\viewbk.bmp
%TEMP%\_desktop.ini
%ProgramFiles%\beauview\managelanc\skin\riant\_desktop.ini
%ProgramFiles%\beauview\managelanc\skin.ini
%TEMP%\systeminfo.dll
%ProgramFiles%\beauview\managelanc\vgwdrv.sys
%ProgramFiles%\beauview\managelanc\skin\riant\thumbs.db
%TEMP%\viewc.dll
%ProgramFiles%\beauview\managelanc\systeminfo.dll
%WINDIR%\syswow64\drivers\usbupper.sys
%TEMP%\verctrl.dll
%ProgramFiles%\beauview\managelanc\verctrl.dll
%TEMP%\vgwdrv.dll
%ProgramFiles%\beauview\managelanc\vgwdrv.dll
%TEMP%\vgwdrv.inf
%ProgramFiles%\beauview\managelanc\vgwdrv.inf
%TEMP%\usbmanage.dll
%ProgramFiles%\beauview\managelanc\usbmanage.dll
%TEMP%\usbupper.sys
%TEMP%\max_focu.bmp
%ProgramFiles%\beauview\managelanc\skin\riant\max_down.bmp
%TEMP%\max_down.bmp
%TEMP%\imagelib.dll
%ProgramFiles%\beauview\managelanc\imagelib.dll
%TEMP%\lanmap.dll
%WINDIR%\syswow64\lanmap.dll
%TEMP%\mediaopera.dll
%ProgramFiles%\beauview\managelanc\mediaopera.dll
%TEMP%\mscfg.exe
%WINDIR%\syswow64\mscfg.exe
%TEMP%\ijl15.dll
%ProgramFiles%\beauview\managelanc\net\xpfilter\plviewer.sys
%ProgramFiles%\beauview\managelanc\hkforbit.dll
%ProgramFiles%\beauview\managelanc\net\thumbs.db
%TEMP%\netsf.inf
%ProgramFiles%\beauview\managelanc\net\xpfilter\netsf.inf
%TEMP%\netsf_m.inf
%ProgramFiles%\beauview\managelanc\net\xpfilter\netsf_m.inf
%TEMP%\plviewer.dll
%ProgramFiles%\beauview\managelanc\net\xpfilter\plviewer.dll
%TEMP%\plviewer.sys
%WINDIR%\syswow64\msgtrack.dll
%TEMP%\msgtrack.dll
%TEMP%\thumbs.db
%ProgramFiles%\beauview\managelanc\gui.dll
%TEMP%\comfun.dll
%TEMP%\aidc.exe
%ProgramFiles%\beauview\managelanc\aidc.exe
%TEMP%\assistantth.dll
%ProgramFiles%\beauview\managelanc\assistantth.dll
%TEMP%\change.dll
%ProgramFiles%\beauview\managelanc\change.dll
%TEMP%\cj60lib.dll
%ProgramFiles%\beauview\managelanc\cj60lib.dll
%TEMP%\hkforbit.dll
%TEMP%\snetcfg.exe
%TEMP%\00029058
%ProgramFiles%\beauview\managelanc\comfun.dll
%TEMP%\commonfundll.dll
%ProgramFiles%\beauview\managelanc\commonfundll.dll
%TEMP%\devicemanage.dll
%ProgramFiles%\beauview\managelanc\devicemanage.dll
%TEMP%\filetransport.dll
%ProgramFiles%\beauview\managelanc\filetransport.dll
%TEMP%\gui.dll
%ProgramFiles%\beauview\managelanc\clienttool.exe
%TEMP%\clienttool.exe
%ProgramFiles%\beauview\managelanc\ijl15.dll
%ProgramFiles%\beauview\managelanc\net\xpfilter\snetcfg.exe
%TEMP%\exit_foc.bmp
%TEMP%\exit_nor.bmp
%ProgramFiles%\beauview\managelanc\skin\riant\exit_nor.bmp
%TEMP%\formviewbk.bmp
%ProgramFiles%\beauview\managelanc\skin\riant\formviewbk.bmp
%TEMP%\frameborder.bmp
%ProgramFiles%\beauview\managelanc\skin\riant\frameborder.bmp
%TEMP%\frametopborder.bmp
%ProgramFiles%\beauview\managelanc\skin\riant\exit_down.bmp
%ProgramFiles%\beauview\managelanc\skin\riant\dialogbk==.bmp
%ProgramFiles%\beauview\managelanc\skin\riant\exit_foc.bmp
%ProgramFiles%\beauview\managelanc\skin\riant\frametopborder.bmp
%ProgramFiles%\beauview\managelanc\skin\riant\horizontalthumb.bmp
%TEMP%\inactivecaption.bmp
%ProgramFiles%\beauview\managelanc\skin\riant\inactivecaption.bmp
%TEMP%\leftarrow.bmp
%ProgramFiles%\beauview\managelanc\skin\riant\leftarrow.bmp
%TEMP%\listbk.bmp
%ProgramFiles%\beauview\managelanc\skin\riant\listbk.bmp
%TEMP%\headerctrlnormal.bmp
%ProgramFiles%\beauview\managelanc\skin\riant\headerctrlnormal.bmp
%TEMP%\horizontalthumb.bmp
%TEMP%\exit_down.bmp
%TEMP%\dialogbk==.bmp
%TEMP%\netclass.dll
%TEMP%\netop.dll
%ProgramFiles%\beauview\managelanc\netop.dll
%TEMP%\newlockdesk.dll
%ProgramFiles%\beauview\managelanc\newlockdesk.dll
%TEMP%\pctrl32.dll
%ProgramFiles%\beauview\managelanc\pctrl32.dll
%TEMP%\plchat.dll
%ProgramFiles%\beauview\managelanc\plchat.dll
%TEMP%\pldevice.dll
%ProgramFiles%\beauview\managelanc\netclass.dll
%ProgramFiles%\beauview\managelanc\pldevice.dll
%WINDIR%\syswow64\procmon.sys
%TEMP%\runonce.exe
%ProgramFiles%\beauview\managelanc\runonce.exe
%TEMP%\setup.exe
%ProgramFiles%\beauview\managelanc\setup.exe
%TEMP%\activecaption.bmp
%ProgramFiles%\beauview\managelanc\skin\riant\activecaption.bmp
%TEMP%\dialogbk.bmp
%ProgramFiles%\beauview\managelanc\skin\riant\dialogbk.bmp
%TEMP%\procmon.sys
%WINDIR%\syswow64\sys_config.ini
%TEMP%\{58b976c3-5296-37d5-632c-c203dae52070}\setfd90.tmp

Deletes the following files

%TEMP%\0011bcf8
%TEMP%\tableftsel.bmp
%TEMP%\tableft.bmp
%TEMP%\statusbarback.bmp
%TEMP%\skin.ini
%TEMP%\scrollbarbk.bmp
%TEMP%\rightarrow.bmp
%TEMP%\res_norm.bmp
%TEMP%\res_focu.bmp
%TEMP%\res_down.bmp
%TEMP%\tabmid.bmp
%TEMP%\min_norm.bmp
%TEMP%\min_down.bmp
%TEMP%\menuitemslider.bmp
%TEMP%\menuitemfocus.bmp
%TEMP%\menuitemdown.bmp
%TEMP%\menuitemback.bmp
%TEMP%\menufocus.bmp
%TEMP%\menudown.bmp
%TEMP%\menuback.bmp
%TEMP%\max_norm.bmp
%TEMP%\min_focu.bmp
%TEMP%\vgwdrv.sys
%TEMP%\zip.dll
%TEMP%\tabrightsel.bmp
%TEMP%\xfsvc.pdb
%TEMP%\xfsvc.exe
%TEMP%\xfstorefile.dll
%TEMP%\xfnet.dll
%TEMP%\xfmainth.dll
%TEMP%\wni.dat
%TEMP%\winmon.dll
%TEMP%\webmail.pl
%TEMP%\vsetup.exe
%TEMP%\max_focu.bmp
%TEMP%\viewc.dll
%TEMP%\vgwdrv.inf
%TEMP%\vgwdrv.dll
%TEMP%\verctrl.dll
%TEMP%\usbupper.sys
%TEMP%\usbmanage.dll
%TEMP%\systeminfo.dll
%TEMP%\_desktop.ini
%TEMP%\viewbk.bmp
%TEMP%\toolbarback.bmp
%TEMP%\tabmidsel.bmp
%TEMP%\tabright.bmp
%TEMP%\max_down.bmp
%TEMP%\snetcfg.exe
%TEMP%\netsf_m.inf
%TEMP%\netsf.inf
%TEMP%\thumbs.db
%TEMP%\msgtrack.dll
%TEMP%\mscfg.exe
%TEMP%\mediaopera.dll
%TEMP%\lanmap.dll
%TEMP%\imagelib.dll
%TEMP%\ijl15.dll
%TEMP%\plviewer.dll
%TEMP%\hkforbit.dll
%TEMP%\filetransport.dll
%TEMP%\devicemanage.dll
%TEMP%\commonfundll.dll
%TEMP%\comfun.dll
%TEMP%\clienttool.exe
%TEMP%\cj60lib.dll
%TEMP%\change.dll
%TEMP%\assistantth.dll
%TEMP%\aidc.exe
%TEMP%\gui.dll
%TEMP%\dialogbk.bmp
%TEMP%\leftarrow.bmp
%TEMP%\netclass.dll
%TEMP%\inactivecaption.bmp
%TEMP%\horizontalthumb.bmp
%TEMP%\headerctrlnormal.bmp
%TEMP%\frametopborder.bmp
%TEMP%\frameborder.bmp
%TEMP%\formviewbk.bmp
%TEMP%\exit_nor.bmp
%TEMP%\exit_foc.bmp
%TEMP%\exit_down.bmp
%TEMP%\listbk.bmp
%TEMP%\dialogbk==.bmp
%TEMP%\activecaption.bmp
%TEMP%\setup.exe
%TEMP%\runonce.exe
%TEMP%\procmon.sys
%TEMP%\pldevice.dll
%TEMP%\plchat.dll
%TEMP%\pctrl32.dll
%TEMP%\newlockdesk.dll
%TEMP%\netop.dll
%TEMP%\plviewer.sys
%TEMP%\00029058

Moves the following files

from %TEMP%\{58b976c3-5296-37d5-632c-c203dae52070}\setfd90.tmp to %TEMP%\{58b976c3-5296-37d5-632c-c203dae52070}\netsf.inf

Substitutes the following files

%TEMP%\thumbs.db
%TEMP%\skin.ini

Miscellaneous

Searches for the following windows

ClassName: '' WindowName: 'Г“ВІВјГѕВ°ВІГ—В°'
ClassName: '' WindowName: 'Г€ГВјГѕВ°ВІГ—В°'

Creates and executes the following

'%ProgramFiles%\beauview\managelanc\vsetup.exe' /VideoSetup
'%ProgramFiles%\beauview\managelanc\setup.exe' /InstallC
'%ProgramFiles%\beauview\managelanc\net\xpfilter\snetcfg.exe' -c s -i ms_PLViewer
'%ProgramFiles%\beauview\managelanc\net\xpfilter\snetcfg.exe' -c s -i ms_PLViewer' (with hidden window)

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней