Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '<Имя вируса>' = '<Полный путь к вирусу>'
Вредоносные функции:
Для затруднения выявления своего присутствия в системе
блокирует запуск следующих системных утилит:
- Диспетчера задач (Taskmgr)
Изменения в файловой системе:
Создает следующие файлы:
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\geotracker[1].1466
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\geotracker[1].4305
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\geotracker[1].9279
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\geotracker[1].1521
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\geotracker[1].2755
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\geotracker[1].1624
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\geotracker[1].3484
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\geotracker[1].4791
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\geotracker[1].9639
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\geotracker[1].64859
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\geotracker[1].279
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\geotracker[1].0485
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\geotracker[1].9341
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\geotracker[1].18929
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\geotracker[1].4567
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\geotracker[1].028
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\geotracker[1].4351
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\geotracker[1].4807
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\geotracker[1].0197
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\geotracker[1].5253
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\geotracker[1].6789
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\geotracker[1].7684
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\geotracker[1].07292
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\geotracker[1].1189
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\geotracker[1].94253
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\geotracker[1].02838
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\geotracker[1].46042
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\geotracker[1].1091
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\geotracker[1].8177
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\geotracker[1].6758
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\geotracker[1].7998
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\geotracker[1].0121
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\geotracker[1].6585
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\geotracker[1].1659
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\geotracker[1].6378
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\geotracker[1].4724
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\geotracker[1].1819
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\geotracker[1].2839
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\geotracker[1].3843
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\geotracker[1].2509
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\geotracker[1].042
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\geotracker[1].1049
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\geotracker[1].0493
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\geotracker[1].0718
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\geotracker[1].7286
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\geotracker[1].8299
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\geotracker[1].2928
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\geotracker[1].0381
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\geotracker[1].803
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\geotracker[1].9807
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\geotracker[1].1019
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\geotracker[1].0148
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\geotracker[1].0931
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\geotracker[1].797
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\geotracker[1].123
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\geotracker[1].1227
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\geotracker[1].465
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\geotracker[1].3672
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\geotracker[1].751
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\geotracker[1].1113
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\geotracker[1].7473
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\geotracker[1].575
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\geotracker[1].6689
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\geotracker[1].971027
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\geotracker[1].7949
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\geotracker[1].6087
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\geotracker[1].0312
- <Текущая директория>\userid.dat
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\nua[1].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\geotracker[1].1236
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\geotracker[1].3714
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\geotracker[1].8935
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\geotracker[1].2541
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\geotracker[1].1842
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\geotracker[1].2231
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\geotracker[1].9065
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\geotracker[1].175
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\geotracker[1].46632
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\geotracker[1].41345
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\geotracker[1].0031
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\geotracker[1].1141
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\geotracker[1].58273
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\geotracker[1].1646
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\geotracker[1].8221
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\geotracker[1].5956
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\geotracker[1].4479
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\geotracker[1].9341
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\geotracker[1].1062
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\geotracker[1].5701
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\geotracker[1].3842
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\geotracker[1].1147
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\geotracker[1].5278
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\geotracker[1].4633
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\geotracker[1].0175
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\geotracker[1].9509
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\geotracker[1].0438
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\geotracker[1].3284
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\geotracker[1].43213
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\geotracker[1].2439
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\geotracker[1].8661
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\geotracker[1].4944
Сетевая активность:
Подключается к:
- 'ge###acker.info':80
- 'localhost':1037
- 'www.se##wn.com':80
TCP:
Запросы HTTP GET:
- ge###acker.info/?ai#########################################
- ge###acker.info/?ai##########################################
- www.se##wn.com/65/nua.php
UDP:
- DNS ASK ge###acker.info
- DNS ASK www.se##wn.com
Другое:
Ищет следующие окна:
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'Indicator' WindowName: ''
- ClassName: '' WindowName: ''
