Сообщение от :
File System Modifications
The following files were created in the system:
# Filename(s) File Size File Hash
1 %Windir%\43.jpg 8,006 bytes MD5: 0xF47FC21D7592AA546AB8C2A33BEF6137
SHA-1: 0x7F0F6FB272243C8E835B410C502732A15ECAAB31
2 %Windir%\exxplorer.exe 25,088 bytes MD5: 0x139CC2316AFEA5B841E79E8E4C07426A
SHA-1: 0x6B758B5F4698B843F887A7CD5738D333AA6BE9F6
3 %Windir%\svccost.exe 70,144 bytes MD5: 0x5F6A6EBB0BC722D66F5D8FD1D5CB959E
SHA-1: 0xA6EAA5AE9A8DFB8A743EAB763A6463304BC965C9
4 %System%\154.bat 90 bytes MD5: 0xBCDFFB24E094009252C94D3258C98F02
SHA-1: 0x27BBEA3BDF4A6AB2C8DCCBA9B343E69F986DB2D2
5 [file and pathname of the sample #1] 151,040 bytes MD5: 0xB9C1051A7E498D3B7B108B196FD40DCD
SHA-1: 0x4FB9BBCFDCFE7E3AB14272E01ED77150705D2D0A
6 %Windir%\xFoLOOOSErs.txt 25 bytes MD5: 0x3FAC12CA442E9B50352157B5DCCE7E5B
SHA-1: 0x6D8583CA510A1EFB75506068858C30A77E594C2A
Notes:
%Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.
%System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).
Memory Modifications
There was a new process created in the system:
Process Name Process Filename Main Module Size
svccost.exe %Windir%\svccost.exe 73,728 bytes
Registry Modifications
The following Registry Keys were created:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Sa feBoot\Network_
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Sa feBoot\Network_\AFD
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Network_
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Network_\AFD
HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Policies\system
The newly created Registry Value is:
[HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Policies\system]
DisableTaskMgr = 0x00000001
to prevent users from starting Task Manager (Taskmgr.exe)
The following Registry Value was modified:
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
Shell =
Other details
There was registered attempt to establish connection with the remote host. The connection details are:
Remote Host Port Number
87.242.98.91 80
The data identified by the following URL was then requested from the remote web server:
http://www.ch-mz.ru/images/catalog/icon/fg54h.php
Outbound traffic (potentially malicious)
There was an outbound traffic produced on port 80
