Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Classes\ImgBurn.AssocFile.iso\shell\open\command] '' = '"%PROGRAM_FILES%\ImgBurn\ImgBurn.exe" /MODE WRITE /SOURCE "%1"'
- [<HKLM>\SOFTWARE\Classes\ImgBurn.AssocFile.lst\shell\open\command] '' = '"%PROGRAM_FILES%\ImgBurn\ImgBurn.exe" /MODE WRITE /SOURCE "%1"'
- [<HKLM>\SOFTWARE\Classes\ImgBurn.AssocFile.img\shell\open\command] '' = '"%PROGRAM_FILES%\ImgBurn\ImgBurn.exe" /MODE WRITE /SOURCE "%1"'
- [<HKLM>\SOFTWARE\Classes\ImgBurn.AssocFile.ibb\shell\open\command] '' = '"%PROGRAM_FILES%\ImgBurn\ImgBurn.exe" /MODE BUILD /SOURCE "%1"'
- [<HKLM>\SOFTWARE\Classes\ImgBurn.AssocFile.ibq\shell\open\command] '' = '"%PROGRAM_FILES%\ImgBurn\ImgBurn.exe" /MODE WRITE /SOURCE "%1"'
- [<HKLM>\SOFTWARE\Classes\ImgBurn.AssocFile.udi\shell\open\command] '' = '"%PROGRAM_FILES%\ImgBurn\ImgBurn.exe" /MODE WRITE /SOURCE "%1"'
- [<HKLM>\SOFTWARE\Classes\ImgBurn.AssocFile.wv\shell\open\command] '' = '"%PROGRAM_FILES%\ImgBurn\ImgBurn.exe" /MODE WRITE /SOURCE "%1"'
- [<HKLM>\SOFTWARE\Classes\ImgBurn.AssocFile.pdi\shell\open\command] '' = '"%PROGRAM_FILES%\ImgBurn\ImgBurn.exe" /MODE WRITE /SOURCE "%1"'
- [<HKLM>\SOFTWARE\Classes\ImgBurn.AssocFile.mds\shell\open\command] '' = '"%PROGRAM_FILES%\ImgBurn\ImgBurn.exe" /MODE WRITE /SOURCE "%1"'
- [<HKLM>\SOFTWARE\Classes\ImgBurn.AssocFile.nrg\shell\open\command] '' = '"%PROGRAM_FILES%\ImgBurn\ImgBurn.exe" /MODE WRITE /SOURCE "%1"'
- [<HKLM>\SOFTWARE\Classes\ImgBurn.AssocFile.gi\shell\open\command] '' = '"%PROGRAM_FILES%\ImgBurn\ImgBurn.exe" /MODE WRITE /SOURCE "%1"'
- [<HKLM>\SOFTWARE\Classes\ImgBurn.AssocFile.cdi\shell\open\command] '' = '"%PROGRAM_FILES%\ImgBurn\ImgBurn.exe" /MODE WRITE /SOURCE "%1"'
- [<HKLM>\SOFTWARE\Classes\ImgBurn.AssocFile.cdr\shell\open\command] '' = '"%PROGRAM_FILES%\ImgBurn\ImgBurn.exe" /MODE WRITE /SOURCE "%1"'
- [<HKLM>\SOFTWARE\Classes\ImgBurn.AssocFile.ccd\shell\open\command] '' = '"%PROGRAM_FILES%\ImgBurn\ImgBurn.exe" /MODE WRITE /SOURCE "%1"'
- [<HKLM>\SOFTWARE\Classes\ImgBurn.AssocFile.ape\shell\open\command] '' = '"%PROGRAM_FILES%\ImgBurn\ImgBurn.exe" /MODE WRITE /SOURCE "%1"'
- [<HKLM>\SOFTWARE\Classes\ImgBurn.AssocFile.bin\shell\open\command] '' = '"%PROGRAM_FILES%\ImgBurn\ImgBurn.exe" /MODE WRITE /SOURCE "%1"'
- [<HKLM>\SOFTWARE\Classes\ImgBurn.AssocFile.flac\shell\open\command] '' = '"%PROGRAM_FILES%\ImgBurn\ImgBurn.exe" /MODE WRITE /SOURCE "%1"'
- [<HKLM>\SOFTWARE\Classes\ImgBurn.AssocFile.gcm\shell\open\command] '' = '"%PROGRAM_FILES%\ImgBurn\ImgBurn.exe" /MODE WRITE /SOURCE "%1"'
- [<HKLM>\SOFTWARE\Classes\ImgBurn.AssocFile.dvd\shell\open\command] '' = '"%PROGRAM_FILES%\ImgBurn\ImgBurn.exe" /MODE WRITE /SOURCE "%1"'
- [<HKLM>\SOFTWARE\Classes\ImgBurn.AssocFile.cue\shell\open\command] '' = '"%PROGRAM_FILES%\ImgBurn\ImgBurn.exe" /MODE WRITE /SOURCE "%1"'
- [<HKLM>\SOFTWARE\Classes\ImgBurn.AssocFile.di\shell\open\command] '' = '"%PROGRAM_FILES%\ImgBurn\ImgBurn.exe" /MODE WRITE /SOURCE "%1"'
Вредоносные функции:
Создает и запускает на исполнение:
- '%TEMP%\7ZipSfx.000\SetupImgBurn_2.5.0.0.exe' /S /NCRC
Изменения в файловой системе:
Создает следующие файлы:
- %ALLUSERSPROFILE%\Start Menu\Programs\ImgBurn\ImgBurn.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\ImgBurn\Uninstall.lnk
- %PROGRAM_FILES%\ImgBurn\Sounds\Error.wav
- %ALLUSERSPROFILE%\Start Menu\Programs\ImgBurn\ImgBurn Read Me.lnk
- %PROGRAM_FILES%\ImgBurn\uninstall.exe
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\ImgBurn.lnk
- %ALLUSERSPROFILE%\Desktop\ImgBurn.lnk
- %PROGRAM_FILES%\ImgBurn\Sounds\Success.wav
- %TEMP%\nsk3.tmp\System.dll
- %TEMP%\nsp2.tmp
- %TEMP%\7ZipSfx.000\SetupImgBurn_2.5.0.0.exe
- %TEMP%\nsk3.tmp\FindProcDLL.dll
- %PROGRAM_FILES%\ImgBurn\ReadMe.txt
- %PROGRAM_FILES%\ImgBurn\ImgBurnPreview.exe
- %PROGRAM_FILES%\ImgBurn\ImgBurn.exe
Удаляет следующие файлы:
- %TEMP%\7ZipSfx.000\SetupImgBurn_2.5.0.0.exe
- %TEMP%\nsk3.tmp\System.dll
- %TEMP%\nsk3.tmp\FindProcDLL.dll
