ИНТЕЛЛЕКТ DIGITAL WORLD

Вирусы Trojan.PWS.Multi.2081 Техническая информация Вредоносные функции: Запускает на исполнение: ' \cmd.exe' /c ""%TEMP%\oid.bat" " " " Ищет ветки реестра, отвечающие за хранение паролей сторонними программами: [ \SOFTWARE\NCH Software\Fling\Accounts] [ \SOFTWARE\NCH Software\Fling\Accounts] [ \Software\NCH Software\ClassicFTP\FTPAccounts] [ \Software\FTPClient\Sites] [ \Software\SoftX.org\FTPClient\Sites] [ \Software\SoftX.org\FTPClient\Sites] [ \Software\FTPClient\Sites] [ \Software\FTP Explorer\Profiles] [ \Software\FTP Explorer\FTP Explorer\Workspace\MFCToolBar-224] [ \Software\FTPWare\COREFTP\Sites] [ \Software\VanDyke\SecureFX] [ \Software\NCH Software\ClassicFTP\FTPAccounts] [ \Software\ExpanDrive\Sessions] [ \Software\Cryer\WebSitePublisher] [ \Software\Martin Prikryl] [ \Software\SimonTatham\PuTTY\Sessions] [ \Software\LinasFTP\Site Manager] [ \SOFTWARE\Robo-FTP 3.7\Scripts] [ \Software\SimonTatham\PuTTY\Sessions] [ \Software\MAS-Soft\FTPInfo\Setup] [ \Software\CoffeeCup Software] [ \Software\CoffeeCup Software] [ \Software\South River Technologies\WebDrive\Connections] [ \Software\South River Technologies\WebDrive\Connections] [ \Software\Martin Prikryl] [ \Software\FlashPeak\BlazeFtp\Settings] [ \SOFTWARE\Robo-FTP 3.7\Scripts] [ \SOFTWARE\Robo-FTP 3.7\FTPServers] [ \SOFTWARE\Robo-FTP 3.7\FTPServers] [ \Software\CoffeeCup Software\Internet\Profiles] [ \Software\GlobalSCAPE\CuteFTP 7 Professional\QCToolbar] [ \Software\GlobalSCAPE\CuteFTP 7 Home\QCToolbar] [ \Software\GlobalSCAPE\CuteFTP 6 Professional\QCToolbar] [ \Software\GlobalSCAPE\CuteFTP 8 Home\QCToolbar] [ \Software\FlashFXP] [ \Software\FlashFXP\3] [ \Software\GlobalSCAPE\CuteFTP 8 Professional\QCToolbar] [ \Software\Ghisler\Windows Commander] [ \Software\Far2\SavedDialogHistory\FTPHost] [ \Software\Far\SavedDialogHistory\FTPHost] [ \Software\Ghisler\Windows Commander] [ \Software\GlobalSCAPE\CuteFTP 6 Home\QCToolbar] [ \Software\Ghisler\Total Commander] [ \Software\Ghisler\Total Commander] [ \Software\FlashFXP\3] [ \Software\BPFTP] [ \Software\BulletProof Software\BulletProof FTP Client\Options] [ \Software\BPFTP\Bullet Proof FTP\Options] [ \Software\TurboFTP] [ \Software\Sota\FFFTP\Options] [ \Software\Sota\FFFTP] [ \Software\TurboFTP] [ \Software\FileZilla Client] [ \Software\FileZilla] [ \Software\FlashFXP] [ \Software\FileZilla] [ \Software\BulletProof Software\BulletProof FTP Client\Main] [ \Software\BPFTP\Bullet Proof FTP\Main] [ \Software\FileZilla Client] Изменения в файловой системе: Создает следующие файлы: %TEMP%\oid.bat Самоудаляется. Сетевая активность: Подключается к: 'wi#####reekcompany.mobi':80 TCP: Запросы HTTP POST: http://wi#####reekcompany.mobi/vepof83/gw3t3s.php UDP: DNS ASK wi#####reekcompany.mobi