Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Otshot' = '%PROGRAM_FILES%\otshot\otshot.exe -minimize'
Вредоносные функции:
Создает и запускает на исполнение:
- '%PROGRAM_FILES%\otshot\otshot.exe'
Изменения в файловой системе:
Создает следующие файлы:
- %PROGRAM_FILES%\otshot\signatures\Signitures_camera_3.bmp
- %PROGRAM_FILES%\otshot\signatures\Signitures_camera_4.bmp
- %PROGRAM_FILES%\otshot\signatures\Signitures_camera_2.bmp
- %PROGRAM_FILES%\otshot\signatures\Signitures_29.bmp
- %PROGRAM_FILES%\otshot\signatures\Signitures_camera_1.bmp
- %PROGRAM_FILES%\otshot\signatures\Signitures_camera_5.bmp
- %PROGRAM_FILES%\otshot\signatures\love and kisses.bmp
- %PROGRAM_FILES%\otshot\signatures\simple.bmp
- %PROGRAM_FILES%\otshot\signatures\Thumbs.db
- %PROGRAM_FILES%\otshot\signatures\Signitures_camera_6.bmp
- %PROGRAM_FILES%\otshot\signatures\Signitures_camera_7.bmp
- %PROGRAM_FILES%\otshot\signatures\Signitures_21.bmp
- %PROGRAM_FILES%\otshot\signatures\Signitures_22.bmp
- %PROGRAM_FILES%\otshot\signatures\Signitures_20.bmp
- %PROGRAM_FILES%\otshot\signatures\9_Signitures.bmp
- %PROGRAM_FILES%\otshot\signatures\I'm a baby.bmp
- %PROGRAM_FILES%\otshot\signatures\Signitures_23.bmp
- %PROGRAM_FILES%\otshot\signatures\Signitures_27.bmp
- %PROGRAM_FILES%\otshot\signatures\Signitures_28.bmp
- %PROGRAM_FILES%\otshot\signatures\Signitures_26.bmp
- %PROGRAM_FILES%\otshot\signatures\Signitures_24.bmp
- %PROGRAM_FILES%\otshot\signatures\Signitures_25.bmp
- %PROGRAM_FILES%\otshot\signatures\stikers.zip
- %HOMEPATH%\Desktop\Otshot.lnk
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Otshot.lnk
- %PROGRAM_FILES%\otshot\sample\sample_4.jpg
- %PROGRAM_FILES%\otshot\sample\sample_2.jpg
- %PROGRAM_FILES%\otshot\sample\sample_3.jpg
- %HOMEPATH%\Start Menu\Programs\otshot.lnk
- %PROGRAM_FILES%\otshot\files.db-journal
- %PROGRAM_FILES%\otshot\files.db
- %PROGRAM_FILES%\otshot\hotshot.db
- %PROGRAM_FILES%\otshot\uninstall.exe
- %PROGRAM_FILES%\otshot\hotshot.db-journal
- %PROGRAM_FILES%\otshot\signatures\you are a star.bmp
- %PROGRAM_FILES%\otshot\frames\Thumbs.db
- %PROGRAM_FILES%\otshot\signatures\with regards.bmp
- %PROGRAM_FILES%\otshot\signatures\the basics.bmp
- %PROGRAM_FILES%\otshot\signatures\white.bmp
- %PROGRAM_FILES%\otshot\frames\bg.bmp
- %PROGRAM_FILES%\otshot\sample\Thumbs.db
- %PROGRAM_FILES%\otshot\sample\sample_1.jpg
- %PROGRAM_FILES%\otshot\frames\f_bg1.bmp
- %PROGRAM_FILES%\otshot\frames\bg1.bmp
- %PROGRAM_FILES%\otshot\frames\f_bg.bmp
- %PROGRAM_FILES%\otshot\signatures\6_Signitures.bmp
- %PROGRAM_FILES%\otshot\ui\belv\image\image_20.bmp
- %PROGRAM_FILES%\otshot\ui\belv\image\image_22.bmp
- %PROGRAM_FILES%\otshot\ui\belv\image\help_pinball.bmp
- %PROGRAM_FILES%\otshot\ui\belv\image\fttop.bmp
- %PROGRAM_FILES%\otshot\ui\belv\image\header_spring.gif
- %PROGRAM_FILES%\otshot\ui\belv\image\max_clody.bmp
- %PROGRAM_FILES%\otshot\ui\belv\image\scroll_h.bmp
- %PROGRAM_FILES%\otshot\ui\belv\image\scroll_v.bmp
- %PROGRAM_FILES%\otshot\ui\belv\image\min_pinball.bmp
- %PROGRAM_FILES%\otshot\ui\belv\image\max_pinball.bmp
- %PROGRAM_FILES%\otshot\ui\belv\image\min_clody.bmp
- %PROGRAM_FILES%\otshot\ui\belv\image\Thumbs.db
- %PROGRAM_FILES%\otshot\ui\belv\image\button_blevs_.bmp
- %PROGRAM_FILES%\otshot\ui\belv.urp
- %PROGRAM_FILES%\otshot\ui\belv.urf
- %PROGRAM_FILES%\otshot\ui\belv.uri
- %PROGRAM_FILES%\otshot\ui\belv\image\close_clody.bmp
- %PROGRAM_FILES%\otshot\ui\belv\image\fl_belv.gif
- %PROGRAM_FILES%\otshot\ui\belv\image\fr_belv.gif
- %PROGRAM_FILES%\otshot\ui\belv\image\fb_belvs_.bmp
- %PROGRAM_FILES%\otshot\ui\belv\image\close_pinball.bmp
- %PROGRAM_FILES%\otshot\ui\belv\image\combox_blev.gif
- %PROGRAM_FILES%\otshot\ui\belv\image\sizebox_wmp.bmp
- %PROGRAM_FILES%\otshot\signatures\12_Signitures.bmp
- %PROGRAM_FILES%\otshot\signatures\13_Signitures.bmp
- %PROGRAM_FILES%\otshot\signatures\11_Signitures.bmp
- %PROGRAM_FILES%\otshot\ZalmanUpdateService.exe
- %PROGRAM_FILES%\otshot\signatures\10_Signitures.bmp
- %PROGRAM_FILES%\otshot\signatures\14_Signitures.bmp
- %PROGRAM_FILES%\otshot\signatures\2_Signitures.bmp
- %PROGRAM_FILES%\otshot\signatures\4_Signitures.bmp
- %PROGRAM_FILES%\otshot\signatures\1_Signitures.bmp
- %PROGRAM_FILES%\otshot\signatures\15_Signitures.bmp
- %PROGRAM_FILES%\otshot\signatures\16_Signitures.bmp
- %PROGRAM_FILES%\otshot\ui\belv\image\thumb_gray_h.bmp
- %PROGRAM_FILES%\otshot\ui\belv\image\thumb_gray_v.bmp
- %PROGRAM_FILES%\otshot\ui\belv\image\tab_v.bmp
- %PROGRAM_FILES%\otshot\ui\belv\image\spin_wmp_h.bmp
- %PROGRAM_FILES%\otshot\ui\belv\image\spin_wmp_v.bmp
- %PROGRAM_FILES%\otshot\ui\belv\image\wround.jpg
- %PROGRAM_FILES%\otshot\UnInstaller.exe
- %PROGRAM_FILES%\otshot\uninstall.ini
- %PROGRAM_FILES%\otshot\iconprog.ico
- %PROGRAM_FILES%\otshot\ShowToWin.exe
- %PROGRAM_FILES%\otshot\otshot.exe
Удаляет следующие файлы:
- %PROGRAM_FILES%\otshot\files.db-journal
- %PROGRAM_FILES%\otshot\hotshot.db-journal
Сетевая активность:
Подключается к:
- 'ot##ot.net':80
TCP:
Запросы HTTP POST:
- ot##ot.net/hsstats2.php
UDP:
- DNS ASK ot##ot.net
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
