Technical Information
To ensure autorun and distribution:
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Diskeeper] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\Diskeeper] 'ImagePath' = '"%ProgramFiles%\Diskeeper Corporation\Diskeeper\DkService.exe"'
- [<HKLM>\SYSTEM\ControlSet001\Services\DKRtWrt] 'ImagePath' = 'system32\DRIVERS\DKRtWrt.sys'
Malicious functions:
Executes the following:
- '<SYSTEM32>\net.exe' stop Diskeeper
Modifies file system:
Creates the following files:
- %TEMP%\RarSFX0\Autorun.exe
- %ProgramFiles%\Diskeeper Corporation\Diskeeper\Diskeeper.adm
- %ProgramFiles%\Diskeeper Corporation\Diskeeper\Diskeeper.adml
- %ProgramFiles%\Diskeeper Corporation\Diskeeper\Diskeeper.admx
- %ProgramFiles%\Diskeeper Corporation\Diskeeper\DKLib.dll
- %ProgramFiles%\Diskeeper Corporation\Diskeeper\DkMsg.dll
- %ProgramFiles%\Diskeeper Corporation\Diskeeper\DkPerf.exe
- %ProgramFiles%\Diskeeper Corporation\Diskeeper\DkService.exe
- %ProgramFiles%\Diskeeper Corporation\Diskeeper\Exclude.ctl
- %ProgramFiles%\Diskeeper Corporation\Diskeeper\DkTabProvider.dll
- %ProgramFiles%\Diskeeper Corporation\Diskeeper\dka.LMF
- %ProgramFiles%\Diskeeper Corporation\Diskeeper\Diskeeper.msc
- %ProgramFiles%\Diskeeper Corporation\Diskeeper\tab_1.dat
- %ProgramFiles%\Diskeeper Corporation\Diskeeper\PrFacade.dll
- %ProgramFiles%\Diskeeper Corporation\Diskeeper\setdkacls.bat
- %ProgramFiles%\Diskeeper Corporation\Diskeeper\DkServiceMsg.exe
- %ProgramFiles%\Diskeeper Corporation\Diskeeper\AppLauncher.exe
- %ProgramFiles%\Diskeeper Corporation\Diskeeper\config.xml
- %ProgramFiles%\Diskeeper Corporation\Diskeeper\Diskeeper.exe
- %ProgramFiles%\Diskeeper Corporation\Diskeeper\AutoNTFS.exe
- %ProgramFiles%\Diskeeper Corporation\Diskeeper\AutoFAT.exe
- %ProgramFiles%\Diskeeper Corporation\Diskeeper\NsNtfsEgFSConsolidate.dll
- %ProgramFiles%\Diskeeper Corporation\Diskeeper\NsNtfsJIT.dll
- %ProgramFiles%\Diskeeper Corporation\Diskeeper\NsNtfsFSConsolidate.dll
- %ProgramFiles%\Diskeeper Corporation\Diskeeper\NsFatFSConsolidate.dll
- %ProgramFiles%\Diskeeper Corporation\Diskeeper\NsNtfsSSDAnalysis.dll
- %ProgramFiles%\Diskeeper Corporation\Diskeeper\NsFatSSDAnalysis.dll
- %ProgramFiles%\Diskeeper Corporation\Diskeeper\NsNtfsTVE-Ex.dll
- %ProgramFiles%\Diskeeper Corporation\Diskeeper\NsFatSSDdefrag.dll
- %ProgramFiles%\Diskeeper Corporation\Diskeeper\NsNtfsSSDdefrag.dll
- %ProgramFiles%\Diskeeper Corporation\Diskeeper\DfrgSnap.dll
- %ProgramFiles%\Diskeeper Corporation\Diskeeper\Tab.dll
- %TEMP%\~10.tmp
- %ProgramFiles%\Diskeeper Corporation\Diskeeper\ExcAll.dat
- %WINDIR%\Installer\MSI22.tmp
- <SYSTEM32>\DRVSTORE\DKRtWrt_FE42A1D8379529E4AD0C21E8B4B3401788F92230\DKRtWrt.sys
- <DRIVERS>\SET18.tmp
- %WINDIR%\Installer\{3193FAB1-1A72-4677-8C62-523731349C1C}\ARPPRODUCTICON.exe
- %WINDIR%\Installer\{3193FAB1-1A72-4677-8C62-523731349C1C}\DiskeeperShortcut.exe
- %WINDIR%\Installer\MSI19.tmp
- %WINDIR%\Installer\MSI1B.tmp
- %WINDIR%\Installer\MSI1D.tmp
- %ProgramFiles%\Diskeeper Corporation\Diskeeper\DkDecoupledProvider.mof
- %WINDIR%\Installer\MSI1E.tmp
- %TEMP%\tmp1F.tmp
- <SYSTEM32>\wbem\AutoRecover\29715E907D2397DB1968ACDA766DA2CC.mof
- %WINDIR%\Installer\MSI20.tmp
- %WINDIR%\Installer\MSI21.tmp
- %ProgramFiles%\Diskeeper Corporation\Diskeeper\Controller.log
- <SYSTEM32>\DRVSTORE\DKRtWrt_FE42A1D8379529E4AD0C21E8B4B3401788F92230\DKRtWrt.cat
- <SYSTEM32>\DRVSTORE\DKRtWrt_FE42A1D8379529E4AD0C21E8B4B3401788F92230\DKRtWrt.inf
- %ProgramFiles%\Diskeeper Corporation\Diskeeper\DkWMIClient.exe
- %WINDIR%\Help\Diskeeper.chm
- %WINDIR%\Installer\MSI17.tmp
- %WINDIR%\Installer\2bd7e.msi
- %WINDIR%\Installer\MSI16.tmp
- %WINDIR%\Installer\MSI15.tmp
- %ALLUSERSPROFILE%\Start Menu\Programs\Diskeeper Corporation\Diskeeper 2011.lnk
- %ProgramFiles%\Diskeeper Corporation\Diskeeper\Connect.exe
- %WINDIR%\inf\DKRtWrt.inf
- %ProgramFiles%\Diskeeper Corporation\Diskeeper\NsNtfsLfsDfrg.dll
- %WINDIR%\Installer\$PatchCache$\Managed\1BAF391327A17764C82625731343C9C1\15.0.952\F_CENTRAL_msvcr100_x86.DF495DFD_79F6_34DF_BB1E_E58DB5BDCF2C
- %ProgramFiles%\Diskeeper Corporation\Diskeeper\HyperFast TW30.DAL
- %ProgramFiles%\Diskeeper Corporation\Diskeeper\Pro TW30.DAL
- %CommonProgramFiles%\Diskeeper Corporation\MJS\MJSCR.dll
- %ProgramFiles%\Diskeeper Corporation\Diskeeper\MJS.dll
- %WINDIR%\Installer\$PatchCache$\Managed\1BAF391327A17764C82625731343C9C1\15.0.952\F_CENTRAL_msvcp100_x86.DF495DFD_79F6_34DF_BB1E_E58DB5BDCF2C
- %ProgramFiles%\Diskeeper Corporation\Diskeeper\NsNtfsAnalyze.dll
- %ProgramFiles%\Diskeeper Corporation\Diskeeper\NsIfaastMeas.dll
- %ProgramFiles%\Diskeeper Corporation\Diskeeper\NsFatStd.dll
- %WINDIR%\Installer\MSIC.tmp
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\ComDb.Dat
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SAM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SYSTEM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SOFTWARE
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SECURITY
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_.DEFAULT
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18
- %WINDIR%\Installer\MSID.tmp
- %WINDIR%\Installer\MSIA.tmp
- %TEMP%\MSI4.tmp
- %WINDIR%\Installer\2bd7a.msi
- %TEMP%\MSI9.tmp
- %TEMP%\_is8.tmp
- %TEMP%\MSI7.tmp
- %TEMP%\MSI6.tmp
- %TEMP%\MSI5.tmp
- %WINDIR%\Temp\Perflib_Perfdata_d70.dat
- %TEMP%\MSI3.tmp
- %TEMP%\DLL_{3193FAB1-1A72-4677-8C62-523731349C1C}.ini
- %TEMP%\MSI1.tmp
- %TEMP%\283ad.msi
- %TEMP%\RarSFX1\Diskeeper 2011.msi
- %TEMP%\RarSFX0\X86\setup.exe
- %TEMP%\RarSFX0\X64\setup.exe
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\$WinMgmt.CFG
- %WINDIR%\Installer\MSI1C.tmp
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.BTR
- %ProgramFiles%\Diskeeper Corporation\Diskeeper\2052\DkRes.dll
- %ProgramFiles%\Diskeeper Corporation\Diskeeper\NsNtfsIfaast.dll
- %ProgramFiles%\Diskeeper Corporation\Diskeeper\DfrgUI.dll
- %ProgramFiles%\Diskeeper Corporation\Diskeeper\NsFatAnalyze.dll
- %ProgramFiles%\Diskeeper Corporation\Diskeeper\NsFatAutoAnalyze.dll
- %ProgramFiles%\Diskeeper Corporation\Diskeeper\NsNtfsAutoAnalyze.dll
- %ProgramFiles%\Diskeeper Corporation\Diskeeper\NsNtfsBootOptimization.dll
- %ProgramFiles%\Diskeeper Corporation\Diskeeper\NsNtfsDirConsolidate.dll
- %ProgramFiles%\Diskeeper Corporation\Diskeeper\NsNtfsManual.dll
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\domain.txt
- %ProgramFiles%\Diskeeper Corporation\Diskeeper\NsNtfsPartialDefrag.dll
- %ProgramFiles%\Diskeeper Corporation\Diskeeper\NsNtfsStd.dll
- %ProgramFiles%\Diskeeper Corporation\Diskeeper\NsNtfsTve.dll
- %ProgramFiles%\Diskeeper Corporation\Diskeeper\NsFatBootOptimization.dll
- %ProgramFiles%\Diskeeper Corporation\Diskeeper\NsFatManual.dll
- %ProgramFiles%\Diskeeper Corporation\Diskeeper\NsFatPartialDefrag.dll
- %ProgramFiles%\Diskeeper Corporation\Diskeeper\DKRtWrt\DKRtWrt.sys
- %ProgramFiles%\Diskeeper Corporation\Diskeeper\DKRtWrt\DKRtWrt.cat
- %ProgramFiles%\Diskeeper Corporation\Diskeeper\Diskeeper.chm
- %WINDIR%\Installer\MSI14.tmp
- %WINDIR%\Installer\MSI13.tmp
- C:\Config.Msi\2bd7c.rbs
- %WINDIR%\Installer\MSI11.tmp
- %WINDIR%\Installer\MSIF.tmp
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.MAP
- %WINDIR%\Installer\2bd7b.ipi
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.DATA
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING2.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING1.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING.VER
- %ProgramFiles%\Diskeeper Corporation\Diskeeper\DKRtWrt\DKRtWrt.inf
- %WINDIR%\Installer\MSIE.tmp
- %WINDIR%\Installer\MSI23.tmp
Sets the 'hidden' attribute to the following files:
- C:\Config.Msi\2bd7d.rbf
Deletes the following files:
- %TEMP%\MSI1.tmp
- %WINDIR%\Installer\MSI17.tmp
- %WINDIR%\Installer\MSI19.tmp
- %WINDIR%\Installer\MSIE.tmp
- C:\Config.Msi\2bd7d.rbf
- C:\Config.Msi\2bd7c.rbs
- %TEMP%\~10.tmp
- %WINDIR%\Installer\MSI1C.tmp
- %ProgramFiles%\Diskeeper Corporation\Diskeeper\Pro TW30.DAL
- %WINDIR%\Installer\MSI1D.tmp
- %TEMP%\tmp1F.tmp
- %WINDIR%\Installer\MSI1E.tmp
- %WINDIR%\Installer\MSI20.tmp
- %WINDIR%\Installer\MSI21.tmp
- %ProgramFiles%\Diskeeper Corporation\Diskeeper\HyperFast TW30.DAL
- %WINDIR%\Installer\MSI16.tmp
- %WINDIR%\Installer\MSI1B.tmp
- %WINDIR%\Installer\MSI15.tmp
- %TEMP%\MSI9.tmp
- %TEMP%\MSI3.tmp
- %TEMP%\MSI4.tmp
- %TEMP%\MSI5.tmp
- %TEMP%\MSI6.tmp
- %TEMP%\_is8.tmp
- %TEMP%\MSI7.tmp
- %TEMP%\RarSFX0\Autorun.exe
- %WINDIR%\Installer\MSI13.tmp
- %TEMP%\RarSFX0\X86\setup.exe
- %WINDIR%\Installer\MSIA.tmp
- %WINDIR%\Installer\MSIC.tmp
- %WINDIR%\Installer\MSID.tmp
- %WINDIR%\Installer\MSIF.tmp
- %WINDIR%\Installer\MSI11.tmp
- %WINDIR%\Installer\MSI14.tmp
- %WINDIR%\Installer\MSI22.tmp
Moves the following files:
- from %ProgramFiles%\Diskeeper Corporation\Diskeeper\DKRtWrt\DKRtWrt.inf to C:\Config.Msi\2bd7d.rbf
- from <DRIVERS>\SET18.tmp to <DRIVERS>\DKRtWrt.sys
Substitutes the following files:
- %ProgramFiles%\Diskeeper Corporation\Diskeeper\DKRtWrt\DKRtWrt.inf
Miscellaneous:
Searches for the following windows:
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following:
- '%TEMP%\RarSFX0\Autorun.exe'
- '%TEMP%\RarSFX0\X86\setup.exe'
- '%ProgramFiles%\Diskeeper Corporation\Diskeeper\DkService.exe'
Executes the following:
- '<SYSTEM32>\msiexec.exe' /i "%TEMP%\RarSFX1\Diskeeper 2011.msi" /qr /norestart
- '<SYSTEM32>\msiexec.exe' /V
- '<SYSTEM32>\msiexec.exe' -Embedding DC86DCA1290E3332BC8D1253A4565A6E C
- '<SYSTEM32>\cmd.exe' /C copy /Y "*.DAL" "%WINDIR%\Installer\"
- '<SYSTEM32>\cmd.exe' /C copy /Y "\*.DAL" "%WINDIR%\Installer\"
- '<SYSTEM32>\msiexec.exe' -Embedding 8CDFD0C086C1C1C45289C227B71C3415
- '<SYSTEM32>\net1.exe' stop Diskeeper
- '<SYSTEM32>\msiexec.exe' -Embedding 038EDB2931EF855EB13CCEB6BADDD9C9 M Global\MSI0000
- '<SYSTEM32>\regsvr32.exe' "%ProgramFiles%\Diskeeper Corporation\Diskeeper\DfrgSnap.dll" /s
- '<SYSTEM32>\wbem\mofcomp.exe' "%ProgramFiles%\Diskeeper Corporation\Diskeeper\DkDecoupledProvider.mof"
- '<SYSTEM32>\sc.exe' config Diskeeper start= delayed-auto
- '<SYSTEM32>\net.exe' start Diskeeper
- '<SYSTEM32>\net1.exe' start Diskeeper
- '<SYSTEM32>\cmd.exe' /C move /Y "%ALLUSERSPROFILE%\Start Menu\Programs\\??\????\????????.lnk" "%ProgramFiles%\Diskeeper Corporation\Diskeeper\"