Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\top.exe] 'Debugger' = 'C:\iexplor.bat'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zhinanzhenbrowser.exe] 'Debugger' = 'C:\iexplor.bat'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avant.exe] 'Debugger' = 'C:\iexplor.bat'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Iparmor.exe] 'Debugger' = '<SYSTEM32>\ruixing.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hsreg.exe] 'Debugger' = '<SYSTEM32>\ruixing.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\XWebStar.exe] 'Debugger' = 'C:\iexplor.bat'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SaaYaa.exe] 'Debugger' = 'C:\iexplor.bat'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MyIE.exe] 'Debugger' = 'C:\iexplor.bat'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\See9IE.exe] 'Debugger' = 'C:\iexplor.bat'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TouchNet.exe] 'Debugger' = 'C:\iexplor.bat'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360safe.exe] 'Debugger' = '<SYSTEM32>\ctfmon.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360safebox.exe] 'Debugger' = '<SYSTEM32>\ctfmon.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kastray.exe] 'Debugger' = '<SYSTEM32>\ctfmon.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360SE.exe] 'Debugger' = 'C:\iexplor.bat'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RSTray.exe] 'Debugger' = '<SYSTEM32>\ctfmon.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe] 'Debugger' = '<SYSTEM32>\ctfmon.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\srgui.exe] 'Debugger' = '<SYSTEM32>\ctfmon.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sriecli.exe] 'Debugger' = '<SYSTEM32>\ctfmon.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ast.exe] 'Debugger' = '<SYSTEM32>\ctfmon.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winpatrol.exe] 'Debugger' = '<SYSTEM32>\ctfmon.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Maxthon.exe] 'Debugger' = 'C:\iexplor.bat'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\opera.exe] 'Debugger' = 'C:\iexplor.bat'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\chrome.exe] 'Debugger' = 'C:\iexplor.bat'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KylinBrowser.exe] 'Debugger' = 'C:\iexplor.bat'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TTraveler.exe] 'Debugger' = 'C:\iexplor.bat'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Runonce] '360sfety' = '%ALLUSERSPROFILE%\Application Data\lq16.com'
- [<HKLM>\SOFTWARE\Classes\HTTP\shell\open\command] '' = '"%PROGRAM_FILES%\Internet Explorer\IEXPLORE" ""'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Runonce] 'runonnce' = '%CommonProgramFiles%\Adobe\start.bat'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\firefox.exe] 'Debugger' = 'C:\iexplor.bat'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\theworld.exe] 'Debugger' = 'C:\iexplor.bat'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IERepair.exe] 'Debugger' = 'C:\iexplor.bat'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iemate.exe] 'Debugger' = 'C:\iexplor.bat'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SogouExplorer.exe] 'Debugger' = 'C:\iexplor.bat'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tango.exe] 'Debugger' = 'C:\iexplor.bat'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GreenBrowser.exe] 'Debugger' = 'C:\iexplor.bat'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MiniIE.exe] 'Debugger' = 'C:\iexplor.bat'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vu.exe] 'Debugger' = 'C:\iexplor.bat'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\suda.exe] 'Debugger' = 'C:\iexplor.bat'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Start.exe] 'Debugger' = 'C:\iexplor.bat'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AdoIE.exe] 'Debugger' = 'C:\iexplor.bat'
Вредоносные функции:
Для затруднения выявления своего присутствия в системе
блокирует отображение:
- скрытых файлов
- расширений файлов
Запускает на исполнение:
- '%WINDIR%\regedit.exe' /s 1123.reg
- '<SYSTEM32>\msiexec.exe' /regserver
- '%WINDIR%\regedit.exe' /s keysh.reg
- '<SYSTEM32>\wscript.exe' "C:\fsfs.vbs"
- '<SYSTEM32>\cmd.exe' /c ""C:\bdr.bat" "
Изменяет следующие настройки проводника Windows (Windows Explorer):
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoInternetIcon' = '00000001'
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %ALLUSERSPROFILE%\Application Data\i\topbg05.gif
- %ALLUSERSPROFILE%\Application Data\i\topbg04.gif
- %ALLUSERSPROFILE%\Application Data\images\funb.js
- %ALLUSERSPROFILE%\Application Data\i\zj_2.gif
- %ALLUSERSPROFILE%\Application Data\i\topbg01.gif
- %ALLUSERSPROFILE%\Application Data\i\srh_5.gif
- %ALLUSERSPROFILE%\Application Data\i\topbg03.gif
- %ALLUSERSPROFILE%\Application Data\i\topbg02.gif
- %ALLUSERSPROFILE%\Application Data\images\gl_1.gif
- C:\Users\All Users\Desktop\买东西就上淘宝网.url
- %CommonProgramFiles%\Adobe\start.bat
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\╞Ї╢п Internet Explorer фп└└╞ў.lnk
- %ALLUSERSPROFILE%\桌面\买东西就上淘宝网.url
- %ALLUSERSPROFILE%\Application Data\images\sd_1.css
- %ALLUSERSPROFILE%\Application Data\images\logo.jpg
- %ALLUSERSPROFILE%\桌面\Internet Explore.lnk
- %ALLUSERSPROFILE%\Application Data\images\srh_1.gif
- C:\keysh.reg
- C:\Internet Explore.lnk
- %ALLUSERSPROFILE%\Application Data\daohang.htm
- C:\1123.reg
- C:\bdr.bat
- C:\Users\All Users\Desktop\Internet Explore.lnk
- C:\iexplor.bat
- C:\fsfs.vbs
- %ALLUSERSPROFILE%\Application Data\i\gl_1.gif
- %ALLUSERSPROFILE%\Application Data\i\srh_2.gif
- %ALLUSERSPROFILE%\Application Data\i\srh_1.gif
- %ALLUSERSPROFILE%\Application Data\i\srh_4.gif
- %ALLUSERSPROFILE%\Application Data\i\srh_3.gif
- %ALLUSERSPROFILE%\Application Data\i\gl_3.gif
- %ALLUSERSPROFILE%\Application Data\i\gl_2.gif
- %ALLUSERSPROFILE%\Application Data\i\gl_5.gif
- %ALLUSERSPROFILE%\Application Data\i\gl_4.gif
Присваивает атрибут 'скрытый' для следующих файлов:
- %ALLUSERSPROFILE%\Application Data\i\topbg04.gif
- %ALLUSERSPROFILE%\Application Data\i\topbg05.gif
- %ALLUSERSPROFILE%\Application Data\i\zj_2.gif
- %ALLUSERSPROFILE%\Application Data\i\topbg01.gif
- %ALLUSERSPROFILE%\Application Data\i\topbg02.gif
- %ALLUSERSPROFILE%\Application Data\i\topbg03.gif
- %ALLUSERSPROFILE%\Application Data\images\sd_1.css
- %ALLUSERSPROFILE%\Application Data\images\srh_1.gif
- %CommonProgramFiles%\Adobe\start.bat
- %ALLUSERSPROFILE%\Application Data\images\funb.js
- %ALLUSERSPROFILE%\Application Data\images\gl_1.gif
- %ALLUSERSPROFILE%\Application Data\images\logo.jpg
- %ALLUSERSPROFILE%\Application Data\i\gl_2.gif
- %ALLUSERSPROFILE%\Application Data\i\gl_3.gif
- %ALLUSERSPROFILE%\Application Data\i\gl_4.gif
- C:\iexplor.bat
- %ALLUSERSPROFILE%\Application Data\daohang.htm
- %ALLUSERSPROFILE%\Application Data\i\gl_1.gif
- %ALLUSERSPROFILE%\Application Data\i\srh_3.gif
- %ALLUSERSPROFILE%\Application Data\i\srh_4.gif
- %ALLUSERSPROFILE%\Application Data\i\srh_5.gif
- %ALLUSERSPROFILE%\Application Data\i\gl_5.gif
- %ALLUSERSPROFILE%\Application Data\i\srh_1.gif
- %ALLUSERSPROFILE%\Application Data\i\srh_2.gif
Удаляет следующие файлы:
- C:\Internet Explore.lnk
- C:\fsfs.vbs
- C:\keysh.reg
- C:\1123.reg
Другое:
Ищет следующие окна:
- ClassName: 'RegEdit_RegEdit' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'EDIT' WindowName: '(null)'
