Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'kuaikan0' = '%PROGRAM_FILES%\kuaikan\kuaikan0.exe /StartUp'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'FHSpeed' = '%PROGRAM_FILES%\TDJ\TDJSpeed.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'numfirst' = '%PROGRAM_FILES%\numfirst\numfirst.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'ManTray' = '%PROGRAM_FILES%\К±їМФЪПЯ\ManTray.exe'
Изменяет следующие исполняемые системные файлы:
- <SYSTEM32>\stdole2.tlb
Подменяет следующие исполняемые системные файлы:
- <SYSTEM32>\stdole2.tlb файлом <SYSTEM32>\stdole2.tlb.new
Заражает следующие исполняемые файлы:
- <SYSTEM32>\stdole2.tlb.new
- <SYSTEM32>\stdole2.tlb
Вредоносные функции:
Создает и запускает на исполнение:
- '%PROGRAM_FILES%\kuaikan\kuaikan0.exe'
- '%TEMP%\nss5.tmp\setup_qd285.exe'
- '%PROGRAM_FILES%\IntensityControl\IntensityControl.exe' /default
- '%PROGRAM_FILES%\numfirst\numfirst.exe'
- '%PROGRAM_FILES%\К±їМФЪПЯ\ManTray.exe'
- '%PROGRAM_FILES%\К±їМФЪПЯ\mtup.exe' -update
- '%PROGRAM_FILES%\TDJ\TDJSpeed.exe'
- '%PROGRAM_FILES%\К±їМФЪПЯ\mtup.exe' -uploaddata
- '%PROGRAM_FILES%\К±їМФЪПЯ\mtad.exe'
- '%PROGRAM_FILES%\setupX04_062.exe'
- '%PROGRAM_FILES%\sonlinetime_1202.exe'
- '%TEMP%\is-HKOEE.tmp\s1001.tmp' /SL5="$1010A,3858841,119296,%PROGRAM_FILES%\s1001.exe"
- '%PROGRAM_FILES%\s1001.exe'
- '%PROGRAM_FILES%\Setup_030.exe'
- '%PROGRAM_FILES%\LD_2072_S.exe'
- '%TEMP%\is-8SCCN.tmp\Setup_030.tmp' /SL5="$1010C,1290468,118784,%PROGRAM_FILES%\Setup_030.exe"
- '%PROGRAM_FILES%\IFoxInstall-y-c203946779-run-s-x.exe'
- '%PROGRAM_FILES%\setup_qd285.exe'
- '%PROGRAM_FILES%\setupX_2001_162.exe'
- '%TEMP%\nss5.tmp\setup_qd285.exe' (загружен из сети Интернет)
Запускает на исполнение:
- '<SYSTEM32>\regsvr32.exe' /s "%PROGRAM_FILES%\TDJ\Taodijia.dll"
- '<SYSTEM32>\taskkill.exe' /f /im TDJSpeed.exe
Изменения в файловой системе:
Создает следующие файлы:
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\9їй9°ьУК_.url
- %HOMEPATH%\Desktop\Internet 9їй9°ьУК.lnk
- %HOMEPATH%\Start Menu\Programs\ББ¶ИµчЅЪ\ББ¶ИµчЅЪ.lnk
- %PROGRAM_FILES%\numfirst\numfirst.url
- <SYSTEM32>\MSCOMCT2.OCX
- %PROGRAM_FILES%\kuaikan\32.ico
- %PROGRAM_FILES%\kuaikan\playlist.xml
- %PROGRAM_FILES%\kuaikan\loading.gif
- %HOMEPATH%\Desktop\Internet Etoutiao.lnk
- %PROGRAM_FILES%\К±їМФЪПЯ\resources\CityList.xml
- %TEMP%\nsvA.tmp\System.dll
- %PROGRAM_FILES%\К±їМФЪПЯ\Uninstall.exe
- %PROGRAM_FILES%\kuaikan\їмїґКУЖµдЇААЖч.url
- %HOMEPATH%\Start Menu\Programs\їмїґКУЖµдЇААЖч\Uninstall.lnk
- %PROGRAM_FILES%\К±їМФЪПЯ\XCGUId.dll
- %PROGRAM_FILES%\К±їМФЪПЯ\setup.ini
- %PROGRAM_FILES%\numfirst\uninst.exe
- <SYSTEM32>\MSCOMM32.OCX
- <SYSTEM32>\MSCC2CHS.DLL
- <SYSTEM32>\MSCOMCHS.DLL
- %PROGRAM_FILES%\К±їМФЪПЯ\mtad.exe
- %PROGRAM_FILES%\numfirst\parameter.ini
- %PROGRAM_FILES%\numfirst\32.ico
- <SYSTEM32>\MSCOMCTL.OCX
- <SYSTEM32>\MSCMCCHS.DLL
- %PROGRAM_FILES%\К±їМФЪПЯ\ManTraySetDlg\tabSoundSettings.xml
- %HOMEPATH%\Start Menu\Programs\ЅсИХРВОЕ\ЅсИХРВОЕ.lnk
- %PROGRAM_FILES%\К±їМФЪПЯ\ManTraySetDlg\tabTimeSettings.xml
- %HOMEPATH%\Desktop\ЅсИХРВОЕ.lnk
- %PROGRAM_FILES%\К±їМФЪПЯ\ManTraySetDlg\tabWeatherSettings.xml
- %HOMEPATH%\Desktop\їмїґКУЖµ дЇААЖч.lnk
- %PROGRAM_FILES%\Internet Explorer\4.ico
- %PROGRAM_FILES%\К±їМФЪПЯ\PopWinParam.xml
- %PROGRAM_FILES%\kuaikan\parameter.ini
- <SYSTEM32>\SubclassingSink.tlb
- %PROGRAM_FILES%\К±їМФЪПЯ\mtup.exe
- %PROGRAM_FILES%\К±їМФЪПЯ\mtset.exe
- %HOMEPATH%\Start Menu\Programs\їмїґКУЖµдЇААЖч\їмїґКУЖµдЇААЖч.lnk
- %PROGRAM_FILES%\Internet Explorer\2.ico
- %TEMP%\nsq7.tmp\System.dll
- %PROGRAM_FILES%\kuaikan\uninst.exe
- %PROGRAM_FILES%\TDJ\skin\default2\is-H0MUE.tmp
- %PROGRAM_FILES%\TDJ\skin\default2\is-FCGCM.tmp
- %TEMP%\is-EQBLQ.tmp\is-UDFRE.tmp
- %TEMP%\is-EQBLQ.tmp\is-URAAK.tmp
- %TEMP%\is-EQBLQ.tmp\is-S0D1J.tmp
- %PROGRAM_FILES%\TDJ\skin\default2\is-AKH0H.tmp
- %PROGRAM_FILES%\TDJ\skin\default2\is-JO80P.tmp
- %PROGRAM_FILES%\TDJ\skin\default2\is-F3TQK.tmp
- %PROGRAM_FILES%\TDJ\skin\default2\is-GJM46.tmp
- %PROGRAM_FILES%\TDJ\skin\default2\is-EU55B.tmp
- %PROGRAM_FILES%\TDJ\unins000.dat
- %PROGRAM_FILES%\TDJ\unins000.msg
- %WINDIR%\RGID.tmp
- %PROGRAM_FILES%\TDJ\Taodijia64.dll
- %TEMP%\is-EQBLQ.tmp\Taodijia64.dll
- %PROGRAM_FILES%\TDJ\is-7U7DL.tmp
- %TEMP%\is-EQBLQ.tmp\is-H1TB3.tmp
- %TEMP%\is-EQBLQ.tmp\is-KSORM.tmp
- %PROGRAM_FILES%\TDJ\is-PAF5A.tmp
- %TEMP%\is-EQBLQ.tmp\is-EJJ82.tmp
- %PROGRAM_FILES%\TDJ\is-C0T0L.tmp
- %PROGRAM_FILES%\TDJ\is-V7SQH.tmp
- %PROGRAM_FILES%\TDJ\is-KVLNE.tmp
- %PROGRAM_FILES%\TDJ\is-RULP5.tmp
- %PROGRAM_FILES%\TDJ\is-32G2M.tmp
- %TEMP%\nss5.tmp\setup_qd285.gif.partial
- %TEMP%\tmpSKZXSteup.zip
- %PROGRAM_FILES%\К±їМФЪПЯ\ManTray.exe
- %PROGRAM_FILES%\TDJ\is-2IQRI.tmp
- %PROGRAM_FILES%\К±їМФЪПЯ\ManTrayDll.dll
- %PROGRAM_FILES%\TDJ\skin\default2\is-5HM8H.tmp
- %PROGRAM_FILES%\TDJ\skin\default2\is-B7J2K.tmp
- %PROGRAM_FILES%\TDJ\skin\default2\is-9ULSD.tmp
- %PROGRAM_FILES%\TDJ\skin\default2\is-2P9NL.tmp
- %PROGRAM_FILES%\TDJ\skin\default2\is-E2AET.tmp
- %PROGRAM_FILES%\TDJ\skin\default2\is-7LBQF.tmp
- %PROGRAM_FILES%\TDJ\skin\default2\is-OO40L.tmp
- %PROGRAM_FILES%\TDJ\skin\default2\is-5PU0O.tmp
- %PROGRAM_FILES%\TDJ\skin\default2\is-H85UG.tmp
- %PROGRAM_FILES%\TDJ\skin\default2\is-2POQG.tmp
- %PROGRAM_FILES%\К±їМФЪПЯ\ManTraySetDlg\images\close.png
- %TEMP%\nsh4.tmp
- %TEMP%\is-42IL7.tmp\_isetup\_shfoldr.dll
- %PROGRAM_FILES%\IntensityControl\IntensityControlPag.exe
- %PROGRAM_FILES%\IntensityControl\IntensityControlMonitor.dll
- %PROGRAM_FILES%\IntensityControl\IntensityControl64.dll
- %PROGRAM_FILES%\К±їМФЪПЯ\license.txt
- %PROGRAM_FILES%\IntensityControl\IntensityControlAut.dll
- %PROGRAM_FILES%\IntensityControl\IntensityControlCom.exe
- %PROGRAM_FILES%\К±їМФЪПЯ\ManTraySetDlg\images\button.png
- %TEMP%\nss5.tmp\metadl.dll
- %TEMP%\is-42IL7.tmp\webctrl.dll
- %PROGRAM_FILES%\IntensityControl\IntensityControlUp.exe
- %PROGRAM_FILES%\IntensityControl\unrar.dll
- %TEMP%\is-42IL7.tmp\CallbackCtrl.dll
- %TEMP%\nss5.tmp\System.dll
- %TEMP%\is-42IL7.tmp\ItDownload.dll
- %TEMP%\is-42IL7.tmp\WSysInfo.dll
- %PROGRAM_FILES%\IntensityControl\IntensityControlSer.exe
- %PROGRAM_FILES%\К±їМФЪПЯ\ManTraySetDlg\images\question.png
- %PROGRAM_FILES%\setupX04_062.exe
- %PROGRAM_FILES%\setupX_2001_162.exe
- %PROGRAM_FILES%\sonlinetime_1202.exe
- %TEMP%\nsb2.tmp\Auto.ini
- %TEMP%\nsb2.tmp\System.dll
- %PROGRAM_FILES%\LD_2072_S.exe
- %PROGRAM_FILES%\IFoxInstall-y-c203946779-run-s-x.exe
- %PROGRAM_FILES%\s1001.exe
- %PROGRAM_FILES%\setup_qd285.exe
- %PROGRAM_FILES%\Setup_030.exe
- %PROGRAM_FILES%\IntensityControl\IntensityControl.dat
- %TEMP%\tmpSKZXComm.zip
- %PROGRAM_FILES%\IntensityControl\IntensityControl.dll
- %PROGRAM_FILES%\IntensityControl\IntensityControl64.dat
- %PROGRAM_FILES%\IntensityControl\IntensityControl.exe
- %TEMP%\is-HKOEE.tmp\s1001.tmp
- %TEMP%\nsb2.tmp\FindProcDLL.dll
- %PROGRAM_FILES%\IntensityControl\IntensityControlIn.dll
- %TEMP%\is-8SCCN.tmp\Setup_030.tmp
- %PROGRAM_FILES%\IntensityControl\IntensityControlCo.dll
- %TEMP%\is-42IL7.tmp\botva2.dll
- %ALLUSERSPROFILE%\Application Data\IntensityControl\copyfile.ini
- %ALLUSERSPROFILE%\Application Data\IntensityControl\controler.ini
- %PROGRAM_FILES%\К±їМФЪПЯ\ManTraySetDlg\images\set_line.png
- %ALLUSERSPROFILE%\Application Data\IntensityControl\softset.ini
- %ALLUSERSPROFILE%\Application Data\IntensityControl\defaultupdate.ini
- %PROGRAM_FILES%\IntensityControl\MSGBoxSkin\UI\yes_button.png
- %PROGRAM_FILES%\IntensityControl\MSGBoxSkin\UI\warning.png
- %TEMP%\nsu9.tmp
- %ALLUSERSPROFILE%\Application Data\IntensityControl\calendar.ini
- %ALLUSERSPROFILE%\Application Data\IntensityControl\City.xml
- %PROGRAM_FILES%\К±їМФЪПЯ\ManTraySetDlg\resource.res
- %PROGRAM_FILES%\К±їМФЪПЯ\ManTraySetDlg\mainFrame.xml
- %PROGRAM_FILES%\К±їМФЪПЯ\ManTraySetDlg\style.css
- %PROGRAM_FILES%\К±їМФЪПЯ\ManTraySetDlg\tabOtherSettings.xml
- %PROGRAM_FILES%\К±їМФЪПЯ\ManTraySetDlg\tabGeneralSettings.xml
- %ALLUSERSPROFILE%\Application Data\IntensityControl\vacation.ini
- %ALLUSERSPROFILE%\Application Data\IntensityControl\sysconfig.ini
- %PROGRAM_FILES%\IntensityControl\uninst.exe
- %PROGRAM_FILES%\К±їМФЪПЯ\ManTraySetDlg\images\set_right.png
- %PROGRAM_FILES%\kuaikan\kuaikan0.exe
- <SYSTEM32>\VB6STKIT.DLL
- %PROGRAM_FILES%\IntensityControl\MSGBoxSkin\UI\delete.png
- %PROGRAM_FILES%\IntensityControl\MSGBoxSkin\UI\error.png
- %PROGRAM_FILES%\IntensityControl\MSGBoxSkin\UI\infomation.png
- %PROGRAM_FILES%\IntensityControl\MSGBoxSkin\UI\faild.png
- %PROGRAM_FILES%\К±їМФЪПЯ\ManTraySetDlg\images\set_bk.png
- %PROGRAM_FILES%\IntensityControl\MSGBoxSkin\MSGBoxSkin.ini
- %TEMP%\is-EQBLQ.tmp\_isetup\_shfoldr.dll
- %PROGRAM_FILES%\IntensityControl\MSGBoxSkin\UI\cancel-button.png
- %PROGRAM_FILES%\IntensityControl\MSGBoxSkin\UI\bg_top.png
- %PROGRAM_FILES%\IntensityControl\MSGBoxSkin\UI\retry_button.png
- %PROGRAM_FILES%\IntensityControl\MSGBoxSkin\UI\question.png
- %PROGRAM_FILES%\IntensityControl\MSGBoxSkin\UI\stop_button.png
- %PROGRAM_FILES%\IntensityControl\MSGBoxSkin\UI\success.png
- %TEMP%\is-EQBLQ.tmp\Taodijia.dll
- <SYSTEM32>\VB6CHS.DLL
- %PROGRAM_FILES%\К±їМФЪПЯ\ManTraySetDlg\images\set_Common.png
- %PROGRAM_FILES%\IntensityControl\MSGBoxSkin\UI\no_button.png
- %PROGRAM_FILES%\numfirst\numfirst.exe
- %PROGRAM_FILES%\IntensityControl\MSGBoxSkin\UI\ok_button.png
Удаляет следующие файлы:
- %TEMP%\is-EQBLQ.tmp\manifest.json
- %TEMP%\is-EQBLQ.tmp\external_extensions.json
- %TEMP%\is-EQBLQ.tmp\icon.png
- %TEMP%\is-EQBLQ.tmp\icon-128.png
- %TEMP%\is-EQBLQ.tmp\inst1.txt
- %TEMP%\is-EQBLQ.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-8SCCN.tmp\Setup_030.tmp
- %TEMP%\is-EQBLQ.tmp\Taodijia.dll
- %TEMP%\is-EQBLQ.tmp\Taodijia64.dll
- %TEMP%\tmpSKZXComm.zip
- %TEMP%\tmpSKZXSteup.zip
- %PROGRAM_FILES%\IntensityControl\IntensityControl64.dat
- %PROGRAM_FILES%\IntensityControl\IntensityControl64.dll
- %TEMP%\nss5.tmp\metadl.dll
- %PROGRAM_FILES%\TDJ\TDJSpeed.exe
- %TEMP%\is-EQBLQ.tmp\content.js
- %TEMP%\nss5.tmp\setup_qd285.exe
- %TEMP%\nss5.tmp\System.dll
Перемещает следующие файлы:
- %PROGRAM_FILES%\TDJ\skin\default2\is-EU55B.tmp в %PROGRAM_FILES%\TDJ\skin\default2\set_close.imageset
- %PROGRAM_FILES%\TDJ\skin\default2\is-F3TQK.tmp в %PROGRAM_FILES%\TDJ\skin\default2\set_btn.imageset
- %PROGRAM_FILES%\TDJ\skin\default2\is-FCGCM.tmp в %PROGRAM_FILES%\TDJ\skin\default2\sys_icon.imageset
- %PROGRAM_FILES%\TDJ\skin\default2\is-GJM46.tmp в %PROGRAM_FILES%\TDJ\skin\default2\set_icon.imageset
- %PROGRAM_FILES%\TDJ\skin\default2\is-2P9NL.tmp в %PROGRAM_FILES%\TDJ\skin\default2\notice_bg.imageset
- %PROGRAM_FILES%\TDJ\skin\default2\is-E2AET.tmp в %PROGRAM_FILES%\TDJ\skin\default2\mini_view.imageset
- %PROGRAM_FILES%\TDJ\skin\default2\is-AKH0H.tmp в %PROGRAM_FILES%\TDJ\skin\default2\set_bg.imageset
- %PROGRAM_FILES%\TDJ\skin\default2\is-JO80P.tmp в %PROGRAM_FILES%\TDJ\skin\default2\notice_icon.imageset
- %PROGRAM_FILES%\TDJ\skin\default2\is-H0MUE.tmp в %PROGRAM_FILES%\TDJ\skin\default2\toolbar_icon.imageset
- %TEMP%\is-EQBLQ.tmp\is-KSORM.tmp в %TEMP%\is-EQBLQ.tmp\external_extensions.json
- %PROGRAM_FILES%\TDJ\is-7U7DL.tmp в %PROGRAM_FILES%\TDJ\logid.txt
- %PROGRAM_FILES%\TDJ\is-PAF5A.tmp в %PROGRAM_FILES%\TDJ\Taodijia.dll
- %TEMP%\is-EQBLQ.tmp\is-EJJ82.tmp в %TEMP%\is-EQBLQ.tmp\inst1.txt
- %TEMP%\is-EQBLQ.tmp\is-S0D1J.tmp в %TEMP%\is-EQBLQ.tmp\icon.png
- %TEMP%\is-EQBLQ.tmp\is-UDFRE.tmp в %TEMP%\is-EQBLQ.tmp\content.js
- %TEMP%\is-EQBLQ.tmp\is-H1TB3.tmp в %TEMP%\is-EQBLQ.tmp\manifest.json
- %TEMP%\is-EQBLQ.tmp\is-URAAK.tmp в %TEMP%\is-EQBLQ.tmp\icon-128.png
- %PROGRAM_FILES%\TDJ\is-C0T0L.tmp в %PROGRAM_FILES%\TDJ\TDJSpeed.exe
- %PROGRAM_FILES%\TDJ\is-V7SQH.tmp в %PROGRAM_FILES%\TDJ\TDJSpeed.exe
- %PROGRAM_FILES%\TDJ\is-32G2M.tmp в %PROGRAM_FILES%\TDJ\urls2.config
- %PROGRAM_FILES%\TDJ\is-KVLNE.tmp в %PROGRAM_FILES%\TDJ\config2.ini
- %TEMP%\nss5.tmp\setup_qd285.gif.partial в %TEMP%\nss5.tmp\setup_qd285.gif
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\9їй9°ьУК_.url в %APPDATA%\Microsoft\Internet Explorer\Quick Launch\9їй9°ьУК.url
- %PROGRAM_FILES%\TDJ\is-2IQRI.tmp в %PROGRAM_FILES%\TDJ\unins000.exe
- %TEMP%\nss5.tmp\setup_qd285.gif в %TEMP%\nss5.tmp\setup_qd285.exe
- %PROGRAM_FILES%\TDJ\is-RULP5.tmp в %PROGRAM_FILES%\TDJ\self.ico
- %PROGRAM_FILES%\TDJ\skin\default2\is-B7J2K.tmp в %PROGRAM_FILES%\TDJ\skin\default2\mainframe_bg.imageset
- %PROGRAM_FILES%\TDJ\skin\default2\is-H85UG.tmp в %PROGRAM_FILES%\TDJ\skin\default2\index.schema
- %PROGRAM_FILES%\TDJ\skin\default2\is-9ULSD.tmp в %PROGRAM_FILES%\TDJ\skin\default2\mini_close.imageset
- %PROGRAM_FILES%\TDJ\skin\default2\is-5HM8H.tmp в %PROGRAM_FILES%\TDJ\skin\default2\mini_bg.imageset
- %PROGRAM_FILES%\TDJ\skin\default2\is-7LBQF.tmp в %PROGRAM_FILES%\TDJ\skin\default2\about_btn.imageset
- %PROGRAM_FILES%\TDJ\skin\default2\is-OO40L.tmp в %PROGRAM_FILES%\TDJ\skin\default2\about_bg.imageset
- %PROGRAM_FILES%\TDJ\skin\default2\is-2POQG.tmp в %PROGRAM_FILES%\TDJ\skin\default2\check_btn.imageset
- %PROGRAM_FILES%\TDJ\skin\default2\is-5PU0O.tmp в %PROGRAM_FILES%\TDJ\skin\default2\about_close.imageset
Сетевая активность:
Подключается к:
- 'localhost':1041
- 'localhost':1044
- 'localhost':1045
- 'do##.guangsu.cn':80
- 'localhost':1037
- 'localhost':1040
TCP:
Запросы HTTP GET:
- do##.guangsu.cn/qdn/setup_qd285.gif
UDP:
- DNS ASK up####.657080.com
- DNS ASK ha#.43.cn
- DNS ASK cl####.035668.com
- DNS ASK to#.#7663.com
- DNS ASK p2#.##.sohu.com.cn
- DNS ASK xc.#a98.com
- DNS ASK cl####.180308.com
- DNS ASK ph#####n.hd.sohu.com
- DNS ASK up####.redshu.com
- DNS ASK do##.guangsu.cn
- DNS ASK tj.##7080.com
- DNS ASK v.#3.cn
- DNS ASK to####.toutiao001.com
- DNS ASK ne##.#outiao001.com
Другое:
Ищет следующие окна:
- ClassName: 'MS_AutodialMonitor' WindowName: '(null)'
- ClassName: '(null)' WindowName: '(null)'
- ClassName: 'MS_WebcheckMonitor' WindowName: '(null)'
- ClassName: 'Indicator' WindowName: '(null)'
- ClassName: 'SysListView32' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'EDIT' WindowName: '(null)'
- ClassName: 'IntensityControl' WindowName: 'IntensityControl'
- ClassName: 'TrayClockWClass' WindowName: '(null)'
- ClassName: 'TrayNotifyWnd' WindowName: ''
