Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Classes\mbox\Shell\open\command] '' = '"%PROGRAM_FILES%\KWMUSIC\KwMusic.exe" "%1"'
Вредоносные функции:
Для обхода брандмауэра удаляет или модифицирует следующие ключи реестра:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\KWMUSIC\KwMV.exe' = '%PROGRAM_FILES%\KWMUSIC\KwMV.exe:*:Enabled:їбОТMVґ«КдТэЗж'
Создает и запускает на исполнение:
- '<SYSTEM32>\plugins\plu.exe' /S
- '<Текущая директория>\sou.exe'
Запускает на исполнение:
- '<SYSTEM32>\regsvr32.exe' /s "%PROGRAM_FILES%\KWMUSIC\dump.ax"
- '<SYSTEM32>\netsh.exe' firewall add allowedprogram "%PROGRAM_FILES%\KWMUSIC\KwMV.exe" їбОТMVґ«КдТэЗж ENABLE
Изменения в файловой системе:
Создает следующие файлы:
- %PROGRAM_FILES%\KWMUSIC\skin\Д¬ИПЖ¤·ф\close-hover.bmp
- %PROGRAM_FILES%\KWMUSIC\skin\Д¬ИПЖ¤·ф\TreeDirSongList.bmp
- %PROGRAM_FILES%\KWMUSIC\skin\Д¬ИПЖ¤·ф\close-pressed.bmp
- %PROGRAM_FILES%\KWMUSIC\skin\Д¬ИПЖ¤·ф\close-normal.bmp
- %PROGRAM_FILES%\KWMUSIC\skin\Д¬ИПЖ¤·ф\StateDownloading.bmp
- %PROGRAM_FILES%\KWMUSIC\skin\Д¬ИПЖ¤·ф\PlayerBtnMute2Over.bmp
- %PROGRAM_FILES%\KWMUSIC\skin\Д¬ИПЖ¤·ф\PlayerBtnMute2Normal.bmp
- %PROGRAM_FILES%\KWMUSIC\skin\Д¬ИПЖ¤·ф\Right.bmp
- %PROGRAM_FILES%\KWMUSIC\skin\Д¬ИПЖ¤·ф\PlayerSkin.xml
- %PROGRAM_FILES%\KWMUSIC\skin\Д¬ИПЖ¤·ф\mini-normal.bmp
- %PROGRAM_FILES%\KWMUSIC\skin\Д¬ИПЖ¤·ф\mini-hover.bmp
- %PROGRAM_FILES%\KWMUSIC\skin\Д¬ИПЖ¤·ф\next-disable.bmp
- %PROGRAM_FILES%\KWMUSIC\skin\Д¬ИПЖ¤·ф\mini-pressed.bmp
- %PROGRAM_FILES%\KWMUSIC\skin\Д¬ИПЖ¤·ф\last-pressed.bmp
- %PROGRAM_FILES%\KWMUSIC\skin\Д¬ИПЖ¤·ф\last-disable.bmp
- %PROGRAM_FILES%\KWMUSIC\skin\Д¬ИПЖ¤·ф\down-icon.gif
- %PROGRAM_FILES%\KWMUSIC\skin\Д¬ИПЖ¤·ф\last-normal.bmp
- %PROGRAM_FILES%\KWMUSIC\skin\Д¬ИПЖ¤·ф\last-hover.bmp
- %PROGRAM_FILES%\KWMUSIC\skin\Д¬ИПЖ¤·ф\PlayerBtnMute2Down.bmp
- %PROGRAM_FILES%\KWMUSIC\skin\notice.gif
- %PROGRAM_FILES%\KWMUSIC\skin\downnotice.gif
- %PROGRAM_FILES%\KWMUSIC\skin\Д¬ИПЖ¤·ф\IDB_ListDESC.bmp
- %PROGRAM_FILES%\KWMUSIC\skin\Д¬ИПЖ¤·ф\IDB_ListASC.bmp
- %PROGRAM_FILES%\KWMUSIC\config\StringConfig.ini
- %PROGRAM_FILES%\KWMUSIC\res\ranks\У°КУЅрЗъ.xml
- %PROGRAM_FILES%\KWMUSIC\res\ranks\СЕ»ўРВёи°с.xml
- %PROGRAM_FILES%\KWMUSIC\config\MiniConfig.ini
- %PROGRAM_FILES%\KWMUSIC\res\ranks\УОП·ТфАЦ.xml
- %PROGRAM_FILES%\KWMUSIC\skin\Д¬ИПЖ¤·ф\MidPanelBottomBK.bmp
- %PROGRAM_FILES%\KWMUSIC\skin\Д¬ИПЖ¤·ф\Mid.bmp
- %PROGRAM_FILES%\KWMUSIC\skin\Д¬ИПЖ¤·ф\MusicSouceSkin.xml
- %PROGRAM_FILES%\KWMUSIC\skin\Д¬ИПЖ¤·ф\MidPanelTopBK.bmp
- %PROGRAM_FILES%\KWMUSIC\skin\Д¬ИПЖ¤·ф\LoadingGif.gif
- %PROGRAM_FILES%\KWMUSIC\skin\Д¬ИПЖ¤·ф\ListContentBK.bmp
- %PROGRAM_FILES%\KWMUSIC\skin\Д¬ИПЖ¤·ф\LEFT.bmp
- %PROGRAM_FILES%\KWMUSIC\skin\Д¬ИПЖ¤·ф\ListHeaderMidLine.bmp
- %PROGRAM_FILES%\KWMUSIC\skin\Д¬ИПЖ¤·ф\ListHeaderBK.bmp
- %PROGRAM_FILES%\KWMUSIC\KwLogSvr.dll
- %PROGRAM_FILES%\KWMUSIC\lidx.dll
- %PROGRAM_FILES%\KWMUSIC\dump.ax
- %PROGRAM_FILES%\KWMUSIC\KwUpdate.dll
- %PROGRAM_FILES%\KWMUSIC\KwMV.exe
- %WINDIR%\KwYl.dat
- %PROGRAM_FILES%\KWMUSIC\skin\Д¬ИПЖ¤·ф\switch-pressed.bmp
- %PROGRAM_FILES%\KWMUSIC\msvcp71.dll
- %PROGRAM_FILES%\KWMUSIC\msvcr71.dll
- %HOMEPATH%\Favorites\µзДФІй°Й--НшХѕµјєЅ.lnk
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\їбОТТфАЦєР.lnk
- %TEMP%\nsx6.tmp\AdvSplash.dll
- %TEMP%\nsx6.tmp\Splash_YourSplash.bmp
- %HOMEPATH%\Desktop\їбОТТфАЦєР.lnk
- %PROGRAM_FILES%\KWMUSIC\Uninstall.exe
- %TEMP%\nsj5.tmp\System.dll
- %HOMEPATH%\Start Menu\Programs\їбОТТфАЦєР\ИнјюЛµГч.lnk
- %HOMEPATH%\Start Menu\Programs\їбОТТфАЦєР\їбОТТфАЦєР.lnk
- %PROGRAM_FILES%\KWMUSIC\skin\Д¬ИПЖ¤·ф\switch-normal.bmp
- %PROGRAM_FILES%\KWMUSIC\skin\Д¬ИПЖ¤·ф\pause-pressed.bmp
- %PROGRAM_FILES%\KWMUSIC\skin\Д¬ИПЖ¤·ф\pause-normal.bmp
- %PROGRAM_FILES%\KWMUSIC\skin\Д¬ИПЖ¤·ф\play-hover.bmp
- %PROGRAM_FILES%\KWMUSIC\skin\Д¬ИПЖ¤·ф\play-disable.bmp
- %PROGRAM_FILES%\KWMUSIC\skin\Д¬ИПЖ¤·ф\pause-hover.bmp
- %PROGRAM_FILES%\KWMUSIC\skin\Д¬ИПЖ¤·ф\next-normal.bmp
- %PROGRAM_FILES%\KWMUSIC\skin\Д¬ИПЖ¤·ф\next-hover.bmp
- %PROGRAM_FILES%\KWMUSIC\skin\Д¬ИПЖ¤·ф\pause-disable.bmp
- %PROGRAM_FILES%\KWMUSIC\skin\Д¬ИПЖ¤·ф\next-pressed.bmp
- %PROGRAM_FILES%\KWMUSIC\skin\Д¬ИПЖ¤·ф\stop-normal.bmp
- %PROGRAM_FILES%\KWMUSIC\skin\Д¬ИПЖ¤·ф\stop-hover.bmp
- %PROGRAM_FILES%\KWMUSIC\skin\Д¬ИПЖ¤·ф\switch-hover.bmp
- %PROGRAM_FILES%\KWMUSIC\skin\Д¬ИПЖ¤·ф\stop-pressed.bmp
- %PROGRAM_FILES%\KWMUSIC\skin\Д¬ИПЖ¤·ф\stop-disable.bmp
- %PROGRAM_FILES%\KWMUSIC\skin\Д¬ИПЖ¤·ф\play-pressed.bmp
- %PROGRAM_FILES%\KWMUSIC\skin\Д¬ИПЖ¤·ф\play-normal.bmp
- %PROGRAM_FILES%\KWMUSIC\skin\Д¬ИПЖ¤·ф\skinpack.pkg
- %PROGRAM_FILES%\KWMUSIC\skin\Д¬ИПЖ¤·ф\skin.jpg
- %PROGRAM_FILES%\KWMUSIC\res\ranks\СЕ»ўИИёи°с.xml
- %PROGRAM_FILES%\KWMUSIC\face\pub.img
- %PROGRAM_FILES%\KWMUSIC\face\left.bmp
- %PROGRAM_FILES%\KWMUSIC\face\defaultbak\bkground1.jpg
- %PROGRAM_FILES%\KWMUSIC\face\rigt.bmp
- %PROGRAM_FILES%\KWMUSIC\face\kwplog.img
- %PROGRAM_FILES%\KWMUSIC\face\hand-open.cur
- %PROGRAM_FILES%\KWMUSIC\face\hand-close.cur
- %PROGRAM_FILES%\KWMUSIC\face\kwpcmd.img
- %PROGRAM_FILES%\KWMUSIC\face\kwc.img
- %PROGRAM_FILES%\KWMUSIC\swf\enjoy.swf
- %PROGRAM_FILES%\KWMUSIC\swf\directx.swf
- %PROGRAM_FILES%\KWMUSIC\swf\neterror.swf
- %PROGRAM_FILES%\KWMUSIC\swf\load.swf
- %PROGRAM_FILES%\KWMUSIC\swf\coverflow.swf
- %PROGRAM_FILES%\KWMUSIC\swf\MvComplete.swf
- %PROGRAM_FILES%\KWMUSIC\face\defaultbak\bkground2.jpg
- %PROGRAM_FILES%\KWMUSIC\swf\SteelExternalAll.swf
- %PROGRAM_FILES%\KWMUSIC\swf\Player.swf
- %PROGRAM_FILES%\KWMUSIC\face\font.bmp
- %TEMP%\nsd4.tmp
- <Текущая директория>\sou.exe
- %TEMP%\nsj5.tmp\AnimGif.dll
- %PROGRAM_FILES%\KWMUSIC\instpage.gif
- <SYSTEM32>\plugins\sou.exe
- %TEMP%\Install.ini
- %TEMP%\nsn2.tmp
- <SYSTEM32>\plugins\plu.exe
- %TEMP%\bind\Bind.ini
- %PROGRAM_FILES%\KWMUSIC\conf.ini
- %PROGRAM_FILES%\KWMUSIC\panes.xml
- %PROGRAM_FILES%\KWMUSIC\face\back.bmp
- %PROGRAM_FILES%\KWMUSIC\readme.txt
- %PROGRAM_FILES%\KWMUSIC\recoEngine.exe
- %PROGRAM_FILES%\KWMUSIC\KwMusic.exe
- %TEMP%\nsj5.tmp\KillProcDLL.dll
- %PROGRAM_FILES%\KWMUSIC\dotag.exe
- %PROGRAM_FILES%\KWMUSIC\Encode.exe
- %PROGRAM_FILES%\KWMUSIC\res\ranks\°Щ¶ИИИёи°с.xml
- %PROGRAM_FILES%\KWMUSIC\res\ranks\MVѕµд»іДо.xml
- %PROGRAM_FILES%\KWMUSIC\res\ranks\µҐЗъЦчґт.xml
- %PROGRAM_FILES%\KWMUSIC\res\ranks\°Щ¶ИРВёи°с.xml
- %PROGRAM_FILES%\KWMUSIC\res\ranks\MVѕ«ІККУЅз.xml
- %PROGRAM_FILES%\KWMUSIC\res\coverflow\8.jpg
- %PROGRAM_FILES%\KWMUSIC\res\coverflow\7.JPG
- %PROGRAM_FILES%\KWMUSIC\res\ranks\MV-ёР¶ЇДг.xml
- %PROGRAM_FILES%\KWMUSIC\res\ranks\DJОиЗъ·з.xml
- %PROGRAM_FILES%\KWMUSIC\res\ranks\Е·ГАЅрЗъ.xml
- %PROGRAM_FILES%\KWMUSIC\res\ranks\АЦ¶УЧйєП.xml
- %PROGRAM_FILES%\KWMUSIC\res\ranks\ИХє«ёиЗъ.xml
- %PROGRAM_FILES%\KWMUSIC\res\ranks\ИИГЕ¶ФіЄ.xml
- %PROGRAM_FILES%\KWMUSIC\res\ranks\їбОТИИёи°с.xml
- %PROGRAM_FILES%\KWMUSIC\res\ranks\¶щНЇёиЗъ.xml
- %PROGRAM_FILES%\KWMUSIC\res\ranks\¶ЇВюёиЗъ.xml
- %PROGRAM_FILES%\KWMUSIC\res\ranks\ѕµдАПёи.xml
- %PROGRAM_FILES%\KWMUSIC\res\ranks\ёпГьѕьВГёиЗъ.xml
- %PROGRAM_FILES%\KWMUSIC\res\coverflow\6.JPG
- %PROGRAM_FILES%\KWMUSIC\res\albums.xml
- %PROGRAM_FILES%\KWMUSIC\res\PanesData.xml
- %PROGRAM_FILES%\KWMUSIC\res\artists.xml
- %PROGRAM_FILES%\KWMUSIC\res\arthistory.xml
- %PROGRAM_FILES%\KWMUSIC\swf\serverbusy.swf
- %PROGRAM_FILES%\KWMUSIC\swf\nomtv.swf
- %PROGRAM_FILES%\KWMUSIC\swf\no.swf
- %PROGRAM_FILES%\KWMUSIC\swf\picexception.swf
- %PROGRAM_FILES%\KWMUSIC\swf\nores.swf
- %PROGRAM_FILES%\KWMUSIC\res\coverflow\3.JPG
- %PROGRAM_FILES%\KWMUSIC\res\coverflow\2.JPG
- %PROGRAM_FILES%\KWMUSIC\res\coverflow\5.JPG
- %PROGRAM_FILES%\KWMUSIC\res\coverflow\4.JPG
- %PROGRAM_FILES%\KWMUSIC\res\coverflow\1.JPG
- %PROGRAM_FILES%\KWMUSIC\res\mblistcount.xml
- %PROGRAM_FILES%\KWMUSIC\res\hot_singer.xml
- %PROGRAM_FILES%\KWMUSIC\res\coverflow\001.jpg
- %PROGRAM_FILES%\KWMUSIC\res\starmenu.xml
Удаляет следующие файлы:
- %TEMP%\nsj5.tmp\System.dll
- <SYSTEM32>\plugins\plu.exe
- %TEMP%\nsj5.tmp\KillProcDLL.dll
- <Текущая директория>\sou.exe
- %TEMP%\nsj5.tmp\AnimGif.dll
Сетевая активность:
Подключается к:
- 'www.dn##.net':80
- 'localhost':1038
TCP:
Запросы HTTP GET:
- www.dn##.net/
UDP:
- DNS ASK www.dn##.net
Другое:
Ищет следующие окна:
- ClassName: 'IEFrame' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'KwMusicBox' WindowName: ''
- ClassName: '#32770' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'KwMusicServer' WindowName: 'KwMusicServer'
