Trojan.Click2.35476

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'updmgr' = '%CommonProgramFiles%\updmgr\updmgr.exe'
[<HKCU>\Control Panel\Desktop] 'SCRNSAVE.EXE' = '<SYSTEM32>\sheclangs.scr'

Вредоносные функции:

Создает и запускает на исполнение:

%PROGRAM_FILES%\IncrediFind\BHO\setup.exe guidgenerate
%CommonProgramFiles%\updmgr\updmgr.exe
%CommonProgramFiles%\updmgr\rvupdmgr.exe updmgr.exe
%PROGRAM_FILES%\PowerSearch\Toolbar\setup.exe 84722637-E866-4188-A9D7-45C915C61A76ended
%PROGRAM_FILES%\IncrediFind\BHO\setup.exe CD074655-28AD-4899-A6A1-3DE8476C4CCDended 0EBBB0F8-2504-404F-8A4B-EF2953B72002
%PROGRAM_FILES%\IncrediFind\BHO\setup.exe dateandtime
%PROGRAM_FILES%\PowerSearch\Toolbar\setup.exe 84722637-E866-4188-A9D7-45C915C61A76start
%PROGRAM_FILES%\ScreenSavers\sheclangs\incredifind_williamhung.exe
%PROGRAM_FILES%\ScreenSavers\sheclangs\regw.exe SCRNSAVE.EXE <SYSTEM32>\sheclangs.scr
%PROGRAM_FILES%\ScreenSavers\sheclangs\setup.exe 90D0BD04-B5E7-4E58-89B0-817A4D624177start
%PROGRAM_FILES%\ScreenSavers\sheclangs\setup.exe 90D0BD04-B5E7-4E58-89B0-817A4D624177ended
%TEMP%\updmgrInstall_143.exe
%PROGRAM_FILES%\ScreenSavers\sheclangs\setup_powersearch_williamhung.exe

Запускает на исполнение:

%PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE http://www.si###arch.com/toolbar/partner/williamhung/installed.html
%PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE http://www.si###arch.com/toolbar/partner/williamhung/failed.html?gg##################################################################################################################

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%PROGRAM_FILES%\IncrediFind\BHO\guid.txt
%PROGRAM_FILES%\IncrediFind\BHO\IncFindBHO150.dll
%PROGRAM_FILES%\IncrediFind\BHO\date.txt
%PROGRAM_FILES%\IncrediFind\BHO\setup.exe
%CommonProgramFiles%\updmgr\simgr.exe
%CommonProgramFiles%\updmgr\data1.dat
%CommonProgramFiles%\updmgr\data2.dat
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\tracker[1].cfm
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\mgmt[1].htm
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\mgmt[1].htm
%TEMP%\IncrediFindBHOLog.tmp
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\tracker[1].cfm
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\tracker[1].cfm
%CommonProgramFiles%\updmgr\updmgr.exe
%PROGRAM_FILES%\ScreenSavers\sheclangs\incredifind_williamhung.exe
%PROGRAM_FILES%\ScreenSavers\sheclangs\setup_powersearch_williamhung.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\tracker[1].cfm
%PROGRAM_FILES%\ScreenSavers\sheclangs\setup.exe
<SYSTEM32>\sheclangs.scr
%PROGRAM_FILES%\ScreenSavers\sheclangs\regw.exe
%PROGRAM_FILES%\ScreenSavers\sheclangs\uninstall.ico
%PROGRAM_FILES%\PowerSearch\Toolbar\pwrshung.dll
%PROGRAM_FILES%\PowerSearch\Toolbar\setup.exe
%CommonProgramFiles%\updmgr\rvupdmgr.exe
%TEMP%\updmgrInstall_143.exe
%PROGRAM_FILES%\ScreenSavers\sheclangs\Uninstall.exe
%ALLUSERSPROFILE%\Start Menu\Programs\ScreenSavers\sheclangs\Uninstall.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\ScreenSavers\sheclangs\Configure ScreenSaver.lnk

Удаляет следующие файлы:

%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\mgmt[1].htm
%PROGRAM_FILES%\IncrediFind\BHO\setup.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\mgmt[1].htm
%TEMP%\updmgrInstall_143.exe
%PROGRAM_FILES%\IncrediFind\BHO\guid.txt
%PROGRAM_FILES%\IncrediFind\BHO\date.txt

Сетевая активность:

Подключается к:

'up####.#hunderdownloads.com':80
'localhost':1045
'localhost':1048
'localhost':1040
'localhost':1035
'tr######.thunderdownloads.com':80
'localhost':1039

TCP:

Запросы HTTP GET:

tr######.thunderdownloads.com/tracker.cfm?ac###########################################################################################################
tr######.thunderdownloads.com/tracker.cfm?ac##################################################################
tr######.thunderdownloads.com/tracker.cfm?ac###############################################################

Запросы HTTP POST: