Trojan.Click2.54957

Техническая информация

Для обеспечения автозапуска и распространения:

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\Kingsoft Antivirus WebShield Service] 'Start' = '00000002'

Вредоносные функции:

Создает и запускает на исполнение:

'%PROGRAM_FILES%\kingsoft\KSWebShield.exe'
'%PROGRAM_FILES%\kingsoft\KSWebShield.exe' -start
'%PROGRAM_FILES%\kingsoft\KSWebShield.exe' -install

Запускает на исполнение:

'<SYSTEM32>\attrib.exe' "%HOMEPATH%\Desktop\╨╘╕╨├└┼о.url" +R +S
'<SYSTEM32>\attrib.exe' "%HOMEPATH%\Desktop\╠╘▒ж╣║╬я.url" +R +S
'<SYSTEM32>\attrib.exe' "%HOMEPATH%\Desktop\╘┌╧▀╨б╦╡.url" +R +S
'<SYSTEM32>\attrib.exe' "%HOMEPATH%\Desktop\╘┌╧▀╡ч╙░.url" +R +S
'<SYSTEM32>\attrib.exe' "%ALLUSERSPROFILE%\Application Data\Kingsoft\kws\kws.ini" +R +S
'<SYSTEM32>\attrib.exe' "%HOMEPATH%\Desktop\╘┌╧▀┬■╗н.url" +R +S
'<SYSTEM32>\attrib.exe' "%HOMEPATH%\Desktop\├└┼о╩╙╞╡.url" +R +S
'<SYSTEM32>\cacls.exe' "%HOMEPATH%\Desktop\╨╘╕╨├└┼о.url" /p everyone:R
'<SYSTEM32>\cacls.exe' "%HOMEPATH%\Desktop\╠╘▒ж╣║╬я.url" /p everyone:R
'<SYSTEM32>\cacls.exe' "%HOMEPATH%\Desktop\╘┌╧▀╨б╦╡.url" /p everyone:R
'<SYSTEM32>\cacls.exe' "%HOMEPATH%\Desktop\╘┌╧▀╡ч╙░.url" /p everyone:R
'<SYSTEM32>\cacls.exe' "%ALLUSERSPROFILE%\Application Data\Kingsoft\kws\kws.ini" /p everyone:R
'<SYSTEM32>\cacls.exe' "%HOMEPATH%\Desktop\╘┌╧▀┬■╗н.url" /p everyone:R
'<SYSTEM32>\cacls.exe' "%HOMEPATH%\Desktop\├└┼о╩╙╞╡.url" /p everyone:R
'<SYSTEM32>\cmd.exe' /c %TEMP%\lnk.bat
'<SYSTEM32>\ping.exe' -n 5 127.0.0.1
'%PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE' http://www.77##h.com/?kj###
'%PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE' http://www.31##6.net/?uk###
'<SYSTEM32>\expand.exe' "%TEMP%\url.cab" -F:*.* "%HOMEPATH%\Desktop
'<SYSTEM32>\expand.exe' "%TEMP%\url.cab" -F:*.* "%HOMEPATH%\Favorites
'%PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE' http://www.66##.net/?uk####
'<SYSTEM32>\cacls.exe' "%HOMEPATH%\Desktop\╨╘╕╨├└┼о.url" /p everyone:f
'<SYSTEM32>\cacls.exe' "%HOMEPATH%\Desktop\╠╘▒ж╣║╬я.url" /p everyone:f
'<SYSTEM32>\cacls.exe' "%HOMEPATH%\Desktop\╘┌╧▀╨б╦╡.url" /p everyone:f
'<SYSTEM32>\cacls.exe' "%HOMEPATH%\Desktop\╘┌╧▀╡ч╙░.url" /p everyone:f
'<SYSTEM32>\cacls.exe' "%ALLUSERSPROFILE%\Application Data\Kingsoft\kws\kws.ini" /p everyone:f
'<SYSTEM32>\cacls.exe' "%HOMEPATH%\Desktop\╘┌╧▀┬■╗н.url" /p everyone:f
'<SYSTEM32>\cacls.exe' "%HOMEPATH%\Desktop\├└┼о╩╙╞╡.url" /p everyone:f

Изменения в файловой системе:

Создает следующие файлы:

%HOMEPATH%\Desktop\ФЪПЯµзУ°.url
%HOMEPATH%\Desktop\ТБИЛНш.url
%HOMEPATH%\Favorites\ФЪПЯВю».url
%HOMEPATH%\Favorites\МФ±¦№єОп.url
%HOMEPATH%\Favorites\ГАЕ®КУЖµ.url
%HOMEPATH%\Desktop\ГАЕ®КУЖµ.url
%HOMEPATH%\Desktop\ФЪПЯВю».url
%HOMEPATH%\Desktop\МФ±¦№єОп.url
%PROGRAM_FILES%\kingsoft\KWSSVC.log
%HOMEPATH%\Desktop\РФёРГАЕ®.url
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\up_1[1].asp
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\6626[1]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\779dh[1]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\31166[1]
%HOMEPATH%\Favorites\ТБИЛНш.url
%HOMEPATH%\Favorites\РФёРГАЕ®.url
%HOMEPATH%\Favorites\ФЪПЯµзУ°.url
%ALLUSERSPROFILE%\Application Data\kingsoft\kws\urlcache.dat
%ALLUSERSPROFILE%\Application Data\kingsoft\kws\kws.ini
%PROGRAM_FILES%\ico\Chat.ico
%PROGRAM_FILES%\ico\Video.ico
<SYSTEM32>\safe.ico
%ALLUSERSPROFILE%\Desktopkws\kws.ini
%TEMP%\url.cab
%PROGRAM_FILES%\ico\Beauty.ico
%TEMP%\lnk.bat
%PROGRAM_FILES%\ico\Film.ico
%PROGRAM_FILES%\ico\Taobao.ico
%PROGRAM_FILES%\ico\meiv.ico
%ALLUSERSPROFILE%\Start Menu\KSWebShield.lnk
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip.chinaz[1]
%ALLUSERSPROFILE%\Start Menu\360safe.lnk
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\getip[1]
%ALLUSERSPROFILE%\Start Menu\360sdo.lnk
%PROGRAM_FILES%\kingsoft\KSWebShield.dll
%PROGRAM_FILES%\kingsoft\KSWebShield.exe
%PROGRAM_FILES%\kingsoft\kwssp.dll
%ALLUSERSPROFILE%\Start Menu\ЅрЙЅНш¶Ь.lnk
%PROGRAM_FILES%\kingsoft\kwsui.dll