Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKCU>\Software\Microsoft\Internet Explorer\Extensions\{82D9671E-0B56-4285-92CD-15BC08B883BB}] 'ClsidExtension' = '{E415B63C-41C1-4A69-9A2E-D817D03B7C78}'
Создает или изменяет следующие файлы:
- %HOMEPATH%\Start Menu\Programs\Startup\KІҐНшВзУ°КУ.LNK
Вредоносные функции:
Создает и запускает на исполнение:
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\QvodPlayer.exe u_setup
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\KІҐНшВзУ°КУ.exe
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\QvodInit.exe setup
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\QvodInit.exe writett
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Skin\new_lskj\tabs_mid.bmp
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Skin\new_lskj\tabs_left.bmp
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Skin\new_lskj\tabs_play_fill.bmp
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Skin\new_lskj\tabs_search_fill.bmp
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Skin\new_lskj\tabs_right.bmp
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Skin\new_lskj\tabs_fill.bmp
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Skin\new_lskj\tab_bottom.bmp
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Skin\new_lskj\stop.bmp
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Skin\new_lskj\tab_top.bmp
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Skin\new_lskj\tabs_bottom_fill_2.bmp
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Skin\new_lskj\tabs_bottom_fill_1.bmp
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Skin\new_lskj\top_right_back.bmp
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Skin\new_lskj\top_left_back.bmp
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Skin\new_lskj\topleft.bmp
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Skin\new_lskj\volume.bmp
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Skin\new_lskj\topright.bmp
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Skin\new_lskj\top_fill_2.bmp
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Skin\new_lskj\toolbar_fill.bmp
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Skin\new_lskj\tabs_search_left.bmp
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Skin\new_lskj\top.bmp
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Skin\new_lskj\top_fill.bmp
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Skin\new_lskj\top_2.bmp
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Skin\new_lskj\progress_point_b.bmp
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Skin\new_lskj\progress_point_a.bmp
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Skin\new_lskj\progress_thumb.bmp
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Skin\new_lskj\right_fill.bmp
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Skin\new_lskj\reold.bmp
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Skin\new_lskj\progress_fill.bmp
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Skin\new_lskj\pre.bmp
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Skin\new_lskj\playlisticon.bmp
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Skin\new_lskj\processp_fill.bmp
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Skin\new_lskj\processp_right.bmp
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Skin\new_lskj\processp_left.bmp
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Skin\new_lskj\scroll_up.bmp
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Skin\new_lskj\scroll_right.bmp
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Skin\new_lskj\search_botton.bmp
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Skin\new_lskj\search_icon_2.bmp
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Skin\new_lskj\search_full.bmp
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Skin\new_lskj\scroll_limit_h.bmp
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Skin\new_lskj\scroll_back_h.bmp
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Skin\new_lskj\scroll_back.bmp
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Skin\new_lskj\scroll_down.bmp
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Skin\new_lskj\scroll_limit.bmp
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Skin\new_lskj\scroll_left.bmp
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\МФ±¦Нш.url
- %HOMEPATH%\Start Menu\Programs\KІҐНшВзУ°КУ\НшЦ·µјєЅ.url
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\НшЦ·µјєЅ.url
- %HOMEPATH%\Start Menu\Programs\KІҐНшВзУ°КУ\KІҐНшВзУ°КУ.lnk
- %TEMP%\nsd3.tmp\KillProcDLL.dll
- %HOMEPATH%\Start Menu\Programs\KІҐНшВзУ°КУ\МФ±¦Нш.url
- %HOMEPATH%\Start Menu\Programs\МФ±¦Нш.url
- %HOMEPATH%\Desktop\НшЦ·µјєЅ.url
- %HOMEPATH%\Start Menu\Programs\НшЦ·µјєЅ.url
- %HOMEPATH%\Start Menu\НшЦ·µјєЅ.url
- %HOMEPATH%\Start Menu\МФ±¦Нш.url
- %HOMEPATH%\Start Menu\Programs\KІҐНшВзУ°КУ\Р¶ФШKІҐНшВзУ°КУ.lnk
- %TEMP%\nsd3.tmp\rfshdktp.dll
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\uninst.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\s2[1].asp
- %HOMEPATH%\Favorites\МФ±¦Нш - МФЈЎОТПІ»¶.url
- %HOMEPATH%\Start Menu\KІҐНшВзУ°КУ.lnk
- %HOMEPATH%\Desktop\KІҐНшВзУ°КУ.lnk
- %HOMEPATH%\Start Menu\Programs\KІҐНшВзУ°КУ.lnk
- %HOMEPATH%\Favorites\77114ЙПНшµјєЅЈОТµДЙПНшЦчТіЈЎ.url
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\KІҐНшВзУ°КУ.lnk
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Skin\MiNi\mute.bmp
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Skin\MiNi\info.bmp
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Skin\MiNi\mute2.bmp
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Skin\MiNi\open.bmp
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Skin\MiNi\next.bmp
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Skin\MiNi\back.bmp
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Skin\new_lskj\volumep.bmp
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Skin\new_lskj\volumeb.bmp
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Skin\Logo.bmp
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Skin\new_lskj.xml
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Skin\Mini.xml
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Skin\MiNi\volume.bmp
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Skin\MiNi\progressd.bmp
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Skin\MiNi\volumeb.bmp
- %HOMEPATH%\Desktop\МФ±¦Нш.url
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Skin\MiNi\volumep.bmp
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Skin\MiNi\progress_thumb.bmp
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Skin\MiNi\play.bmp
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Skin\MiNi\pause.bmp
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Skin\MiNi\pre.bmp
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Skin\MiNi\progress.bmp
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Skin\MiNi\processp.bmp
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Codecs\RealMediaSplitter.ax
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Codecs\raac.dll
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Tip\PopMessage.xml
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Tip\QvodTips.dll
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Tip\QvodTip.exe
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Codecs\f4v.swf
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Codecs\atrc.dll
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Codecs\asfsplliter.ax
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Codecs\ColorFilter.ax
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Codecs\drvc.dll
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Codecs\cook.dll
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Playlist\Mediacenter.xml
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Playlist\Channel.xml
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Playlist\Playlist.xml
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Playlist\Text.xml
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Playlist\QvodSearch.xml
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Favorite\Desktop.ini
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Tip\back.bmp
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Tip\QvodTips_.xml
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Tip\close.bmp
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Tip\view.bmp
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Tip\maintext.bmp
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\NetAgent.dll
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\KІҐНшВзУ°КУ.exe
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\QvodBand.dll
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\ShareModule.dll
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\QvodInsert.dll
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\QvodPlayer.exe
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\QvodInit.exe
- %TEMP%\nsd2.tmp
- <SYSTEM32>\QvodInit.exe
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\QvodTerminal.exe
- <SYSTEM32>\shop.ico
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\QvodPlayer.xml
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\QvodExtend.dll
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\QvodUninst.exe
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\AddIn\VisLrc.dll
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\unrar.dll
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\QvodCfg.ini
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\MediaConfig.exe
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\drv43260.dll
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\MediaData.dll
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Qvod.cfg
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\pncrt.dll
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Skin\new_lskj\mediaeditdel.bmp
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Skin\new_lskj\media_sham_2.bmp
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Skin\new_lskj\mediare.bmp
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Skin\new_lskj\mediatree.bmp
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Skin\new_lskj\mediatolist.bmp
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Skin\new_lskj\media_sham.bmp
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Skin\new_lskj\media_info.bmp
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Skin\new_lskj\media_fill.bmp
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Skin\new_lskj\media_left.bmp
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Skin\new_lskj\media_search.bmp
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Skin\new_lskj\media_right.bmp
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Skin\new_lskj\open.bmp
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Skin\new_lskj\nowplay.bmp
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Skin\new_lskj\pause.bmp
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Skin\new_lskj\playlist_toolbar.bmp
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Skin\new_lskj\play.bmp
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Skin\new_lskj\next.bmp
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Skin\new_lskj\min.bmp
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Skin\new_lskj\menu.bmp
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Skin\new_lskj\mtk.bmp
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Skin\new_lskj\mute2.bmp
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Skin\new_lskj\mute.bmp
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Skin\new_lskj\bottom_fill_2.bmp
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Skin\new_lskj\bottom_fill.bmp
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Skin\new_lskj\bottom_fill_3.bmp
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Skin\new_lskj\bottomright.bmp
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Skin\new_lskj\bottomleft.bmp
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Skin\new_lskj\bottom_background_right.bmp
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Lang\zh_TW.dll
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Lang\en_US.dll
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Skin\new_lskj\Thumbs.db
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Skin\new_lskj\bottom_background_left.bmp
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Skin\new_lskj\bottom_background_2.bmp
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Skin\new_lskj\logo.bmp
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Skin\new_lskj\listbutton2.bmp
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Skin\new_lskj\max.bmp
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Skin\new_lskj\media_files_2.bmp
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Skin\new_lskj\media_files.bmp
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Skin\new_lskj\listbutton.bmp
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Skin\new_lskj\full.bmp
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Skin\new_lskj\close.bmp
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Skin\new_lskj\info.bmp
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Skin\new_lskj\left_fill.bmp
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\Skin\new_lskj\infofull.bmp
Удаляет следующие файлы:
- %TEMP%\nsd3.tmp\rfshdktp.dll
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\s2[1].asp
- %PROGRAM_FILES%\KІҐНшВзУ°КУ\QvodInit.exe
- %TEMP%\nsd3.tmp\KillProcDLL.dll
Сетевая активность:
Подключается к:
- 'www.le##ilm.cn':80
- 'localhost':1038
- 'st##.qvod.com':80
TCP:
Запросы HTTP GET:
- www.le##ilm.cn/s2.asp?df#############################################
- st##.qvod.com/?ma##############################################
UDP:
- DNS ASK www.le##ilm.cn
- DNS ASK st##.qvod.com
Другое:
Ищет следующие окна:
- ClassName: 'MDIClient' WindowName: ''
- ClassName: 'SysPager' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'ToolBarWindow32' WindowName: ''
- ClassName: 'Qvod Terminal' WindowName: 'Qvod Terminal'
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'TrayNotifyWnd' WindowName: ''
- ClassName: 'QVODPLAYERCLASS' WindowName: ''
