Trojan.Click1.57539

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Classes\CLSID\{86AEFBE8-763F-0688-899C-A93138888899}\Shell\Open\Command] '' = '%PROGRAM_FILES%\Internet Explorer\iexplore.exe http://www.27dh.com/?10034/'

Вредоносные функции:

Запускает на исполнение:

<SYSTEM32>\reg.exe delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{86AEFBE8-763F-0647-899C-A93138888899}" /f
<SYSTEM32>\reg.exe delete "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{86AEFBE8-763F-0647-899C-A93138888899}" /f
<SYSTEM32>\regini.exe <SYSTEM32>\regsets.ini
%WINDIR%\regedit.exe /s web.rig
<SYSTEM32>\reg.exe delete "HKEY_CLASSES_ROOT\CLSID\{86AEFBE8-763F-0647-899C-A93138888899}" /f
<SYSTEM32>\attrib.exe -r "%HOMEPATH%\╫└├ц\*.lnk"
<SYSTEM32>\attrib.exe -r "%APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk"
<SYSTEM32>\attrib.exe -r "%HOMEPATH%\б╕┐к╩╝б╣▓╦╡е\│╠╨Є\╞Ї╢п\*.lnk"
<SYSTEM32>\attrib.exe -r "%HOMEPATH%\б╕┐к╩╝б╣▓╦╡е\│╠╨Є\*.lnk"
<SYSTEM32>\reg.exe add "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /d "http://www.27##.com/?10####" /f
<SYSTEM32>\wscript.exe "%WINDIR%\46.vbs"
%PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE http://www.fx##99.cn/img/tc.htm?34
<SYSTEM32>\cmd.exe /c %WINDIR%\46.bat
<SYSTEM32>\mshta.exe vbscript:CreateObject("WScript.Shell").Run("iexplore http://www.fx##99.cn/img/tc.htm?34##################
<SYSTEM32>\mshta.exe vbscript:CreateObject("WScript.Shell").Run("iexplore http://www.27##.com/?34####################
%WINDIR%\regedit.exe /s add7.rig
<SYSTEM32>\reg.exe delete "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /f
%PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE http://www.fx##99.cn/img/gg.htm?vb###
%PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE http://www.27##.com/?34##

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%WINDIR%\Resources\1005.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\T1gANoXmXwXXcGRBI1_1006[1].gif
%WINDIR%\Resources\1006.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\T1gANoXmXwXXcGRBI1_1005[1].gif
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\T1gANoXmXwXXcGRBI1_1004[1].gif
%WINDIR%\Resources\1004.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\27dh[1]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\T1gANoXmXwXXcGRBI1_1007[1].gif
%WINDIR%\Resources\1009.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\T1gANoXmXwXXcGRBI1_1010[1].gif
%WINDIR%\Resources\1010.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\T1gANoXmXwXXcGRBI1_1009[1].gif
%WINDIR%\Resources\1007.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\T1gANoXmXwXXcGRBI1_1008[1].gif
%WINDIR%\Resources\1008.exe
%WINDIR%\Resources\1001.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\tc[1].htm
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\T1gANoXmXwXXcGRBI1_1002[1].gif
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\T1gANoXmXwXXcGRBI1_1001[1].gif
%WINDIR%\46.bat
%WINDIR%\46.vbs
<Текущая директория>\add7.rig
%WINDIR%\Resources\1002.exe
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.url
%HOMEPATH%\Favorites\27═°╓╖╓о╝╥ ╔╧═°╛═╔╧27═°╓╖╓о╝╥.url
<Текущая директория>\web.rig
%WINDIR%\Resources\1003.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\gg[1].htm
<SYSTEM32>\regsets.ini
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\T1gANoXmXwXXcGRBI1_1003[1].gif