Trojan.Click3.25111

Техническая информация

Для обеспечения автозапуска и распространения:

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\Kingsoft Antivirus WebShield Service] 'ImagePath' = '%ProgramFiles%\kingsoft\KSWebShield.exe'
[<HKLM>\SYSTEM\ControlSet001\Services\Kingsoft Antivirus WebShield Service] 'Start' = '00000002'

Вредоносные функции:

Создает и запускает на исполнение:

'%ProgramFiles%\kingsoft\KSWebShield.exe'
'%TEMP%\guaguadance.exe'
'%ProgramFiles%\kingsoft\KSWebShield.exe' -start
'C:\°ІЧ°°ь\Setup.exe'
'%ProgramFiles%\kingsoft\KSWebShield.exe' -install
'%TEMP%\guaguadance.exe' (загружен из сети Интернет)

Запускает на исполнение:

'<SYSTEM32>\attrib.exe' "%HOMEPATH%\Desktop\╨╘╕╨├└┼о.url" +R +S
'<SYSTEM32>\attrib.exe' "%HOMEPATH%\Desktop\╠╘▒ж╣║╬я.url" +R +S
'<SYSTEM32>\attrib.exe' "%HOMEPATH%\Desktop\╥┴╚╦┼о╨╘═°.url" +R +S
'<SYSTEM32>\attrib.exe' "%HOMEPATH%\Desktop\╘┌╧▀╡ч╙░.url" +R +S
'<SYSTEM32>\attrib.exe' "%ALLUSERSPROFILE%\Application Data\Kingsoft\kws\kws.ini" +R +S
'<SYSTEM32>\attrib.exe' "%HOMEPATH%\Desktop\╘┌╧▀┬■╗н.url" +R +S
'<SYSTEM32>\attrib.exe' "%HOMEPATH%\Desktop\├└┼о╩╙╞╡.url" +R +S
'<SYSTEM32>\cacls.exe' "%HOMEPATH%\Desktop\╨╘╕╨├└┼о.url" /p everyone:R
'<SYSTEM32>\cacls.exe' "%HOMEPATH%\Desktop\╠╘▒ж╣║╬я.url" /p everyone:R
'<SYSTEM32>\cacls.exe' "%HOMEPATH%\Desktop\╥┴╚╦┼о╨╘═°.url" /p everyone:R
'<SYSTEM32>\cacls.exe' "%HOMEPATH%\Desktop\╘┌╧▀╡ч╙░.url" /p everyone:R
'<SYSTEM32>\cacls.exe' "%ALLUSERSPROFILE%\Application Data\Kingsoft\kws\kws.ini" /p everyone:R
'<SYSTEM32>\cacls.exe' "%HOMEPATH%\Desktop\╘┌╧▀┬■╗н.url" /p everyone:R
'<SYSTEM32>\cacls.exe' "%HOMEPATH%\Desktop\├└┼о╩╙╞╡.url" /p everyone:R
'%ProgramFiles%\Internet Explorer\IEXPLORE.EXE' http://www.31##6.net/?uk###
'<SYSTEM32>\cmd.exe' /S /D /c" echo y"
'<SYSTEM32>\cacls.exe' "%ALLUSERSPROFILE%\Application Data\Kingsoft\kws\kws.ini" /p everyone:f
'<SYSTEM32>\ping.exe' -n 5 127.0.0.1
'<SYSTEM32>\svchost.exe'
'%ProgramFiles%\Internet Explorer\IEXPLORE.EXE' http://www.66##.net/?uk####
'<SYSTEM32>\cmd.exe' /c %TEMP%\lnk.bat
'<SYSTEM32>\cacls.exe' "%HOMEPATH%\Desktop\╨╘╕╨├└┼о.url" /p everyone:f
'<SYSTEM32>\cacls.exe' "%HOMEPATH%\Desktop\╠╘▒ж╣║╬я.url" /p everyone:f
'<SYSTEM32>\cacls.exe' "%HOMEPATH%\Desktop\╥┴╚╦┼о╨╘═°.url" /p everyone:f
'<SYSTEM32>\cacls.exe' "%HOMEPATH%\Desktop\╘┌╧▀╡ч╙░.url" /p everyone:f
'<SYSTEM32>\cacls.exe' "%HOMEPATH%\Desktop\╘┌╧▀┬■╗н.url" /p everyone:f
'%ProgramFiles%\Internet Explorer\IEXPLORE.EXE' http://www.77##h.com/?kj###
'<SYSTEM32>\cacls.exe' "%HOMEPATH%\Desktop\├└┼о╩╙╞╡.url" /p everyone:f

Внедряет код в

следующие системные процессы:

<SYSTEM32>\svchost.exe

Изменения в файловой системе:

Создает следующие файлы:

%ProgramFiles%\ico\Taobao.ico
%HOMEPATH%\Favorites\ТБИЛЕ®РФНш.url
%HOMEPATH%\Favorites\МФ±¦№єОп.url
%HOMEPATH%\Desktop\МФ±¦№єОп.url
%HOMEPATH%\Favorites\ФЪПЯµзУ°.url
%HOMEPATH%\Desktop\ФЪПЯµзУ°.url
%HOMEPATH%\Desktop\ТБИЛЕ®РФНш.url
%ProgramFiles%\ico\Beauty.ico
%ProgramFiles%\ico\Video.ico
%HOMEPATH%\Desktop\РФёРГАЕ®.url
%ProgramFiles%\ico\meiv.ico
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\ip.chinaz[1]
%HOMEPATH%\Favorites\РФёРГАЕ®.url
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\fifo.log
%HOMEPATH%\Desktop\ГАЕ®КУЖµ.url
%TEMP%\guaguadance.exe
%HOMEPATH%\Favorites\ГАЕ®КУЖµ.url
%ProgramFiles%\ico\Film.ico
%ALLUSERSPROFILE%\Desktopkws\kws.ini
%TEMP%\suicide.bat
%ProgramFiles%\kingsoft\KSWebShield.dll
%ProgramFiles%\kingsoft\KSWebShield.exe
C:\°ІЧ°°ь\Setup.exe
%TEMP%\SE1.tmp
%TEMP%\SE2.tmp
%ALLUSERSPROFILE%\Start Menu\Setup.lnk
%ProgramFiles%\kingsoft\kwssp.dll
%ProgramFiles%\ico\Manhua.ico
%TEMP%\lnk.bat
%HOMEPATH%\Favorites\ФЪПЯВю».url
%HOMEPATH%\Desktop\ФЪПЯВю».url
%ProgramFiles%\kingsoft\KWSSVC.log
%ProgramFiles%\kingsoft\kwsui.dll
%ALLUSERSPROFILE%\Application Data\kingsoft\kws\urlcache.dat
%ALLUSERSPROFILE%\Application Data\kingsoft\kws\kws.ini