Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Classes\.ghi\shell\open\command] '' = 'rundll32.exe "%PROGRAM_FILES%\wisesoft\xec.cc" xxx '
Вредоносные функции:
Создает и запускает на исполнение:
- %PROGRAM_FILES%\wisesoft\setup_p47.exe
- %TEMP%\is-UH5RD.tmp\is-80FET.tmp /SL4 $40036 "<Полный путь к вирусу>" 696664 52224
Запускает на исполнение:
- <SYSTEM32>\rundll32.exe "%PROGRAM_FILES%\wisesoft\gen.nn" ggg
- <SYSTEM32>\rundll32.exe "%PROGRAM_FILES%\wisesoft\qtc.dll" unknown
- <SYSTEM32>\rundll32.exe "%PROGRAM_FILES%\wisesoft\idi.ii" gis
- %WINDIR%\regedit.exe -s "%PROGRAM_FILES%\wisesoft\xec.err"
Изменения в файловой системе:
Создает следующие файлы:
- %PROGRAM_FILES%\5DGame\skin\default\skin.xml.bak
- %PROGRAM_FILES%\5DGame\skin\default\toolbar_nav02.png
- %PROGRAM_FILES%\5DGame\skin\default\skin.xml
- %PROGRAM_FILES%\5DGame\skin\default\root_bg.png
- %PROGRAM_FILES%\5DGame\skin\default\root_my.ico
- %PROGRAM_FILES%\5DGame\skin\default\top_big03.png
- %PROGRAM_FILES%\5DGame\skin\default\top_close01.png
- %PROGRAM_FILES%\5DGame\skin\default\top_big02.png
- %PROGRAM_FILES%\5DGame\skin\default\toolbar_nav03.png
- %PROGRAM_FILES%\5DGame\skin\default\top_big01.png
- %PROGRAM_FILES%\5DGame\skin\default\logo.png
- %PROGRAM_FILES%\5DGame\skin\default\ico_kf.png
- %PROGRAM_FILES%\5DGame\skin\default\ico_message.png
- %PROGRAM_FILES%\5DGame\skin\default\ico_jian.png
- %PROGRAM_FILES%\5DGame\skin\default\ico_gw.png
- %PROGRAM_FILES%\5DGame\skin\default\ico_jia.png
- %PROGRAM_FILES%\5DGame\skin\default\item_normal.ico
- %PROGRAM_FILES%\5DGame\skin\default\loading.gif
- %PROGRAM_FILES%\5DGame\skin\default\item_new.png
- %PROGRAM_FILES%\5DGame\skin\default\item_go.png
- %PROGRAM_FILES%\5DGame\skin\default\item_my.ico
- %PROGRAM_FILES%\5DGame\skin\default\top_close02.png
- %PROGRAM_FILES%\5DGame\skin\default\vs_tarrow.png
- %PROGRAM_FILES%\5DGame\skin\default\vs_top.png
- %PROGRAM_FILES%\5DGame\skin\default\vs_middle.png
- %PROGRAM_FILES%\5DGame\skin\default\vs_bg.png
- %PROGRAM_FILES%\5DGame\skin\default\vs_bottom.png
- %PROGRAM_FILES%\5DGame\config.xml
- %PROGRAM_FILES%\5DGame\fancygame.ocx
- %PROGRAM_FILES%\5DGame\WebGame.exe
- %PROGRAM_FILES%\5DGame\Updater.exe
- %PROGRAM_FILES%\5DGame\person_pic.gif
- %PROGRAM_FILES%\5DGame\skin\default\vs_barrow.png
- %PROGRAM_FILES%\5DGame\skin\default\top_restore03.png
- %PROGRAM_FILES%\5DGame\skin\default\top_small01.png
- %PROGRAM_FILES%\5DGame\skin\default\top_restore02.png
- %PROGRAM_FILES%\5DGame\skin\default\top_close03.png
- %PROGRAM_FILES%\5DGame\skin\default\top_restore01.png
- %PROGRAM_FILES%\5DGame\skin\default\tx_bg02.png
- %PROGRAM_FILES%\5DGame\skin\default\tx_bg03.png
- %PROGRAM_FILES%\5DGame\skin\default\tx_bg01.png
- %PROGRAM_FILES%\5DGame\skin\default\top_small02.png
- %PROGRAM_FILES%\5DGame\skin\default\top_small03.png
- %PROGRAM_FILES%\5DGame\skin\default\ico_gr.png
- %PROGRAM_FILES%\wisesoft\is-026EM.tmp
- %PROGRAM_FILES%\wisesoft\is-LE7EM.tmp
- %PROGRAM_FILES%\wisesoft\is-81A4B.tmp
- %PROGRAM_FILES%\wisesoft\is-VA911.tmp
- %PROGRAM_FILES%\wisesoft\is-4M8OH.tmp
- %PROGRAM_FILES%\wisesoft\is-95AR0.tmp
- %PROGRAM_FILES%\wisesoft\is-9DV8E.tmp
- %PROGRAM_FILES%\wisesoft\is-5V10I.tmp
- %PROGRAM_FILES%\wisesoft\is-M4LBS.tmp
- %PROGRAM_FILES%\wisesoft\is-0TFG4.tmp
- %PROGRAM_FILES%\wisesoft\is-64AGR.tmp
- %TEMP%\is-M1M23.tmp\reg.gg
- %PROGRAM_FILES%\wisesoft\is-OEOMJ.tmp
- %TEMP%\is-M1M23.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-UH5RD.tmp\is-80FET.tmp
- %TEMP%\is-M1M23.tmp\_isetup\_RegDLL.tmp
- %PROGRAM_FILES%\wisesoft\is-IBL68.tmp
- %PROGRAM_FILES%\wisesoft\is-CPTJK.tmp
- %PROGRAM_FILES%\wisesoft\is-373U7.tmp
- %PROGRAM_FILES%\wisesoft\is-8TRME.tmp
- %PROGRAM_FILES%\wisesoft\is-KEVJR.tmp
- %PROGRAM_FILES%\wisesoft\unins000.dat
- %PROGRAM_FILES%\5DGame\skin\default\ep_left03.png
- %PROGRAM_FILES%\5DGame\skin\default\ep_right01.png
- %PROGRAM_FILES%\5DGame\skin\default\ep_left02.png
- C:\csrss.dat
- %PROGRAM_FILES%\5DGame\skin\default\ep_left01.png
- %PROGRAM_FILES%\5DGame\skin\default\game_btn03.png
- %PROGRAM_FILES%\5DGame\skin\default\ico_cz.png
- %PROGRAM_FILES%\5DGame\skin\default\game_btn02.png
- %PROGRAM_FILES%\5DGame\skin\default\ep_right02.png
- %PROGRAM_FILES%\5DGame\skin\default\ep_right03.png
- %PROGRAM_FILES%\5DGame\skin\default\dir_bg.png
- %PROGRAM_FILES%\5DGame\skin\skin.xml.bak
- %PROGRAM_FILES%\5DGame\skin\default\Thumbs.db
- %PROGRAM_FILES%\5DGame\skin\skin.xml
- %TEMP%\nst2.tmp
- %TEMP%\nso3.tmp\System.dll
- %PROGRAM_FILES%\5DGame\skin\default\bg_main.png
- %PROGRAM_FILES%\5DGame\skin\default\bg_popup.png
- %PROGRAM_FILES%\5DGame\skin\default\bg_hide.png
- %PROGRAM_FILES%\5DGame\skin\default\adbtn_bg02.png
- %PROGRAM_FILES%\5DGame\skin\default\bg_game.png
Удаляет следующие файлы:
- %TEMP%\is-M1M23.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-UH5RD.tmp\is-80FET.tmp
- %TEMP%\is-M1M23.tmp\reg.gg
- %TEMP%\is-M1M23.tmp\_isetup\_RegDLL.tmp
Другое:
Ищет следующие окна:
- ClassName: 'RegEdit_RegEdit' WindowName: ''
- ClassName: '5DCLIENT_CLASS' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
