Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Active Setup\Installed Components\{de5aed00-a4bf-11d1-9948-00c04f98bbc9}] 'StubPath' = 'cmd.exe /Q /T:88 /C vol&set n0=%ProgramFiles%\NetMeeting\&start "CheckUpdate" ...
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\Microsoft Windows Upd.job
- %WINDIR%\Tasks\360 Startup Check.job
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\160WifiSrv] 'ImagePath' = '"%CommonProgramFiles%\okwifi\Wifiservice.exe"'
- [<HKLM>\SYSTEM\ControlSet001\Services\160WifiSrv] 'Start' = '00000002'
Изменения в файловой системе:
Создает следующие файлы:
- <SYSTEM32>\wbem\AutoRecover\C8463ECBE33BC240263A0B094E46D510.mof
- %TEMP%\tmp3.tmp
- <SYSTEM32>\wbem\AutoRecover\23BDE61F1F4FACE17E9B0C01F2A1FD9B.mof
- %ProgramFiles%\Google\Chrome-\res\isfirst.txt
- %TEMP%\tmp1.tmp
- %TEMP%\tmp2.tmp
Присваивает атрибут 'скрытый' для следующих файлов:
- %WINDIR%\Tasks\360 Startup Check.job
- %WINDIR%\Tasks\Microsoft Windows Upd.job
Удаляет следующие файлы:
- %TEMP%\tmp3.tmp
- %TEMP%\tmp2.tmp
- %TEMP%\tmp1.tmp
Другое:
Ищет следующие окна:
- ClassName: 'RegEdit_RegEdit' WindowName: ''
Запускает на исполнение:
- '<SYSTEM32>\cacls.exe' "%ProgramFiles%\Google\Chrome-\*" /p everyone:R /C
- '<SYSTEM32>\attrib.exe' +s +h +r "%WINDIR%\Tasks\Microsoft Windows Upd.job"
- '<SYSTEM32>\schtasks.exe' /change /tn "Smart360 Defrag Schedule" /ENABLE
- '<SYSTEM32>\cacls.exe' "<SYSTEM32>\Tasks\360 Startup Check" /p SYSTEM:R /C
- '<SYSTEM32>\cacls.exe' "%ProgramFiles%\Google\Chrome-\res" /p everyone:F /C
- '<SYSTEM32>\attrib.exe' +s +r +h "%WINDIR%\Tasks\360 Startup Check.job"
- '<SYSTEM32>\cmd.exe' /Q /C vol&for /f "skip=1 tokens=1 delims=" %i IN ('wmic process where "name='AliimSafe.exe' or name='AliIMSrv.exe' or name='wwbizsrv.exe' or name='alipaysafetran.exe' or name='alicnotify.exe ' ...
- '<SYSTEM32>\schtasks.exe' /change /tn "Microsoft Windows Upd" /ENABLE
- '<SYSTEM32>\attrib.exe' -s -r -h "%ProgramFiles%\Google\Chrome-\*.bat"
- '<SYSTEM32>\cacls.exe' "%CommonProgramFiles%\Service" /p SYSTEM:F /C
- '<SYSTEM32>\attrib.exe' +s +r +h "<SYSTEM32>\Tasks\Smart360 Defrag Checking"
- '<SYSTEM32>\cacls.exe' "<SYSTEM32>\Tasks\Microsoft Windows Upd" /p SYSTEM:R /C
- '<SYSTEM32>\cacls.exe' "%ProgramFiles%\NetMeeting\*.bat" /p SYSTEM:N administrators:R users:R /C
- '<SYSTEM32>\attrib.exe' -s -r -h "%ProgramFiles%\Google\Chrome-\res"
- '<SYSTEM32>\cacls.exe' "systemroot%\System32\Tasks\Smart360 Defrag Schedule" /p SYSTEM:R /C
- '<SYSTEM32>\cacls.exe' "%WINDIR%\Tasks\360 Startup Check.job" /p SYSTEM:F /C
- '<SYSTEM32>\attrib.exe' +s +h +r "systemroot%\System32\Tasks\Smart360 Defrag Schedule"
- '<SYSTEM32>\attrib.exe' +s +r +h "%CommonProgramFiles%\Thunder\*" /s
- '<SYSTEM32>\cacls.exe' "systemroot%\Tasks\Smart360 Defrag Schedule.job" /p SYSTEM:F /C
- '<SYSTEM32>\cacls.exe' "%CommonProgramFiles%\Thunder\*" /t /p SYSTEM:R /C
- '<SYSTEM32>\attrib.exe' +s +h +r "systemroot%\Tasks\Smart360 Defrag Schedule.job"
- '<SYSTEM32>\cacls.exe' "%ProgramFiles%\Google\Chrome-\SaySomething.mp4" /p SYSTEM:R /C
- '<SYSTEM32>\cacls.exe' "<SYSTEM32>\Tasks\@НшВз±ЈпЪєуМЁ±Ј»¤(ЅЁТй±ЈБф)" /p SYSTEM:R /C
- '<SYSTEM32>\cmd.exe' /c wmic process where "name='AliimSafe.exe' or name='AliIMSrv.exe' or name='wwbizsrv.exe' or name='alipaysafetran.exe' or name='alicnotify.exe ' or name='AlipaySecSvc.exe' or name='pcas.exe' or...
- '<SYSTEM32>\cacls.exe' "%WINDIR%\Tasks\Microsoft Windows Upd.job" /p SYSTEM:F /C
- '<SYSTEM32>\cacls.exe' "%CommonProgramFiles%\lntel" /t /p SYSTEM:R /C
- '<SYSTEM32>\attrib.exe' +s +r +h "%CommonProgramFiles%\lntel\*"
- '<SYSTEM32>\cacls.exe' "<SYSTEM32>\Tasks\Smart360 Defrag Checking" /p SYSTEM:R /C
- '<SYSTEM32>\cacls.exe' "%ProgramFiles%\NetMeeting\*.lnk" /p SYSTEM:N administrators:R users:R /C
- '<SYSTEM32>\cacls.exe' "%ProgramFiles%\Google\Chrome-\res" /t /p everyone:F /C
- '<SYSTEM32>\cmd.exe' /S /D /c" echo y"
- '%WINDIR%\regedit.exe' /s "%ProgramFiles%\Google\Chrome-\res\tm.reg"
- '<SYSTEM32>\reg.exe' IMPORT "%ProgramFiles%\Google\Chrome-\res\HKLM.reg"
- '<SYSTEM32>\cmd.exe' /Q /c vol®ini.exe "%ProgramFiles%\Google\Chrome-\res\reg.ini" &md "%ProgramFiles%\NetMeeting"&echo y|cacls "%ProgramFiles%\NetMeeting" /p SYSTEM:W administrators:C users:C /C&md "%CommonProg...
- '<SYSTEM32>\cmd.exe' /Q /c vol&attrib +s +r +h "%CommonProgramFiles%\okwifi\*" /s &echo y|cacls "%CommonProgramFiles%\okwifi" /t /p SYSTEM:R /C&attrib +s +r +h "%ProgramFiles%\Google\Chrome-\*" &attrib -s -r -h "%P...
- '<SYSTEM32>\reg.exe' IMPORT "%ProgramFiles%\Google\Chrome-\res\tm.reg"
- '<SYSTEM32>\schtasks.exe' /create /tn "360 Startup Check" /tr "cmd.exe /c vol&set bv=SaySome&cmd.exe /Q /C start /ABOVENORMAL \"alg.exe\" rundll32.exe \"%ProgramFiles%\Google\Chrome-\%bv%thing.mp4\",start&exit" /sc onst...
- '<SYSTEM32>\sc.exe' config 160WifiSrv type= interact type= own start= auto displayname= "Wireless LANs Services" binpath= "\"%CommonProgramFiles%\okwifi\WifiService.exe\""
- '<SYSTEM32>\sc.exe' create 160WifiSrv type= interact type= own start= auto displayname= "Wireless LANs Services" binpath= "\"%CommonProgramFiles%\okwifi\Wifiservice.exe\"" obj= LocalSystem
- '<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{de5aed00-a4bf-11d1-9948-00c04f98bbc9}" /v StubPath /t REG_EXPAND_SZ /d "cmd.exe /Q /T:88 /C vol&set n0=%ProgramFile...
- '<SYSTEM32>\cmd.exe' /Q /c mkdir "%ProgramFiles%\Google\Chrome-\res" &echo y|cacls "%ProgramFiles%\Google\Chrome-\res" /t /p everyone:F /C&echo 11>"%ProgramFiles%\Google\Chrome-\res\isfirst.txt"&exit
- '<SYSTEM32>\schtasks.exe' /create /tn "Microsoft Windows Upd" /tr "\"%CommonProgramFiles%\lntel\svrhost.exe\"" /sc onstart /ru system /RL HIGHEST /F
- '<SYSTEM32>\schtasks.exe' /create /tn "Microsoft Windows Upd" /tr "\"%CommonProgramFiles%\lntel\svrhost.exe\"" /sc onstart /ru system
- '<SYSTEM32>\schtasks.exe' /change /tn "Smart360 Defrag Checking" /ENABLE
- '<SYSTEM32>\cacls.exe' "%ProgramFiles%\NetMeeting" /p SYSTEM:W administrators:C users:C /C
- '<SYSTEM32>\attrib.exe' +s +h +r "<SYSTEM32>\Tasks\Microsoft Windows Upd"
- '<SYSTEM32>\attrib.exe' +s +r +h "<SYSTEM32>\Tasks\@НшВз±ЈпЪєуМЁ±Ј»¤(ЅЁТй±ЈБф)"
- '<SYSTEM32>\attrib.exe' +s +r +h "<SYSTEM32>\Tasks\360 Startup Check"
- '<SYSTEM32>\schtasks.exe' /change /tn "360 Startup Check" /ENABLE
- '<SYSTEM32>\attrib.exe' +s +r +h "%ProgramFiles%\Google\Chrome-\*"
- '<SYSTEM32>\cmd.exe' /Q /C vol&attrib +s +h +r "<SYSTEM32>\Tasks\Microsoft Windows Upd" &attrib +s +r +h "<SYSTEM32>\Tasks\@НшВз±ЈпЪєуМЁ±Ј»¤(ЅЁТй±ЈБф)" &attrib +s +r +h "<SYSTEM32>\Tasks\360 Startup Check" &attrib ...
- '<SYSTEM32>\cmd.exe' /Q /c vol&schtasks /change /tn "@НшВз±ЈпЪєуМЁ±Ј»¤(ЅЁТй±ЈБф)" /ENABLE&schtasks /change /tn "Smart360 Defrag Checking" /ENABLE&schtasks /change /tn "360 Startup Check" /ENABLE&schtasks /change /t...
- '<SYSTEM32>\attrib.exe' +s +r +h "%CommonProgramFiles%\okwifi\*" /s
- '<SYSTEM32>\regini.exe' "%ProgramFiles%\Google\Chrome-\res\reg.ini"
- '<SYSTEM32>\schtasks.exe' /change /tn "@НшВз±ЈпЪєуМЁ±Ј»¤(ЅЁТй±ЈБф)" /ENABLE
- '<SYSTEM32>\cmd.exe' /Q /C vol&echo y|cacls "%ProgramFiles%\NetMeeting\*.lnk" /p SYSTEM:N administrators:R users:R /C&echo y|cacls "%ProgramFiles%\NetMeeting\*.bat" /p SYSTEM:N administrators:R users:R /C&attrib +s...
- '<SYSTEM32>\cacls.exe' "%CommonProgramFiles%\okwifi" /t /p SYSTEM:R /C
