Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'blinkxgate' = '%PROGRAM_FILES%\Blinkx\blinkx.exe -gate30'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'blinkx' = '%PROGRAM_FILES%\Blinkx\blinkxclient.exe -min'
- [<HKCU>\Control Panel\Desktop] 'SCRNSAVE.EXE' = '<SYSTEM32>\ssblinkx.scr'
Вредоносные функции:
Создает и запускает на исполнение:
- %PROGRAM_FILES%\Blinkx\blinkxclient.exe
- %PROGRAM_FILES%\Blinkx\blinkx.exe -gate
- %PROGRAM_FILES%\Blinkx\blinkxgui.exe
- <SYSTEM32>\ssblinkx.scr /S
- %PROGRAM_FILES%\Blinkx\blinkx.exe -startgate
- %TEMP%\blinkxdiag.exe -firewall A -nodiag
- %TEMP%\blinkxstop.exe
- %PROGRAM_FILES%\Blinkx\blinkxstop.exe -install2
- %TEMP%\blinkxdiag.exe -antivirus -nodiag
Изменения в файловой системе:
Создает следующие файлы:
- %PROGRAM_FILES%\Blinkx\templates\logo_blinkxbeat_s.png
- %PROGRAM_FILES%\Blinkx\templates\logo_blinkxbeat_installer.png
- %PROGRAM_FILES%\Blinkx\templates\messagedefault2.PNG
- %PROGRAM_FILES%\Blinkx\templates\logo_projectstetson.png
- %PROGRAM_FILES%\Blinkx\templates\live.bmp
- %PROGRAM_FILES%\Blinkx\templates\down.bmp
- %PROGRAM_FILES%\Blinkx\templates\data.html
- %PROGRAM_FILES%\Blinkx\templates\left.bmp
- %PROGRAM_FILES%\Blinkx\templates\google.bmp
- %PROGRAM_FILES%\Blinkx\templates\sf_1.bmp
- %PROGRAM_FILES%\Blinkx\templates\sf_0.bmp
- %PROGRAM_FILES%\Blinkx\templates\sf_11.bmp
- %PROGRAM_FILES%\Blinkx\templates\sf_10.bmp
- %PROGRAM_FILES%\Blinkx\templates\settings2.html
- %PROGRAM_FILES%\Blinkx\templates\play_tutorial.PNG
- %PROGRAM_FILES%\Blinkx\templates\picobar.png
- %PROGRAM_FILES%\Blinkx\templates\search.bmp
- %PROGRAM_FILES%\Blinkx\templates\right.bmp
- %PROGRAM_FILES%\Blinkx\templates\close.bmp
- %PROGRAM_FILES%\Blinkx\vari\cy5
- %PROGRAM_FILES%\Blinkx\vari\cy4
- %PROGRAM_FILES%\Blinkx\vari\e0a
- %PROGRAM_FILES%\Blinkx\vari\e0
- %PROGRAM_FILES%\Blinkx\vari\cy3
- %PROGRAM_FILES%\Blinkx\vari\cy0
- %PROGRAM_FILES%\Blinkx\vari\cg5
- %PROGRAM_FILES%\Blinkx\vari\cy2
- %PROGRAM_FILES%\Blinkx\vari\cy1
- %PROGRAM_FILES%\Blinkx\templates\Thumbs.db
- %PROGRAM_FILES%\Blinkx\vari\x0
- %PROGRAM_FILES%\Blinkx\templates\blinkx.png
- %PROGRAM_FILES%\Blinkx\templates\blinkx.bmp
- %PROGRAM_FILES%\Blinkx\vari\userchannel.bmp
- %PROGRAM_FILES%\Blinkx\vari\s0
- %PROGRAM_FILES%\Blinkx\vari\q0
- %PROGRAM_FILES%\Blinkx\vari\sf
- %PROGRAM_FILES%\Blinkx\vari\s0a
- %PROGRAM_FILES%\Blinkx\templates\userchannels.js
- %PROGRAM_FILES%\Blinkx\templates\userchannel.htm
- %PROGRAM_FILES%\Blinkx\templates\yahoo.bmp
- %PROGRAM_FILES%\Blinkx\templates\wait.gif
- %PROGRAM_FILES%\Blinkx\templates\user_channel.bmp
- %PROGRAM_FILES%\Blinkx\templates\template7.htm
- %PROGRAM_FILES%\Blinkx\templates\template6.htm
- %PROGRAM_FILES%\Blinkx\templates\toolcfgdata2.html
- %PROGRAM_FILES%\Blinkx\templates\template8.htm
- %PROGRAM_FILES%\Blinkx\templates\uninstallB.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\stats[1].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\screensaver3[1].php
- %PROGRAM_FILES%\Blinkx\bhookxB.dll
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\updater[1].php
- %HOMEPATH%\Desktop\blinkx beat.lnk
- %HOMEPATH%\Start Menu\Programs\blinkx beat\blinkx beat.lnk
- %PROGRAM_FILES%\Blinkx\blinkx.ico
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\blinkx beat.lnk
- %PROGRAM_FILES%\Blinkx\templates\template5.htm
- %PROGRAM_FILES%\Blinkx\templates\sf_7.bmp
- %PROGRAM_FILES%\Blinkx\templates\sf_6.bmp
- %PROGRAM_FILES%\Blinkx\templates\sf_9.bmp
- %PROGRAM_FILES%\Blinkx\templates\sf_8.bmp
- %PROGRAM_FILES%\Blinkx\templates\sf_5.bmp
- %PROGRAM_FILES%\Blinkx\templates\sf_2.bmp
- %PROGRAM_FILES%\Blinkx\templates\sf_12.bmp
- %PROGRAM_FILES%\Blinkx\templates\sf_4.bmp
- %PROGRAM_FILES%\Blinkx\templates\sf_3.bmp
- %PROGRAM_FILES%\Blinkx\templates\template2.htm
- %PROGRAM_FILES%\Blinkx\templates\template12.htm
- %PROGRAM_FILES%\Blinkx\templates\template4.htm
- %PROGRAM_FILES%\Blinkx\templates\template3.htm
- %PROGRAM_FILES%\Blinkx\templates\template11.htm
- %PROGRAM_FILES%\Blinkx\templates\template0.htm
- %PROGRAM_FILES%\Blinkx\templates\swfobject.js
- %PROGRAM_FILES%\Blinkx\templates\template10.htm
- %PROGRAM_FILES%\Blinkx\templates\template1.htm
- %PROGRAM_FILES%\Blinkx\vari\cg4
- %PROGRAM_FILES%\Blinkx\help_im\Thumbs.db
- %PROGRAM_FILES%\Blinkx\help_im\learn-more.gif
- %PROGRAM_FILES%\Blinkx\help_im\index.html
- %PROGRAM_FILES%\Blinkx\blinkxstop.exe
- %TEMP%\blinkxdiag.exe
- %PROGRAM_FILES%\Blinkx\templates\uninstall.exe
- %PROGRAM_FILES%\Blinkx\lang.dll
- %TEMP%\lang.dll
- %PROGRAM_FILES%\Blinkx\blinkxav.exe
- %PROGRAM_FILES%\Blinkx\blinkxclient.exe
- %PROGRAM_FILES%\Blinkx\config2.exe
- %PROGRAM_FILES%\Blinkx\vari.xcp
- %PROGRAM_FILES%\Blinkx\blinkxgui.exe
- %PROGRAM_FILES%\Blinkx\bhookx.dll
- %PROGRAM_FILES%\Blinkx\help_im\logo.gif
- %PROGRAM_FILES%\Blinkx\blinkx.exe
- %PROGRAM_FILES%\Blinkx\query.exe
- %HOMEPATH%\Start Menu\Programs\blinkx beat\Uninstall.lnk
- %PROGRAM_FILES%\Blinkx\templates\logo-black.png
- %PROGRAM_FILES%\Blinkx\templates\logo.png
- %PROGRAM_FILES%\Blinkx\templates\index.html
- %PROGRAM_FILES%\Blinkx\templates\quit.png
- %PROGRAM_FILES%\Blinkx\templates\logo.bmp
- %TEMP%\blinkxstop.exe
- %TEMP%\nsp2.tmp
- %PROGRAM_FILES%\Blinkx\templates\saver.ico
- <SYSTEM32>\ssblinkx.scr
- %PROGRAM_FILES%\Blinkx\templates\controls.swf
- %PROGRAM_FILES%\Blinkx\templates\settings.html
- %PROGRAM_FILES%\Blinkx\templates\quick2.swf
- %PROGRAM_FILES%\Blinkx\templates\controls-offline.swf
- %PROGRAM_FILES%\Blinkx\templates\noflash.html
- %PROGRAM_FILES%\Blinkx\templates\standalone.jpg
- %PROGRAM_FILES%\Blinkx\templates\integrated.jpg
- %PROGRAM_FILES%\Blinkx\templates\offline.swf
- %PROGRAM_FILES%\Blinkx\templates\offline.html
- %PROGRAM_FILES%\Blinkx\vari\71
- %PROGRAM_FILES%\Blinkx\vari\70
- %PROGRAM_FILES%\Blinkx\vari\81
- %PROGRAM_FILES%\Blinkx\vari\80
- %PROGRAM_FILES%\Blinkx\vari\61
- %PROGRAM_FILES%\Blinkx\vari\50
- %PROGRAM_FILES%\Blinkx\vari\41
- %PROGRAM_FILES%\Blinkx\vari\60
- %PROGRAM_FILES%\Blinkx\vari\51
- %PROGRAM_FILES%\Blinkx\vari\cg1
- %PROGRAM_FILES%\Blinkx\vari\cg0
- %PROGRAM_FILES%\Blinkx\vari\cg3
- %PROGRAM_FILES%\Blinkx\vari\cg2
- %PROGRAM_FILES%\Blinkx\vari\b0a
- %PROGRAM_FILES%\Blinkx\vari\91
- %PROGRAM_FILES%\Blinkx\vari\90
- %PROGRAM_FILES%\Blinkx\vari\b0
- %PROGRAM_FILES%\Blinkx\vari\Thumbs.db
- %PROGRAM_FILES%\Blinkx\vari\40
- %PROGRAM_FILES%\Blinkx\vari\10
- %PROGRAM_FILES%\Blinkx\vari\01
- %PROGRAM_FILES%\Blinkx\vari\101
- %PROGRAM_FILES%\Blinkx\vari\100
- %PROGRAM_FILES%\Blinkx\vari\00
- %PROGRAM_FILES%\Blinkx\blinkxclient.exe.manifest
- %PROGRAM_FILES%\Blinkx\blinkx.exe.manifest
- %PROGRAM_FILES%\Blinkx\config2.exe.manifest
- %PROGRAM_FILES%\Blinkx\blinkxstop.exe.manifest
- %PROGRAM_FILES%\Blinkx\vari\21
- %PROGRAM_FILES%\Blinkx\vari\20
- %PROGRAM_FILES%\Blinkx\vari\31
- %PROGRAM_FILES%\Blinkx\vari\30
- %PROGRAM_FILES%\Blinkx\vari\121
- %PROGRAM_FILES%\Blinkx\vari\110
- %PROGRAM_FILES%\Blinkx\vari\11
- %PROGRAM_FILES%\Blinkx\vari\120
- %PROGRAM_FILES%\Blinkx\vari\111
Сетевая активность:
Подключается к:
- 'localhost':1039
- 'sc######verstats.blinkx.com':80
- 'www.bl##kx.com':80
TCP:
Запросы HTTP GET:
- www.bl##kx.com/screensaver3/screensaver3.php?Sh######################################################################################################################################
- sc######verstats.blinkx.com/tvphp/screensaver/stats.php?ac#########################################################################################
- www.bl##kx.com/screensaver3//updater.php?ve###################################################################################################
UDP:
- DNS ASK sc######verstats.blinkx.com
- DNS ASK www.bl##kx.com
Другое:
Ищет следующие окна:
- ClassName: '#32770' WindowName: 'Blinkx unpacker'
- ClassName: '' WindowName: 'blinkx'
- ClassName: '' WindowName: 'blinkx gate'
- ClassName: 'blinkxGuiServer' WindowName: ''
- ClassName: '#32770' WindowName: 'blinkx'
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'Indicator' WindowName: ''
- ClassName: 'blinkxFileScan' WindowName: ''
- ClassName: 'blinkxPDRE4' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: '' WindowName: 'blinkx main'
- ClassName: '#32770' WindowName: 'Please exit Microsoft Outlook now!'
- ClassName: '' WindowName: 'blinkx beat settings'
- ClassName: '#32770' WindowName: 'blinkx settings'
