Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- <Служебный элемент>
- [<HKLM>\SOFTWARE\Classes\https\shell\open\command] '' = '"%PROGRAM_FILES%\iie\iie.exe" "%1"'
- [<HKLM>\SOFTWARE\Clients\StartMenuInternet\iie.exe\shell\open\command] '' = '"%PROGRAM_FILES%\iie\iie.exe"'
- [<HKLM>\SOFTWARE\Classes\ftp\shell\open\command] '' = '"%PROGRAM_FILES%\iie\iie.exe" "%1"'
- [<HKLM>\SOFTWARE\Classes\InternetShortcut\shell\open\command] '' = '"%PROGRAM_FILES%\iie\iie.exe" "%1"'
- [<HKLM>\SOFTWARE\Classes\htmlfile\shell\open\command] '' = '"%PROGRAM_FILES%\iie\iie.exe" "%1"'
- [<HKLM>\SOFTWARE\Classes\HTTP\shell\open\command] '' = '"%PROGRAM_FILES%\iie\iie.exe" "%1"'
- [<HKLM>\SOFTWARE\Classes\mhtmlfile\shell\open\command] '' = '"%PROGRAM_FILES%\iie\iie.exe" "%1"'
Вредоносные функции:
Для обхода брандмауэра удаляет или модифицирует следующие ключи реестра:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\iie\iie.exe' = '%PROGRAM_FILES%\iie\iie.exe:*:Enabled:iie'
Создает и запускает на исполнение:
- %PROGRAM_FILES%\iie\iie.exe -Install
Изменения в файловой системе:
Создает следующие файлы:
- %PROGRAM_FILES%\iie\skin\Default\toolbar\16_font_size.png
- %PROGRAM_FILES%\iie\skin\Default\toolbar\16_find.png
- %PROGRAM_FILES%\iie\skin\Default\toolbar\16_form_filler.png
- %PROGRAM_FILES%\iie\skin\Default\toolbar\16_history.png
- %PROGRAM_FILES%\iie\skin\Default\toolbar\16_forward.png
- %PROGRAM_FILES%\iie\skin\Default\toolbar\16_feed.png
- %PROGRAM_FILES%\iie\skin\Default\toolbar\16_back.png
- %PROGRAM_FILES%\iie\skin\Default\misc\16_website_info.png
- %PROGRAM_FILES%\iie\skin\Default\toolbar\16_download.png
- %PROGRAM_FILES%\iie\skin\Default\toolbar\16_favorites.png
- %PROGRAM_FILES%\iie\skin\Default\toolbar\16_encoding.png
- %PROGRAM_FILES%\iie\skin\Default\toolbar\16_history_menu.png
- %PROGRAM_FILES%\iie\skin\Default\toolbar\16_proxy.png
- %PROGRAM_FILES%\iie\skin\Default\toolbar\16_print.png
- %PROGRAM_FILES%\iie\skin\Default\toolbar\16_refresh.png
- %PROGRAM_FILES%\iie\skin\Default\toolbar\16_search.png
- %PROGRAM_FILES%\iie\skin\Default\toolbar\16_save.png
- %PROGRAM_FILES%\iie\skin\Default\toolbar\16_page_zoom.png
- %PROGRAM_FILES%\iie\skin\Default\toolbar\16_layout.png
- %PROGRAM_FILES%\iie\skin\Default\toolbar\16_home.png
- %PROGRAM_FILES%\iie\skin\Default\toolbar\16_new.png
- %PROGRAM_FILES%\iie\skin\Default\toolbar\16_page_content.png
- %PROGRAM_FILES%\iie\skin\Default\toolbar\16_options.png
- %PROGRAM_FILES%\iie\skin\Default\misc\16_plugins.png
- %PROGRAM_FILES%\iie\skin\Default\misc\16_page.png
- %PROGRAM_FILES%\iie\skin\Default\misc\16_profile.png
- %PROGRAM_FILES%\iie\skin\Default\misc\16_proxy_mono.png
- %PROGRAM_FILES%\iie\skin\Default\misc\16_proxy_advanced.png
- %PROGRAM_FILES%\iie\skin\Default\misc\16_open_in_new.png
- %PROGRAM_FILES%\iie\skin\Default\misc\16_in_progress.png
- %PROGRAM_FILES%\iie\skin\Default\misc\16_hot_fav.png
- %PROGRAM_FILES%\iie\skin\Default\misc\16_info.png
- %PROGRAM_FILES%\iie\skin\Default\misc\16_open_in_bg.png
- %PROGRAM_FILES%\iie\skin\Default\misc\16_new.png
- %PROGRAM_FILES%\iie\skin\Default\misc\16_question.png
- %PROGRAM_FILES%\iie\skin\Default\misc\16_up.png
- %PROGRAM_FILES%\iie\skin\Default\misc\16_trashcan.png
- %PROGRAM_FILES%\iie\skin\Default\misc\16_up_level.png
- %PROGRAM_FILES%\iie\skin\Default\misc\16_views.png
- %PROGRAM_FILES%\iie\skin\Default\misc\16_validate.png
- %PROGRAM_FILES%\iie\skin\Default\misc\16_translate.png
- %PROGRAM_FILES%\iie\skin\Default\misc\16_secure.png
- %PROGRAM_FILES%\iie\skin\Default\misc\16_script_error.png
- %PROGRAM_FILES%\iie\skin\Default\misc\16_skin.png
- %PROGRAM_FILES%\iie\skin\Default\misc\16_stop.png
- %PROGRAM_FILES%\iie\skin\Default\misc\16_sniffer.png
- %PROGRAM_FILES%\iie\skin\Default\toolbar\24_security.png
- %PROGRAM_FILES%\iie\skin\Default\toolbar\24_search.png
- %PROGRAM_FILES%\iie\skin\Default\toolbar\24_service.png
- %PROGRAM_FILES%\iie\skin\Default\toolbar\24_split_screen.png
- %PROGRAM_FILES%\iie\skin\Default\toolbar\24_source.png
- %PROGRAM_FILES%\iie\skin\Default\toolbar\24_save.png
- %PROGRAM_FILES%\iie\skin\Default\toolbar\24_page_zoom.png
- %PROGRAM_FILES%\iie\skin\Default\toolbar\24_page_content.png
- %PROGRAM_FILES%\iie\skin\Default\toolbar\24_print.png
- %PROGRAM_FILES%\iie\skin\Default\toolbar\24_refresh.png
- %PROGRAM_FILES%\iie\skin\Default\toolbar\24_proxy.png
- %PROGRAM_FILES%\iie\skin\Default\toolbar\24_sshot.png
- %HOMEPATH%\Start Menu\Programs\°®ТЧдЇААЖч\°®ТЧдЇААЖч.lnk
- %PROGRAM_FILES%\iie\°®ТЧдЇААЖч.url
- %HOMEPATH%\Start Menu\Programs\°®ТЧдЇААЖч\Р¶ФШ°®ТЧдЇААЖч.lnk
- %WINDIR%\config.ini
- %PROGRAM_FILES%\iie\uninst.exe
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\°®ТЧдЇААЖч.lnk
- %PROGRAM_FILES%\iie\skin\Default\toolbar\24_tools.png
- %PROGRAM_FILES%\iie\skin\Default\toolbar\24_stop.png
- %PROGRAM_FILES%\iie\skin\Default\toolbar\24_undo.png
- %HOMEPATH%\Start Menu\°®ТЧдЇААЖч.lnk
- %HOMEPATH%\Desktop\°®ТЧдЇААЖч.lnk
- %PROGRAM_FILES%\iie\skin\Default\toolbar\16_undo.png
- %PROGRAM_FILES%\iie\skin\Default\toolbar\16_tools.png
- %PROGRAM_FILES%\iie\skin\Default\toolbar\18_history_menu.png
- %PROGRAM_FILES%\iie\skin\Default\toolbar\24_download.png
- %PROGRAM_FILES%\iie\skin\Default\toolbar\24_back.png
- %PROGRAM_FILES%\iie\skin\Default\toolbar\16_stop.png
- %PROGRAM_FILES%\iie\skin\Default\toolbar\16_service.png
- %PROGRAM_FILES%\iie\skin\Default\toolbar\16_security.png
- %PROGRAM_FILES%\iie\skin\Default\toolbar\16_source.png
- %PROGRAM_FILES%\iie\skin\Default\toolbar\16_sshot.png
- %PROGRAM_FILES%\iie\skin\Default\toolbar\16_split_screen.png
- %PROGRAM_FILES%\iie\skin\Default\toolbar\24_encoding.png
- %PROGRAM_FILES%\iie\skin\Default\toolbar\24_home.png
- %PROGRAM_FILES%\iie\skin\Default\toolbar\24_history.png
- %PROGRAM_FILES%\iie\skin\Default\toolbar\24_layout.png
- %PROGRAM_FILES%\iie\skin\Default\toolbar\24_options.png
- %PROGRAM_FILES%\iie\skin\Default\toolbar\24_new.png
- %PROGRAM_FILES%\iie\skin\Default\toolbar\24_forward.png
- %PROGRAM_FILES%\iie\skin\Default\toolbar\24_feed.png
- %PROGRAM_FILES%\iie\skin\Default\toolbar\24_favorites.png
- %PROGRAM_FILES%\iie\skin\Default\toolbar\24_find.png
- %PROGRAM_FILES%\iie\skin\Default\toolbar\24_form_filler.png
- %PROGRAM_FILES%\iie\skin\Default\toolbar\24_font_size.png
- %PROGRAM_FILES%\iie\skin\Default\control\sidebar_tab_active.png
- %PROGRAM_FILES%\iie\skin\Default\control\progress_bg.png
- %PROGRAM_FILES%\iie\skin\Default\control\sidebar_tab_inactive.png
- %PROGRAM_FILES%\iie\skin\Default\control\skin_selector_hover.png
- %PROGRAM_FILES%\iie\skin\Default\control\skin_selector.png
- %PROGRAM_FILES%\iie\skin\Default\control\progress.png
- %PROGRAM_FILES%\iie\skin\Default\control\combo_dropdown_hover.png
- %PROGRAM_FILES%\iie\skin\Default\control\combo_dropdown.png
- %PROGRAM_FILES%\iie\skin\Default\control\combo_hover.png
- %PROGRAM_FILES%\iie\skin\Default\control\mainframe.png
- %PROGRAM_FILES%\iie\skin\Default\control\loading.png
- %PROGRAM_FILES%\iie\skin\Default\control\status_bar_bg.png
- %PROGRAM_FILES%\iie\skin\Default\control\tab_close.png
- %PROGRAM_FILES%\iie\skin\Default\control\tab_bg_inactive.png
- %PROGRAM_FILES%\iie\skin\Default\control\tab_close_hover.png
- %PROGRAM_FILES%\iie\skin\Default\control\tab_inactive.png
- %PROGRAM_FILES%\iie\skin\Default\control\tab_hover.png
- %PROGRAM_FILES%\iie\skin\Default\control\tab_bg.png
- %PROGRAM_FILES%\iie\skin\Default\control\tab_bar_close.png
- %PROGRAM_FILES%\iie\skin\Default\control\tab_active.png
- %PROGRAM_FILES%\iie\skin\Default\control\tab_bar_close_all.png
- %PROGRAM_FILES%\iie\skin\Default\control\tab_bar_close_hover.png
- %PROGRAM_FILES%\iie\skin\Default\control\tab_bar_close_all_hover.png
- %PROGRAM_FILES%\iie\profile\SearchEngine\sogou.ico
- %PROGRAM_FILES%\iie\profile\SearchEngine\google.ico
- %PROGRAM_FILES%\iie\profile\SearchEngine\taobao.ico
- %PROGRAM_FILES%\iie\profile\Template\start\left.html
- %PROGRAM_FILES%\iie\profile\Template\start\index.html
- %PROGRAM_FILES%\iie\profile\SearchEngine\config.ini
- %PROGRAM_FILES%\iie\4399.ico
- %TEMP%\nsg2.tmp\task.ini
- %PROGRAM_FILES%\iie\iie.exe
- %PROGRAM_FILES%\iie\profile\SearchEngine\baidu.ico
- %PROGRAM_FILES%\iie\youku.ico
- %PROGRAM_FILES%\iie\profile\Template\start\right.html
- %PROGRAM_FILES%\iie\skin\Default\control\button_bg_pressed.png
- %PROGRAM_FILES%\iie\skin\Default\control\button_bg_hover.png
- %PROGRAM_FILES%\iie\skin\Default\control\caption_bar_bg.png
- %PROGRAM_FILES%\iie\skin\Default\control\combo.png
- %PROGRAM_FILES%\iie\skin\Default\control\caption_icon.ico
- %PROGRAM_FILES%\iie\skin\Default\control\button_bg_checked.png
- %PROGRAM_FILES%\iie\profile\Template\start\images\dian.gif
- %PROGRAM_FILES%\iie\profile\Template\start\style.css
- %PROGRAM_FILES%\iie\profile\Template\start\images\logo.gif
- %PROGRAM_FILES%\iie\skin\Default\mskin.ini
- %PROGRAM_FILES%\iie\profile\Template\start\images\logo2.gif
- %PROGRAM_FILES%\iie\skin\Default\misc\16_down.png
- %PROGRAM_FILES%\iie\skin\Default\misc\16_delete.png
- %PROGRAM_FILES%\iie\skin\Default\misc\16_edit.png
- %PROGRAM_FILES%\iie\skin\Default\misc\16_execute.png
- %PROGRAM_FILES%\iie\skin\Default\misc\16_error.png
- %PROGRAM_FILES%\iie\skin\Default\misc\16_correct.png
- %PROGRAM_FILES%\iie\skin\Default\misc\16_anti_phishing_safe.png
- %PROGRAM_FILES%\iie\skin\Default\misc\16_anti_phishing_danger.png
- %PROGRAM_FILES%\iie\skin\Default\misc\16_clean.png
- %PROGRAM_FILES%\iie\skin\Default\misc\16_collector.png
- %PROGRAM_FILES%\iie\skin\Default\misc\16_close.png
- %PROGRAM_FILES%\iie\skin\Default\misc\16_execute_hover.png
- %PROGRAM_FILES%\iie\skin\Default\misc\16_folder_open.png
- %PROGRAM_FILES%\iie\skin\Default\misc\16_folder_closed.png
- %PROGRAM_FILES%\iie\skin\Default\misc\16_go.png
- %PROGRAM_FILES%\iie\skin\Default\misc\16_highlight.png
- %PROGRAM_FILES%\iie\skin\Default\misc\16_group.png
- %PROGRAM_FILES%\iie\skin\Default\misc\16_float_button.png
- %PROGRAM_FILES%\iie\skin\Default\misc\16_feed_item.png
- %PROGRAM_FILES%\iie\skin\Default\misc\16_feed_channel.png
- %PROGRAM_FILES%\iie\skin\Default\misc\16_feed_item_enclosure.png
- %PROGRAM_FILES%\iie\skin\Default\misc\16_find.png
- %PROGRAM_FILES%\iie\skin\Default\misc\16_filter.png
- %PROGRAM_FILES%\iie\skin\Default\control\tab_sidebar.png
- %PROGRAM_FILES%\iie\skin\Default\control\tab_progress.png
- %PROGRAM_FILES%\iie\skin\Default\control\tab_sidebar_hover.png
- %PROGRAM_FILES%\iie\skin\Default\control\tab_toolbar_hover.png
- %PROGRAM_FILES%\iie\skin\Default\control\tab_toolbar.png
- %PROGRAM_FILES%\iie\skin\Default\control\tab_options_hover.png
- %PROGRAM_FILES%\iie\skin\Default\control\tab_manager_hover.png
- %PROGRAM_FILES%\iie\skin\Default\control\tab_manager.png
- %PROGRAM_FILES%\iie\skin\Default\control\tab_new.png
- %PROGRAM_FILES%\iie\skin\Default\control\tab_options.png
- %PROGRAM_FILES%\iie\skin\Default\control\tab_new_hover.png
- %PROGRAM_FILES%\iie\skin\Default\control\tab_unread.png
- %PROGRAM_FILES%\iie\skin\Default\control\win_restore_hover.png
- %PROGRAM_FILES%\iie\skin\Default\control\win_restore.png
- %PROGRAM_FILES%\iie\skin\Default\misc\16_accelerator.png
- %PROGRAM_FILES%\iie\skin\Default\misc\16_alert.png
- %PROGRAM_FILES%\iie\skin\Default\misc\16_ad_hunter.png
- %PROGRAM_FILES%\iie\skin\Default\control\win_minimize_hover.png
- %PROGRAM_FILES%\iie\skin\Default\control\win_close_hover.png
- %PROGRAM_FILES%\iie\skin\Default\control\win_close.png
- %PROGRAM_FILES%\iie\skin\Default\control\win_maximum.png
- %PROGRAM_FILES%\iie\skin\Default\control\win_minimize.png
- %PROGRAM_FILES%\iie\skin\Default\control\win_maximum_hover.png
Сетевая активность:
Подключается к:
- 'localhost':1036
Другое:
Ищет следующие окна:
- ClassName: 'IIEFrame' WindowName: ''
