Trojan.KillProc.18153

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Internet Explorer\Extensions\{F049B797-1F92-480D-8C75-B613BCD335F3}] 'Exec' = 'http://www.58pilot.net/test.html'

Вредоносные функции:

Запускает на исполнение:

<SYSTEM32>\reg.exe Add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{F049B797-1F92-480D-8C75-B613BCD335F3}" /v "" /t "REG_SZ" /d "" /f
<SYSTEM32>\reg.exe delete "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{F049B797-1F92-480D-8C75-B613BCD335F3}" /f
<SYSTEM32>\reg.exe Add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{F049B797-1F92-480D-8C75-B613BCD335F3}" /v "ButtonText" /t "REG_SZ" /d "╡у╗ў╕№╢р╛л▓╩" /f
<SYSTEM32>\reg.exe Add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{F049B797-1F92-480D-8C75-B613BCD335F3}" /v "Default Visible" /t "REG_SZ" /d "Yes" /f
<SYSTEM32>\reg.exe delete "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FF065BE-0F56-403d-BE32-B5847BF5E20A}" /f
<SYSTEM32>\reg.exe delete "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ClickDll.IEDll.1\CLSID" /f
<SYSTEM32>\reg.exe delete "HLM\SOFTWARE\Kungho\USH" /f
<SYSTEM32>\reg.exe delete "HKEY_LOCAL_MACHINE\SOFTWARE\Kungho\BBL" /f
<SYSTEM32>\reg.exe Add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{F049B797-1F92-480D-8C75-B613BCD335F3}" /v "CLSID" /t "REG_SZ" /d "{1FBA04EE-3024-11d2-8F1F-0000F87ABD16}" /f
<SYSTEM32>\reg.exe Add "HKEY_CLASSES_ROOT\CLSID\{52FC47BD-4EFC-4cb1-B749-06C575E42410}\InprocServer32" /v "" /t "REG_SZ" /d "%PROGRAM_FILES%\szwbcm\star.dll" /f
<SYSTEM32>\regsvr32.exe /s star.dll
<SYSTEM32>\reg.exe Add "HKEY_CLASSES_ROOT\TypeLib\{5BF85DAD-C057-4073-972E-39D6A448BDFB}\1.0\0\win32" /v "" /t "REG_SZ" /d "%PROGRAM_FILES%\szwbcm\star.dll" /f
<SYSTEM32>\reg.exe Add "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{52FC47BD-4EFC-4cb1-B749-06C575E42410}\InprocServer32" /v "" /t "REG_SZ" /d "%PROGRAM_FILES%\szwbcm\star.dll" /f
<SYSTEM32>\reg.exe Add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{F049B797-1F92-480D-8C75-B613BCD335F3}" /v "HotIcon" /t "REG_SZ" /d "C:\\Program Files\\Internet Explorer\\IE.ico" /f
<SYSTEM32>\reg.exe Add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{F049B797-1F92-480D-8C75-B613BCD335F3}" /v "Icon" /t "REG_SZ" /d "C:\\Program Files\\Internet Explorer\\IE.ico" /f
<SYSTEM32>\reg.exe Add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{F049B797-1F92-480D-8C75-B613BCD335F3}" /v "Exec" /t "REG_SZ" /d "http://www.58##lot.net/test.html" /f
<SYSTEM32>\reg.exe Add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{F049B797-1F92-480D-8C75-B613BCD335F3}" /v "IeakPolicy" /t "REG_SZ" /d "" /f
<SYSTEM32>\reg.exe delete "HKEY_CLASSES_ROOT\CLSID\{5C696E52-BF38-49A8-9017-ACE15A794707}\InprocServer32" /f
<SYSTEM32>\regsvr32.exe /u /s <SYSTEM32>\bbns.dll
<SYSTEM32>\reg.exe delete "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C696E52-BF38-49A8-9017-ACE15A794707}\InprocServer32" /f
<SYSTEM32>\reg.exe delete "HKEY_CLASSES_ROOT\TypeLib\{50C8DD55-8ABE-42B9-B005-98FC0EDC8BD3}\1.5\0\win32" /f
<SYSTEM32>\taskkill.exe /f /im wxplus_08.wxe
<SYSTEM32>\ping.exe -n 20 127.0.0.1
<SYSTEM32>\regsvr32.exe /u /s <SYSTEM32>\IEExtend.dll
<SYSTEM32>\taskkill.exe /f /im wxprolife.wxe
<SYSTEM32>\reg.exe delete "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{50C8DD55-8ABE-42B9-B005-98FC0EDC8BD3}\1.5\0\win32" /f
<SYSTEM32>\regsvr32.exe /u /s "D:/GameMenu/Data/HintBrowser.dll"
<SYSTEM32>\regsvr32.exe /u /s "<SYSTEM32>\SafeBrowser.dll"
<SYSTEM32>\reg.exe delete "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ClickDll.IEDll\CLSID" /f
<SYSTEM32>\reg.exe delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{8FF065BE-0F56-403D-BE32-B5847BF5E20A}" /f
<SYSTEM32>\reg.exe delete "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4391B2A-6A07-4FC2-A4A8-D44431EE590D}\InprocServer32" /f
<SYSTEM32>\reg.exe delete "HKEY_CLASSES_ROOT\CLSID\{D4391B2A-6A07-4FC2-A4A8-D44431EE590D}\InprocServer32" /f
<SYSTEM32>\regsvr32.exe /u /s "E:\NBMSClient\ClientEx.dll"
<SYSTEM32>\regsvr32.exe /u /s "E:\NBMSClient\SunwardIeSafe.dll"