Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TBSCAN.EXE] 'Debugger' = 'svhost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WEBSCANX.EXE] 'Debugger' = 'svhost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVPM.EXE ] 'Debugger' = 'svhost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AUTODOWN.EXE] 'Debugger' = 'svhost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVP.EXE ] 'Debugger' = 'svhost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TCA.EXE] 'Debugger' = 'svhost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TrojanHunter.exe] 'Debugger' = 'svhost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ravtimer.exe] 'Debugger' = 'svhost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\THGUARD.EXE] 'Debugger' = 'svhost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MAILMON.EXE] 'Debugger' = 'svhost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EGHOST.EXE] 'Debugger' = 'svhost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\РЮёґ№¤ѕЯ.exe] 'Debugger' = 'svhost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\srtask.exe] 'Debugger' = 'svhost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AdPop.Exe] 'Debugger' = 'svhost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WoptiProcess.exe] 'Debugger' = 'svhost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AdPop.Exe ] 'Debugger' = 'mmsb.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AdPop.Exe ] 'Debugger' = 'Vcrmon.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KMailMon.EXE ] 'Debugger' = 'svhost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KWatch.EXE] 'Debugger' = 'svhost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPFWSvc.EXE] 'Debugger' = 'svhost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RTHDCPL.EXE] 'Debugger' = 'svhost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPFW32.EXE] 'Debugger' = 'svhost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVStart.EXE] 'Debugger' = 'svhost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMon.exe] 'Debugger' = 'svhost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\C:\Recycled\krnln.exe,userinit.exe,svhost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wmiprvse.exe] 'Debugger' = 'C:\Recycled\krnln.fnr'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kavscr.exe] 'Debugger' = 'svhost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NMain.exe] 'Debugger' = 'svhost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Navapsvc.exe] 'Debugger' = 'svhost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pfw.exe] 'Debugger' = 'svhost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe] 'Debugger' = 'svhost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'wextract_cleanup0' = 'rundll32.exe <SYSTEM32>\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IceSword.exe] 'Debugger' = 'svhost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe] 'Debugger' = 'svhost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQDoctor.exe] 'Debugger' = 'svhost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navw32.EXE] 'Debugger' = 'svhost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVsvc.exe] 'Debugger' = 'svhost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVwsc.exe] 'Debugger' = 'svhost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RAVmonD.exe] 'Debugger' = 'svhost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rav.exe] 'Debugger' = 'svhost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rising.exe] 'Debugger' = 'svhost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVSrvXP.exe] 'Debugger' = 'svhost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVSvcUI.exe] 'Debugger' = 'svhost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVFW.EXE g'] 'Debugger' = 'svhost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVPFW.EXE] 'Debugger' = 'svhost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvXP.kxp] 'Debugger' = 'svhost.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAV32.exe] 'Debugger' = 'svhost.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\GrayPigeon] 'Start' = '00000002'
Вредоносные функции:
Для затруднения выявления своего присутствия в системе
блокирует отображение:
- скрытых файлов
Создает и запускает на исполнение:
- %TEMP%\IXP000.TMP\51515.exe
- %WINDIR%\www.hmhk.cn.exe
- %TEMP%\IXP000.TMP\Server.exe
Запускает на исполнение:
- <SYSTEM32>\cmd.exe /c %WINDIR%\UNINSTAL.BAT
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\E_4\iext2.fne
- %TEMP%\E_4\dp1.fne
- %TEMP%\E_4\sock.fne
- %TEMP%\E_4\internet.fne
- %TEMP%\E_4\spec.fne
- %HOMEPATH%\Desktop\МЪС¶QQ.lnk
- %TEMP%\IXP000.TMP\QQЎЎ.exe
- <SYSTEM32>\svhost.exe
- <SYSTEM32>\svhostkeep.exe
- %WINDIR%\www.hmhk.cn.exe
- %WINDIR%\UNINSTAL.BAT
- %TEMP%\IXP000.TMP\51515.exe
- %TEMP%\IXP000.TMP\Server.exe
- %TEMP%\E_4\krnln.fnr
- %TEMP%\E_4\xplib.fne
- %TEMP%\E_4\eAPI.fne
- %TEMP%\E_4\iext.fnr
- %TEMP%\E_4\shell.fne
Присваивает атрибут 'скрытый' для следующих файлов:
- <SYSTEM32>\svhostkeep.exe
- <SYSTEM32>\svhost.exe
- %WINDIR%\www.hmhk.cn.exe
Удаляет следующие файлы:
- %TEMP%\IXP000.TMP\Server.exe
Сетевая активность:
Подключается к:
- 'we#.59cn.cn':80
TCP:
Запросы HTTP GET:
- we#.59cn.cn/liaoranran/ip.txt
UDP:
- DNS ASK we#.59cn.cn
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
