Техническая информация
Вредоносные функции:
Создает и запускает на исполнение:
- %TEMP%\wsdjbfq.exe
Изменения в файловой системе:
Создает следующие файлы:
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\6[1].swf
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\2[1].swf
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\1[2].html
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\1[1].html
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\1[1].html
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\7[1].swf
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\5[1].swf
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\djPlayAD[1].swf
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\DJjiaoYou[1].swf
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\8[1].swf
- %TEMP%\nsv2.tmp\xconfigx.ini
- %TEMP%\wsdjbfq.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\5[1].xml
- %TEMP%\nsv2.tmp\System.dll
- %TEMP%\nsv2.tmp\inetc.dll
- %APPDATA%\Macromedia\Flash Player\localhost\FromMemory\46A10F369771449587DE913EFC0A258C\1\E4ED7C01D28A43418DBF2CB92CC35E56.swf\superfoo.sxx
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\3[1].swf
- %APPDATA%\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sxx
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\softDjPathURL[1].txt
- %APPDATA%\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#local\settings.sxx
Удаляет следующие файлы:
- %APPDATA%\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sol
- %APPDATA%\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#local\settings.sol
- %TEMP%\nsv2.tmp\xconfigx.ini
- %TEMP%\nsv2.tmp\inetc.dll
- %TEMP%\nsv2.tmp\System.dll
Перемещает следующие файлы:
- %APPDATA%\Macromedia\Flash Player\localhost\FromMemory\46A10F369771449587DE913EFC0A258C\1\E4ED7C01D28A43418DBF2CB92CC35E56.swf\superfoo.sxx в %APPDATA%\Macromedia\Flash Player\localhost\FromMemory\46A10F369771449587DE913EFC0A258C\1\E4ED7C01D28A43418DBF2CB92CC35E56.swf\superfoo.sol
- %APPDATA%\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sxx в %APPDATA%\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sol
- %APPDATA%\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#local\settings.sxx в %APPDATA%\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#local\settings.sol
Сетевая активность:
Подключается к:
- 'dj.#4mc.com':80
- 'localhost':1039
- 'www.kk##56.com':80
TCP:
Запросы HTTP GET:
- dj.#4mc.com/8.swf
- dj.#4mc.com/DJjiaoYou.swf
- dj.#4mc.com/2.swf
- dj.#4mc.com/5.swf
- dj.#4mc.com/7.swf
- dj.#4mc.com/djPlayAD.swf
- dj.#4mc.com/6.swf
- dj.#4mc.com/3.swf
- dj.#4mc.com/softDjPathURL.txt
- www.kk##56.com/5.xml
- dj.#4mc.com/p/New/1.html
- dj.#4mc.com/p/tj2/1.html
- dj.#4mc.com/p/tj/1.html
UDP:
- DNS ASK dj.#4mc.com
- DNS ASK www.pp##34.net
- DNS ASK www.kk##56.com
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
