Trojan.Click2.42449

Техническая информация

Вредоносные функции:

Запускает на исполнение:

<SYSTEM32>\wscript.exe "%PROGRAM_FILES%\soft165912\b_1612.vbe"
%PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE http://www.17##g.com/lianjie/10608.htm

Изменения в файловой системе:

Создает следующие файлы:

%PROGRAM_FILES%\Flush\Shield\Sandboxie.ini
%PROGRAM_FILES%\Flush\plugin\360Skinhelper\Skinhelper.dll
%PROGRAM_FILES%\Flush\ImgCache\www.google.com_favicon.ico
%PROGRAM_FILES%\Flush\ImgCache\www.qihoo.com_favicon.ico
%PROGRAM_FILES%\Flush\plugin\360snap\360snap.dll
%PROGRAM_FILES%\Flush\plugin\360snap\plugin.ini
%PROGRAM_FILES%\Flush\plugin\360Skinhelper\plugin.ini
%PROGRAM_FILES%\Flush\plugin\360Skinhelper\skinhelper.ico
%PROGRAM_FILES%\Flush\ImgCache\www.ename.cn_favicon.ico
%PROGRAM_FILES%\Flush\ImgCache\www.360.cn_favicon.ico
%PROGRAM_FILES%\Flush\ImgCache\www.360buy.com_favicon.ico
%PROGRAM_FILES%\Flush\ImgCache\www.2345a.com_favicon.ico
%PROGRAM_FILES%\Flush\ImgCache\www.3234.com_favicon.ico
%PROGRAM_FILES%\Flush\ImgCache\www.886.la_favicon.ico
%PROGRAM_FILES%\Flush\ImgCache\www.baidu.com_favicon.ico
%PROGRAM_FILES%\Flush\ImgCache\www.46.com_favicon.ico
%PROGRAM_FILES%\Flush\ImgCache\www.58.com_favicon.ico
%PROGRAM_FILES%\Flush\plugin\360snap\screener.exe
%PROGRAM_FILES%\soft165912\smes.exe
%PROGRAM_FILES%\soft165912\w_1612.exe
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\ Intarnot Explarer .lnk
%PROGRAM_FILES%\soft165912\a
%PROGRAM_FILES%\soft165912\1220111204121211591216121212.txt
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\10608[1].htm
%PROGRAM_FILES%\soft165912\B_1220111204121211591216121212.txt
%PROGRAM_FILES%\soft165912\C_1220111204121211591216121212.txt
%ALLUSERSPROFILE%\Desktop\ Intarnot Explarer .lnk
%PROGRAM_FILES%\Flush\plugin\koudai\add.ico
%PROGRAM_FILES%\Flush\plugin\koudai\plugin.ini
%PROGRAM_FILES%\Flush\plugin\360snap\snap.ico
%PROGRAM_FILES%\Flush\plugin\koudai\add.htm
%PROGRAM_FILES%\Flush\plugin\zconf\plugin.ini
%PROGRAM_FILES%\Flush\plugin\zconf\quickconf.dll
%PROGRAM_FILES%\Flush\plugin\koudai\readme.txt
%PROGRAM_FILES%\Flush\plugin\zconf\conf.ico
%PROGRAM_FILES%\Flush\ImgCache\www.2345.com_favicon.ico
%PROGRAM_FILES%\Flush\ImgCache\MouseGesture_1.bmp
%PROGRAM_FILES%\Flush\ImgCache\MouseGesture_10.bmp
%PROGRAM_FILES%\Flush\360\searchcore\searchcore.dll
%PROGRAM_FILES%\Flush\ImgCache\MouseGesture_0.bmp
%PROGRAM_FILES%\Flush\ImgCache\MouseGesture_13.bmp
%PROGRAM_FILES%\Flush\ImgCache\MouseGesture_14.bmp
%PROGRAM_FILES%\Flush\ImgCache\MouseGesture_11.bmp
%PROGRAM_FILES%\Flush\ImgCache\MouseGesture_12.bmp
%PROGRAM_FILES%\Flush\360\searchcore\plugin.ini
%PROGRAM_FILES%\Flush\Flush.ini
%PROGRAM_FILES%\Flush\module.log
%TEMP%\nsz2.tmp\System.dll
%PROGRAM_FILES%\Flush\Flush.exe
%PROGRAM_FILES%\Flush\360\360core\plugin.ini
%PROGRAM_FILES%\Flush\360\searchcore\SearchCfg.dat
%PROGRAM_FILES%\Flush\passlist.dat
%PROGRAM_FILES%\Flush\360\360core\360core.dll
%PROGRAM_FILES%\Flush\ImgCache\MouseGesture_15.bmp
%PROGRAM_FILES%\Flush\ImgCache\MouseGesture_9.bmp
%PROGRAM_FILES%\Flush\ImgCache\hao.360.cn_favicon.ico
%PROGRAM_FILES%\Flush\ImgCache\MouseGesture_7.bmp
%PROGRAM_FILES%\Flush\ImgCache\MouseGesture_8.bmp
%PROGRAM_FILES%\Flush\ImgCache\se.360.cn_favicon.ico
%PROGRAM_FILES%\Flush\ImgCache\wan.360.cn_favicon.ico
%PROGRAM_FILES%\Flush\ImgCache\new.cnzz.com_favicon.ico
%PROGRAM_FILES%\Flush\ImgCache\poker.wan.360.cn_favicon.ico
%PROGRAM_FILES%\Flush\ImgCache\MouseGesture_6.bmp
%PROGRAM_FILES%\Flush\ImgCache\MouseGesture_18.bmp
%PROGRAM_FILES%\Flush\ImgCache\MouseGesture_19.bmp
%PROGRAM_FILES%\Flush\ImgCache\MouseGesture_16.bmp
%PROGRAM_FILES%\Flush\ImgCache\MouseGesture_17.bmp
%PROGRAM_FILES%\Flush\ImgCache\MouseGesture_4.bmp
%PROGRAM_FILES%\Flush\ImgCache\MouseGesture_5.bmp
%PROGRAM_FILES%\Flush\ImgCache\MouseGesture_2.bmp
%PROGRAM_FILES%\Flush\ImgCache\MouseGesture_3.bmp

Перемещает следующие файлы:

%PROGRAM_FILES%\soft165912\B_1220111204121211591216121212.txt в %PROGRAM_FILES%\soft165912\300.bat
%PROGRAM_FILES%\soft165912\C_1220111204121211591216121212.txt в %PROGRAM_FILES%\soft165912\300.reg
%PROGRAM_FILES%\soft165912\1220111204121211591216121212.txt в %PROGRAM_FILES%\soft165912\b_1612.vbe
%PROGRAM_FILES%\soft165912\smes.exe в %PROGRAM_FILES%\soft165912\w_1612.exe
%PROGRAM_FILES%\Flush\Flush.exe в %PROGRAM_FILES%\Flush\Flush_165912.exe
%PROGRAM_FILES%\Flush\Flush.ini в %PROGRAM_FILES%\Flush\Flush_165912.ini
%PROGRAM_FILES%\soft165912\a в %PROGRAM_FILES%\soft165912\165912.txt

Сетевая активность:

Подключается к: