Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Classes\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\Shell\Open\Command] '' = '%PROGRAM_FILES%\Internet Explorer\SIGNUP\iexplore.exe %1 h%t%t%p%:%/%/%w%w%w.m%u51.%c%o%m%/'
Вредоносные функции:
Создает и запускает на исполнение:
- '%PROGRAM_FILES%\Win32Games\wingames.exe'
- '%HOMEPATH%\Templates\installstat.exe'
- '%PROGRAM_FILES%\їмЅЭ·ЅКЅ\KKJDock.exe'
- '%PROGRAM_FILES%\Win32Games\setup_4846.exe'
- '%PROGRAM_FILES%\Win32Games\system32.exe'
- '%PROGRAM_FILES%\Win32Games\InjectDLLTest.exe'
Запускает на исполнение:
- '<SYSTEM32>\rundll32.exe' "%PROGRAM_FILES%\Win32Games\URL.dll" doset
- '<SYSTEM32>\regsvr32.exe' syspowerues.dll /s
- '<SYSTEM32>\rundll32.exe' "%PROGRAM_FILES%\Win32Games\URL.dll" helpme
- '<SYSTEM32>\wscript.exe' "%PROGRAM_FILES%\Win32Games\doset.vbs"
- '<SYSTEM32>\cmd.exe' /c ""%PROGRAM_FILES%\Win32Games\doset.bat" "
Внедряет код в
следующие системные процессы:
- %WINDIR%\Explorer.EXE
Ищет ветки реестра, отвечающие за хранение паролей сторонними программами:
- [<HKCU>\Software\FlashFXP]
Изменяет следующие настройки проводника Windows (Windows Explorer):
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoInternetIcon' = '00000001'
Изменения в файловой системе:
Создает следующие файлы:
- %PROGRAM_FILES%\їмЅЭ·ЅКЅ\icons\soft\QQ.png
- %PROGRAM_FILES%\їмЅЭ·ЅКЅ\icons\soft\RealOne.png
- %PROGRAM_FILES%\їмЅЭ·ЅКЅ\icons\soft\Winamp.png
- %PROGRAM_FILES%\їмЅЭ·ЅКЅ\icons\soft\FXP.png
- %PROGRAM_FILES%\їмЅЭ·ЅКЅ\icons\soft\MSN.png
- %PROGRAM_FILES%\їмЅЭ·ЅКЅ\icons\soft\PS.png
- %PROGRAM_FILES%\їмЅЭ·ЅКЅ\icons\soft\З§З§ѕІМэ.png
- %PROGRAM_FILES%\їмЅЭ·ЅКЅ\icons\soft\УЕ»ЇґуК¦.png
- %PROGRAM_FILES%\їмЅЭ·ЅКЅ\їмЅЭ·ЅКЅ.url
- %PROGRAM_FILES%\їмЅЭ·ЅКЅ\icons\soft\Word.png
- %PROGRAM_FILES%\їмЅЭ·ЅКЅ\icons\soft\і¬ј¶НГЧУ.png
- %PROGRAM_FILES%\їмЅЭ·ЅКЅ\icons\soft\їб№·.png
- %PROGRAM_FILES%\їмЅЭ·ЅКЅ\icons\IE1.png
- %PROGRAM_FILES%\їмЅЭ·ЅКЅ\icons\IE2.png
- %PROGRAM_FILES%\їмЅЭ·ЅКЅ\icons\јЖЛгЖч.png
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\game[1].htm
- %HOMEPATH%\Start Menu\Programs\їмЅЭ·ЅКЅ\їмЅЭ·ЅКЅ.lnk
- %PROGRAM_FILES%\їмЅЭ·ЅКЅ\KKJDock.exe
- %PROGRAM_FILES%\їмЅЭ·ЅКЅ\icons\ОТµДОДµµ.png
- %PROGRAM_FILES%\їмЅЭ·ЅКЅ\icons\soft\ACDSee.png
- %PROGRAM_FILES%\їмЅЭ·ЅКЅ\icons\soft\CS.png
- %PROGRAM_FILES%\їмЅЭ·ЅКЅ\icons\јЗКВ±ѕ.png
- %PROGRAM_FILES%\їмЅЭ·ЅКЅ\icons\їШЦЖГж°е.png
- %PROGRAM_FILES%\їмЅЭ·ЅКЅ\icons\ОТµДµзДФ.png
- %HOMEPATH%\Start Menu\IO±¦Io?nEOIO?UCo.ink
- %HOMEPATH%\Start Menu\Intenet Exploer.ink
- %HOMEPATH%\Desktop\?¬?¶?AI?OII·.ink
- %HOMEPATH%\Favorites\МФ±¦НшЅсИХМШјЫЗш.url
- %HOMEPATH%\Favorites\іЈУГ\і¬ј¶єГНжУОП·.url
- %HOMEPATH%\Favorites\і¬ј¶єГНжУОП·.url
- %HOMEPATH%\Favorites\»Ж№ПУ°Фє.url
- %HOMEPATH%\Desktop\»??IO°O?.ink
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\?¬?¶?AI???OII·.ink
- %HOMEPATH%\Desktop\IO±¦Io?nEOIO?UCo.ink
- %HOMEPATH%\Favorites\іЈУГ\»Ж№ПУ°Фє.url
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.ink
- %PROGRAM_FILES%\їмЅЭ·ЅКЅ\kkjDock.cfg
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Intenet Exploer.ink
- %HOMEPATH%\Start Menu\Programs\їмЅЭ·ЅКЅ\Р¶ФШїмЅЭ·ЅКЅ.lnk
- %PROGRAM_FILES%\їмЅЭ·ЅКЅ\uninst.exe
- %PROGRAM_FILES%\Internet Explorer\SIGNUP\iexplore.exe
- %HOMEPATH%\Favorites\іЈУГ\ЧїФЅНш.url
- %HOMEPATH%\Favorites\ЧїФЅНш.url
- %HOMEPATH%\Favorites\іЈУГ\МФ±¦НшЅсИХМШјЫЗш.url
- %HOMEPATH%\Desktop\Intenet Exploer.ink
- %HOMEPATH%\Favorites\іЈУГ\µ±µ±Нш.url
- %HOMEPATH%\Favorites\µ±µ±Нш.url
- %PROGRAM_FILES%\Win32Games\wingames.exe
- %PROGRAM_FILES%\Win32Games\Thumbs.db
- %PROGRAM_FILES%\Win32Games\taobao.ico
- %PROGRAM_FILES%\Win32Games\taobao.vbs
- %PROGRAM_FILES%\Win32Games\aaa.bat
- %PROGRAM_FILES%\Win32Games\zhuoyue.ico
- %PROGRAM_FILES%\Win32Games\bingfeng.ico
- %PROGRAM_FILES%\Win32Games\baidu.ico
- %PROGRAM_FILES%\Win32Games\2xi.ico
- %PROGRAM_FILES%\Win32Games\jiuzhou.ico
- %PROGRAM_FILES%\Win32Games\dangdangwang.ico
- %PROGRAM_FILES%\Win32Games\bookmarks.dat
- %PROGRAM_FILES%\Win32Games\Config.ini
- %PROGRAM_FILES%\Win32Games\system32.exe
- %PROGRAM_FILES%\Win32Games\URL.dll
- %PROGRAM_FILES%\Win32Games\Xianjian.ico
- %PROGRAM_FILES%\Win32Games\doset.vbs
- %PROGRAM_FILES%\Win32Games\doset.bat
- %PROGRAM_FILES%\Win32Games\2xi.vbs
- %PROGRAM_FILES%\Win32Games\InjectDLLTest.exe
- %PROGRAM_FILES%\Win32Games\minigame.vbs
- %PROGRAM_FILES%\Win32Games\sysurl.dll
- %PROGRAM_FILES%\Win32Games\syspowerues.dll
- %PROGRAM_FILES%\Win32Games\Internet.vbs
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Internet Exlporer.1nk
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.txt
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf
- %HOMEPATH%\My Documents\backup\Launch Internet Explorer Browser.lnk
- %HOMEPATH%\My Documents\backup\Show Desktop.scf
- %HOMEPATH%\My Documents\backup\Windows Media Player.lnk
- %HOMEPATH%\Templates\installstat.exe
- %HOMEPATH%\Templates\statistics.dll
- %PROGRAM_FILES%\Win32Games\url.txt
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.txt
- %PROGRAM_FILES%\Internet Explorer\SIGNUP\in
- %HOMEPATH%\Favorites\УгУгРЎУОП·.url
- %PROGRAM_FILES%\Win32Games\setup_4846.exe
- %TEMP%\nsi2.tmp\System.dll
- <SYSTEM32>\syspowerues.dll
- %PROGRAM_FILES%\Win32Games\helpme.vbs
- %PROGRAM_FILES%\Win32Games\helpme.ink
- %PROGRAM_FILES%\Win32Games\minigame.ico
- %PROGRAM_FILES%\Internet Explorer\SIGNUP\msn.1nk
- %HOMEPATH%\Desktop\Internet Exlporer.1nk
- %HOMEPATH%\My Documents\backup\desktop.ini
- <SYSTEM32>\sysurl.dll
- <SYSTEM32>\helpme.ink
- <SYSTEM32>\helpme.vbs
Присваивает атрибут 'скрытый' для следующих файлов:
- %PROGRAM_FILES%\Win32Games\Thumbs.db
Удаляет следующие файлы:
- <SYSTEM32>\helpme.ink
- %HOMEPATH%\Templates\statistics.dll
- %HOMEPATH%\Templates\installstat.exe
- %TEMP%\nsi2.tmp\System.dll
- %HOMEPATH%\Desktop\Intenet Exploer.ink
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Intenet Exploer.ink
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
- %HOMEPATH%\My Documents\backup\Show Desktop.scf
- %HOMEPATH%\My Documents\backup\Launch Internet Explorer Browser.txt
- %HOMEPATH%\My Documents\backup\desktop.ini
- %HOMEPATH%\My Documents\backup\Windows Media Player.txt
- <SYSTEM32>\helpme.vbs
- %PROGRAM_FILES%\Win32Games\url.txt
- %PROGRAM_FILES%\Win32Games\aaa.bat
Перемещает следующие файлы:
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.txt в %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.txt в %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk
- %HOMEPATH%\My Documents\backup\Launch Internet Explorer Browser.lnk в %HOMEPATH%\My Documents\backup\Launch Internet Explorer Browser.txt
- %HOMEPATH%\My Documents\backup\Windows Media Player.lnk в %HOMEPATH%\My Documents\backup\Windows Media Player.txt
Сетевая активность:
Подключается к:
- 'li####nz.kkjie.com':80
- 'www.ad##ma.cn':80
- 'localhost':1035
TCP:
Запросы HTTP GET:
- www.ad##ma.cn/game.htm?y1
Запросы HTTP POST:
- li####nz.kkjie.com/t.asp?i=#####
UDP:
- DNS ASK li####nz.kkjie.com
- DNS ASK www.ad##ma.cn
Другое:
Ищет следующие окна:
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'Progman' WindowName: 'Program Manager'
- ClassName: 'MS_WINHELP' WindowName: ''
- ClassName: 'EDIT' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
