Trojan.Click2.55682

Техническая информация

Для обеспечения автозапуска и распространения:

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\Kingsoft Antivirus WebShield Service] 'Start' = '00000002'

Вредоносные функции:

Создает и запускает на исполнение:

'%PROGRAM_FILES%\kingsoft\KSWebShield.exe' -start
'%PROGRAM_FILES%\kingsoft\KSWebShield.exe'
'%PROGRAM_FILES%\kingsoft\KSWebShield.exe' -install
'%TEMP%\guaguadance.exe'
'%TEMP%\guaguadance.exe' (загружен из сети Интернет)

Запускает на исполнение:

'<SYSTEM32>\wscript.exe' %TEMP%\E3FHC.vbs
'<SYSTEM32>\wscript.exe' %TEMP%\BEKjA.vbs
'<SYSTEM32>\expand.exe' "%TEMP%\url.cab" -F:*.* "%HOMEPATH%\Favorites"
'<SYSTEM32>\expand.exe' "%TEMP%\url.cab" -F:*.* "%HOMEPATH%\Desktop"
'%PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE' http://www.77##h.com/?kj###
'%PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE' http://www.66##.net/?uk####
'<SYSTEM32>\wscript.exe' %TEMP%\BCi4p.vbs
'%PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE' http://www.v9##.com/?uk###
'<SYSTEM32>\wscript.exe' %TEMP%\K4qEB.vbs

Изменения в файловой системе:

Создает следующие файлы:

%HOMEPATH%\Favorites\МФ±¦№єОп.url
%HOMEPATH%\Favorites\ГАЕ®КУЖµ.url
%HOMEPATH%\Desktop\ГАЕ®КУЖµ.url
%HOMEPATH%\Desktop\МФ±¦№єОп.url
%HOMEPATH%\Favorites\РФёРГАЕ®.url
%ALLUSERSPROFILE%\Start Menu\360sdo.lnk
%TEMP%\E3FHC.vbs
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\779dh[1]
%PROGRAM_FILES%\kingsoft\KWSSVC.log
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\v921[1]
%HOMEPATH%\Favorites\ФЪПЯµзУ°.url
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\6626[1]
%HOMEPATH%\Desktop\ФЪПЯРЎЛµ.url
%ALLUSERSPROFILE%\Application Data\kingsoft\kws\kws.ini
%ALLUSERSPROFILE%\Application Data\kingsoft\kws\urlcache.dat
%HOMEPATH%\Favorites\ФЪПЯВю».url
%HOMEPATH%\Desktop\РФёРГАЕ®.url
%HOMEPATH%\Desktop\ФЪПЯµзУ°.url
%HOMEPATH%\Desktop\ФЪПЯВю».url
%HOMEPATH%\Favorites\ФЪПЯРЎЛµ.url
%ALLUSERSPROFILE%\Start Menu\360safe.lnk
%PROGRAM_FILES%\ico\Chat.ico
%PROGRAM_FILES%\ico\Video.ico
<SYSTEM32>\safe.ico
%ALLUSERSPROFILE%\Desktopkws\kws.ini
%TEMP%\url.cab
%PROGRAM_FILES%\ico\Beauty.ico
%TEMP%\lnk.bat
%PROGRAM_FILES%\ico\Film.ico
%PROGRAM_FILES%\ico\Taobao.ico
%PROGRAM_FILES%\ico\meiv.ico
%PROGRAM_FILES%\kingsoft\KSWebShield.exe
%ALLUSERSPROFILE%\Start Menu\ЅрЙЅНш¶Ь.lnk
%TEMP%\guaguadance.exe
%TEMP%\K4qEB.vbs
%TEMP%\BEKjA.vbs
%ALLUSERSPROFILE%\Start Menu\KSWebShield.lnk
%PROGRAM_FILES%\kingsoft\kwssp.dll
%PROGRAM_FILES%\kingsoft\KSWebShield.dll
%PROGRAM_FILES%\kingsoft\kwsui.dll
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip.chinaz[1]
%TEMP%\BCi4p.vbs