Trojan.DownLoader8.59625

Техническая информация

Для обеспечения автозапуска и распространения:

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\Kingsoft Antivirus WebShield Service] 'Start' = '00000002'

Вредоносные функции:

Создает и запускает на исполнение:

'%WINDIR%\Install\KSWebShield.exe'
'%WINDIR%\Install\Setup.exe' "http://www.xi###i189.com/new/bf02/default.html?fr##########"
'%WINDIR%\Install\KSWebShield.exe' -start
'%TEMP%\is-N5S3N.tmp\<Имя вируса>.tmp' /SL5="$40036,1766584,53248,<Полный путь к вирусу>"
'%WINDIR%\Install\KSWebShield.exe' -install

Запускает на исполнение:

'<SYSTEM32>\cmd.exe' /c ""%WINDIR%\Install\ureg.bat" "

Изменения в файловой системе:

Создает следующие файлы:

%WINDIR%\Install\ОчУОНш.Html
%HOMEPATH%\Favorites\IO±¦Io-IOAo.lnk
%WINDIR%\Install\МФ±¦Нш-МШВф.Html
%HOMEPATH%\Favorites\I?OIIo.lnk
%WINDIR%\Install\РЎУОП·.Html
%HOMEPATH%\Desktop\IO±¦Io-IOAo.lnk
%HOMEPATH%\Start Menu\IO±¦Io-IOAo.lnk
%WINDIR%\Install\µ±µ±Нш.Html
%WINDIR%\Install\ureg.bat
%ALLUSERSPROFILE%\Application Data\kingsoft\kws\kws.ini
%WINDIR%\Install\KWSSVC.log
%HOMEPATH%\Favorites\??O?Io.lnk
%WINDIR%\Install\ЧїФЅНш.Html
%HOMEPATH%\Favorites\µ±µ±Io.lnk
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\I?OI?¤A?Oe.lnk
%HOMEPATH%\Favorites\I?OI?¤A?Oe.lnk
%WINDIR%\Install\ОчУОЎ¤ГчЦй.Html
%HOMEPATH%\Desktop\I?OI?¤A?Oe.lnk
%WINDIR%\Install\Gamlist.xml
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\NewGameList[1].xml
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\default[1].html
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\IO±¦Io-IOAo.lnk
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\??OII·.lnk
%HOMEPATH%\Favorites\??OII·.lnk
%WINDIR%\Install\ИИІҐУ°КУНш.Html
%HOMEPATH%\Favorites\?AµAIA??.lnk
%WINDIR%\Install\єГµДНЕ№є.Html
%HOMEPATH%\Favorites\EE??O°EOIo.lnk
%WINDIR%\Install\zhuoyue.ico
<SYSTEM32>\Install.tmp
%WINDIR%\Install\Install.tmp
%PROGRAM_FILES%\installgame\unins000.dat
%WINDIR%\Install\2xi.ico
%WINDIR%\Install\hao.ico
%WINDIR%\Install\dangdangwang.ico
%WINDIR%\Install\Config.ini
%TEMP%\is-OBPK5.tmp\_isetup\_shfoldr.dll
%TEMP%\is-OBPK5.tmp\_isetup\_RegDLL.tmp
%TEMP%\is-N5S3N.tmp\<Имя вируса>.tmp
%TEMP%\is-OBPK5.tmp\DeCpress.dll
%PROGRAM_FILES%\installgame\is-B0RF7.tmp
%PROGRAM_FILES%\installgame\is-T81CG.tmp
%PROGRAM_FILES%\installgame\is-F0I60.tmp
%WINDIR%\Install\rd.txt
%WINDIR%\Install\PPN1.ico
%WINDIR%\Install\mzsg.ico
%WINDIR%\Install\sanguo.ico
%WINDIR%\Install\url.txt
%WINDIR%\Install\taobao.ico
%WINDIR%\Install\Setup.exe
%WINDIR%\Install\KSWebShield.exe
%WINDIR%\Install\kswebshield.dll
%WINDIR%\Install\kswbc.dll
%WINDIR%\Install\kws.ini
%WINDIR%\Install\minigame.ico
%WINDIR%\Install\kwsui.dll
%WINDIR%\Install\kwssp.dll

Удаляет следующие файлы:

%TEMP%\is-OBPK5.tmp\_isetup\_RegDLL.tmp
%TEMP%\is-OBPK5.tmp\_isetup\_shfoldr.dll
%TEMP%\is-N5S3N.tmp\<Имя вируса>.tmp
%PROGRAM_FILES%\installgame\Install.tmp
%WINDIR%\Install\kws.ini
%TEMP%\is-OBPK5.tmp\DeCpress.dll

Перемещает следующие файлы:

%PROGRAM_FILES%\installgame\is-B0RF7.tmp в %PROGRAM_FILES%\installgame\Install.tmp
%PROGRAM_FILES%\installgame\is-T81CG.tmp в %PROGRAM_FILES%\installgame\DeCpress.dll
%PROGRAM_FILES%\installgame\is-F0I60.tmp в %PROGRAM_FILES%\installgame\unins000.exe

Сетевая активность:

Подключается к: