Trojan.Click3.30814

Техническая информация

Вредоносные функции

Запускает на исполнение

'%ProgramFiles(x86)%\internet explorer\iexplore.exe' http://www.rr##ng.com/softii

Изменения в файловой системе

Создает следующие файлы

%TEMP%\~2867.bat
%HOMEPATH%\favorites\╚╦╚╦╠ВІ┴ВЄ═В°.url
%HOMEPATH%\favorites\╚╦╚╦╚φ╝■╒╛.url
%HOMEPATH%\favorites\┐╝╩╘┤≤.url
%HOMEPATH%\favorites\░Гі└ВЎ▓В«╙∩╤Вє╧░╜╠│╠.url
%HOMEPATH%\favorites\╬≈░α╤└╙∩╤Вє╧░╜╠│╠.url
%HOMEPATH%\favorites\╥γ┤≤└√╙∩╤Вє╧░╜╠│╠.url
%HOMEPATH%\favorites\╘╜─╧╙∩╤Вє╧░╜╠│╠.url
%HOMEPATH%\favorites\╧Гє└░╙∩╤Вє╧░╜╠│╠.url
%HOMEPATH%\favorites\╢φ╙∩╤Вє╧░╜╠│╠.url
%HOMEPATH%\favorites\╡┬╙∩╤Вє╧░╜╠│╠.url
%HOMEPATH%\favorites\╖Вї╙∩╤Вє╧░╜╠│╠.url
%HOMEPATH%\favorites\╚╒╙∩╤Вє╧░╜╠│╠.url
%HOMEPATH%\favorites\║ВЅ╙∩╤Вє╧░╜╠│╠.url
%HOMEPATH%\favorites\╙Гі╙∩╤Вє╧░╜╠│╠.url
%HOMEPATH%\favorites\╙Гі╙∩╘┌╧▀╨Г╙╬╧╖.url

Присваивает атрибут 'скрытый' для следующих файлов

%TEMP%\~2867.bat

Удаляет следующие файлы

%WINDIR%\temp\dmi8538.tmp
%WINDIR%\microsoft.net\framework\v2.0.50727\ngen_service.log
%WINDIR%\microsoft.net\framework\v4.0.30319\ngen.log
%WINDIR%\microsoft.net\framework\v4.0.30319\ngen_service.log
%WINDIR%\microsoft.net\framework64\v2.0.50727\ngen.log
%WINDIR%\microsoft.net\framework64\v2.0.50727\ngen_service.log
%WINDIR%\microsoft.net\framework64\v4.0.30319\ngen.log
%WINDIR%\microsoft.net\framework64\v4.0.30319\ngen_service.log
%WINDIR%\panther\cbs.log
%WINDIR%\panther\ddaclsys.log
%WINDIR%\panther\setuperr.log
<SYSTEM32>\catroot2\edb00563.log
%WINDIR%\panther\unattendgc\setupact.log
%WINDIR%\panther\unattendgc\setuperr.log
%WINDIR%\performance\winsat\winsat.log
%WINDIR%\security\logs\scesetup.log
%WINDIR%\serviceprofiles\localservice\appdata\local\microsoft\windows\windowsupdate.log
%WINDIR%\serviceprofiles\localservice\appdata\roaming\peernetworking\b8887980aee093664ab3bb254ee38ade63e8b7ff.homegroupclassifier\83511c0838e48947d895ba33d3c45b29\grouping\edb.log
%WINDIR%\softwaredistribution\reportingevents.log
%WINDIR%\softwaredistribution\datastore\logs\edb.log
%WINDIR%\softwaredistribution\datastore\logs\edb00002.log
%WINDIR%\microsoft.net\framework\v2.0.50727\ngen.log
%WINDIR%\panther\setupact.log
%WINDIR%\inf\setupapi.offline.log
%WINDIR%\temp\ts_77d1.tmp
%WINDIR%\temp\ts_267a.tmp
%WINDIR%\temp\ts_2b0f.tmp
%WINDIR%\temp\ts_2bfb.tmp
%WINDIR%\temp\ts_316a.tmp
%WINDIR%\temp\ts_361e.tmp
%WINDIR%\temp\ts_3852.tmp
%WINDIR%\temp\ts_39ba.tmp
%WINDIR%\temp\ts_4f66.tmp
%WINDIR%\temp\ts_5080.tmp
%WINDIR%\temp\ts_8e67.tmp
%WINDIR%\inf\setupapi.app.log
%WINDIR%\directx.log
%WINDIR%\dtcinstall.log
%WINDIR%\pfro.log
%WINDIR%\setupact.log
%WINDIR%\setuperr.log
%WINDIR%\tssysprep.log
%WINDIR%\windowsupdate.log
%WINDIR%\debug\sammui.log
%WINDIR%\debug\wia\wiatrace.log
%WINDIR%\inf\setupapi.dev.log
%WINDIR%\syswow64\macromed\flash\flashinstall.log