Техническая информация
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\cacls.exe' "..\..\winsks_safe" /d everyone
- '<SYSTEM32>\attrib.exe' "%HOMEPATH%\Locals~1\Applic~1\*bookmark*" -s -h -r -a /s /d
- '<SYSTEM32>\attrib.exe' "%APPDATA%\..\Local\*bookmark*" -s -h -r -a /s /d
- '<SYSTEM32>\cacls.exe' "%TEMP%\winsks_safe" /d everyone
- '<SYSTEM32>\taskkill.exe' /f /im +++
- '<SYSTEM32>\cacls.exe' "<SYSTEM32>\winsks" /d everyone
- '<SYSTEM32>\cacls.exe' "%APPDATA%\winsks_data" /d everyone
- '<SYSTEM32>\attrib.exe' "%APPDATA%\*fav*" -s -h -r -a /s /d
- '<SYSTEM32>\attrib.exe' "%APPDATA%\winsks_data" +s +h +r +a
- '<SYSTEM32>\attrib.exe' "%TEMP%\winsks_safe" +s +h +r +a
- '<SYSTEM32>\attrib.exe' "..\..\winsks_safe" +s +h +r +a
- '<SYSTEM32>\attrib.exe' "<SYSTEM32>\winsks" +s +h +r +a
- '<SYSTEM32>\attrib.exe' "config_data\Invisible\*.*" +s +r +h /s
- '<SYSTEM32>\attrib.exe' "<Имя диска съемного носителя>:\akfc_data" +s +h +r +a
- '<SYSTEM32>\attrib.exe' "%APPDATA%\..\Local" +s +h +r +a
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\aut23.tmp
- %TEMP%\winsks_safe\winsks_ok\config_data\ForAlax\IEAlax\IElnk\Hight\Internet Explorer.lnk
- %TEMP%\aut24.tmp
- %TEMP%\winsks_safe\winsks_ok\config_data\ForAlax\IEAlax\IElnk\Biger\winsks.lnk
- %TEMP%\aut22.tmp
- %TEMP%\winsks_safe\winsks_ok\config_data\ForAlax\IEAlax\IElnk\DriverD\winsks.lnk
- %TEMP%\winsks_safe\winsks_ok\config_data\ForAlax\IEAlax\IElnk\Options\Internet Explorer.lnk
- %TEMP%\winsks_safe\winsks_ok\config_data\ForAlax\IEAlax\IEsever\Hight.pfc
- %TEMP%\aut27.tmp
- %TEMP%\winsks_safe\winsks_ok\config_data\ForAlax\IEAlax\IEsever\Homepage.pfc
- %TEMP%\aut25.tmp
- %TEMP%\winsks_safe\winsks_ok\config_data\ForAlax\IEAlax\IEsever\Chage.pfc
- %TEMP%\aut26.tmp
- %TEMP%\winsks_safe\winsks_ok\config_data\ForAlax\ExpAleax\sogou\sgall\Driver_D\搜狗高速浏览器.lnk
- %TEMP%\aut1D.tmp
- %TEMP%\winsks_safe\winsks_ok\config_data\ForAlax\ExpAleax\taobao\tball\Driver_C\淘宝浏览器.lnk
- %TEMP%\aut1B.tmp
- %TEMP%\winsks_safe\winsks_ok\config_data\ForAlax\ExpAleax\sogou\sgall\Driver_C\搜狗高速浏览器.lnk
- %TEMP%\aut1C.tmp
- %TEMP%\aut1E.tmp
- %TEMP%\aut20.tmp
- %TEMP%\winsks_safe\winsks_ok\config_data\ForAlax\IEAlax\IEhosts\drivers_etc\hosts
- %TEMP%\aut21.tmp
- %TEMP%\winsks_safe\winsks_ok\config_data\ForAlax\ExpAleax\taobao\tball\Driver_D\淘宝浏览器.lnk
- %TEMP%\aut1F.tmp
- %TEMP%\winsks_safe\winsks_ok\config_data\ForAlax\IEAlax\IEhosts\Hosts.vbe
- %TEMP%\aut30.tmp
- %TEMP%\winsks_safe\winsks_ok\config_data\Invisible\Driver_Data\LocalAppData\2345Chrome\User Data\Default\Preferences
- %TEMP%\aut31.tmp
- %TEMP%\winsks_safe\winsks_ok\config_data\Invisible\Driver_Data\AppData\Baidu\browser\UserData\0A73B7929C9546628F097CEEACA6E079410064006d0069006e006900730074007200610074006f007200\userprofile.db
- %TEMP%\aut2F.tmp
- %TEMP%\winsks_safe\winsks_ok\config_data\Invisible\Driver_Data\AppData\SogouExplorer\config.xml
- %TEMP%\winsks_safe\winsks_ok\config_data\Invisible\Driver_Data\LocalAppData\360Chrome\Chrome\User Data\Default\Preferences
- %TEMP%\winsks_safe\winsks_ok\config_data\Invisible\Driver_Data\LocalAppData\liebao\User Data\Default\Preferences
- %TEMP%\aut34.tmp
- %TEMP%\winsks_safe\winsks_ok\config_data\Invisible\Driver_Data\LocalAppData\TaoBrowser\User Data\Default\Preferences
- %TEMP%\aut32.tmp
- %TEMP%\winsks_safe\winsks_ok\config_data\Invisible\Driver_Data\LocalAppData\Google\Chrome\User Data\Default\Preferences
- %TEMP%\aut33.tmp
- %TEMP%\winsks_safe\winsks_ok\config_data\Invisible\Driver_Data\AppData\2345Explorer\Users\Default\Default.cfg
- %TEMP%\aut2A.tmp
- %TEMP%\winsks_safe\winsks_ok\config_data\Invisible\Driver_Data\AppData\360se\login.ini
- %TEMP%\aut28.tmp
- %TEMP%\winsks_safe\winsks_ok\config_data\ForAlax\UpAlax\upsever\startup.pfc
- %TEMP%\aut29.tmp
- %TEMP%\aut2B.tmp
- %TEMP%\aut2D.tmp
- %TEMP%\winsks_safe\winsks_ok\config_data\Invisible\Driver_Data\AppData\Baidu\browser\UserData\0A73B7929C9546628F097CEEACA6E079410064006d0069006e006900730074007200610074006f007200\userpref_v2
- %TEMP%\aut2E.tmp
- %TEMP%\winsks_safe\winsks_ok\config_data\Invisible\Driver_Data\AppData\360se6\apps\data\users\login.ini
- %TEMP%\aut2C.tmp
- %TEMP%\winsks_safe\winsks_ok\config_data\Invisible\Driver_Data\AppData\360se6\User Data\Default\Preferences
- %TEMP%\aut9.tmp
- %TEMP%\winsks_safe\winsks_ok\config_data\ForAlax\DeskAlax\Tianlnk\dubawebu.url
- %TEMP%\autA.tmp
- %TEMP%\winsks_safe\winsks_ok\config_data\ForAlax\DeskAlax\Tianlnk\2345u.url
- %TEMP%\aut8.tmp
- %TEMP%\winsks_safe\winsks_ok\config_data\ForAlax\DeskAlax\Tianlnk\duba123u.url
- %TEMP%\winsks_safe\winsks_ok\config_data\ForAlax\DeskAlax\Tianlnk\hao123u.url
- %TEMP%\winsks_safe\winsks_ok\config_data\ForAlax\ExpAleax\2345\2345all\Driver_C\2345智能浏览器.lnk
- %TEMP%\autD.tmp
- %TEMP%\winsks_safe\winsks_ok\config_data\ForAlax\ExpAleax\2345\2345all\Driver_D\2345加速浏览器.lnk
- %TEMP%\autB.tmp
- %TEMP%\winsks_safe\winsks_ok\config_data\ForAlax\ExpAleax\2345\2345all\Driver_C\2345加速浏览器.lnk
- %TEMP%\autC.tmp
- %TEMP%\winsks_safe\winsks_ok\winsks.html
- %TEMP%\aut3.tmp
- %TEMP%\winsks_safe\winsks_ok\config_data\ForAlax\DeskAlax\Icolnk\2345desk.ico
- %TEMP%\aut1.tmp
- %TEMP%\winsks_safe\winsks_ok\winsks.bat
- %TEMP%\aut2.tmp
- %TEMP%\aut4.tmp
- %TEMP%\aut6.tmp
- %TEMP%\winsks_safe\winsks_ok\config_data\ForAlax\DeskAlax\Icolnk\hao123.ico
- %TEMP%\aut7.tmp
- %TEMP%\winsks_safe\winsks_ok\config_data\ForAlax\DeskAlax\Icolnk\duba123.ico
- %TEMP%\aut5.tmp
- %TEMP%\winsks_safe\winsks_ok\config_data\ForAlax\DeskAlax\Icolnk\dubaweb.ico
- %TEMP%\aut16.tmp
- %TEMP%\winsks_safe\winsks_ok\config_data\ForAlax\ExpAleax\chrome\chromeall\Driver_D\Google Chrome.lnk
- %TEMP%\aut17.tmp
- %TEMP%\winsks_safe\winsks_ok\config_data\ForAlax\ExpAleax\baidu\bdall\Driver_D\百度浏览器.lnk
- %TEMP%\aut15.tmp
- %TEMP%\winsks_safe\winsks_ok\config_data\ForAlax\ExpAleax\chrome\chromeall\Driver_C\Google Chrome.lnk
- %TEMP%\winsks_safe\winsks_ok\config_data\ForAlax\ExpAleax\liebao\lball\Driver_C\猎豹浏览器.lnk
- %TEMP%\winsks_safe\winsks_ok\config_data\ForAlax\ExpAleax\qqbrowser\qqall\Driver_C\QQ浏览器.lnk
- %TEMP%\aut1A.tmp
- %TEMP%\winsks_safe\winsks_ok\config_data\ForAlax\ExpAleax\qqbrowser\qqall\Driver_D\QQ浏览器.lnk
- %TEMP%\aut18.tmp
- %TEMP%\winsks_safe\winsks_ok\config_data\ForAlax\ExpAleax\liebao\lball\Driver_D\猎豹浏览器.lnk
- %TEMP%\aut19.tmp
- %TEMP%\winsks_safe\winsks_ok\config_data\ForAlax\ExpAleax\360se\360cse6\Driver_C\360极速浏览器.lnk
- %TEMP%\aut10.tmp
- %TEMP%\winsks_safe\winsks_ok\config_data\ForAlax\ExpAleax\360se\360se35\Driver_C\360安全浏览器.lnk
- %TEMP%\autE.tmp
- %TEMP%\winsks_safe\winsks_ok\config_data\ForAlax\ExpAleax\2345\2345all\Driver_D\2345智能浏览器.lnk
- %TEMP%\autF.tmp
- %TEMP%\aut11.tmp
- %TEMP%\aut13.tmp
- %TEMP%\winsks_safe\winsks_ok\config_data\ForAlax\ExpAleax\baidu\bdall\Driver_C\百度浏览器.lnk
- %TEMP%\aut14.tmp
- %TEMP%\winsks_safe\winsks_ok\config_data\ForAlax\ExpAleax\360se\360se35\Driver_D\360安全浏览器.lnk
- %TEMP%\aut12.tmp
- %TEMP%\winsks_safe\winsks_ok\config_data\ForAlax\ExpAleax\360se\360se6\Driver_C\360安全浏览器6.lnk
Присваивает атрибут 'скрытый' для следующих файлов:
- %TEMP%\winsks_safe\winsks_ok\config_data\Invisible\Driver_Data\LocalAppData\360Chrome\Chrome\User Data\Default\Preferences
- %TEMP%\winsks_safe\winsks_ok\config_data\Invisible\Driver_Data\LocalAppData\2345Chrome\User Data\Default\Preferences
- %TEMP%\winsks_safe\winsks_ok\config_data\Invisible\Driver_Data\AppData\SogouExplorer\config.xml
- %TEMP%\winsks_safe\winsks_ok\config_data\Invisible\Driver_Data\LocalAppData\TaoBrowser\User Data\Default\Preferences
- %TEMP%\winsks_safe\winsks_ok\config_data\Invisible\Driver_Data\LocalAppData\liebao\User Data\Default\Preferences
- %TEMP%\winsks_safe\winsks_ok\config_data\Invisible\Driver_Data\LocalAppData\Google\Chrome\User Data\Default\Preferences
- %TEMP%\winsks_safe\winsks_ok\config_data\Invisible\Driver_Data\AppData\360se6\apps\data\users\login.ini
- %TEMP%\winsks_safe\winsks_ok\config_data\Invisible\Driver_Data\AppData\360se\login.ini
- %TEMP%\winsks_safe\winsks_ok\config_data\Invisible\Driver_Data\AppData\2345Explorer\Users\Default\Default.cfg
- %TEMP%\winsks_safe\winsks_ok\config_data\Invisible\Driver_Data\AppData\Baidu\browser\UserData\0A73B7929C9546628F097CEEACA6E079410064006d0069006e006900730074007200610074006f007200\userprofile.db
- %TEMP%\winsks_safe\winsks_ok\config_data\Invisible\Driver_Data\AppData\Baidu\browser\UserData\0A73B7929C9546628F097CEEACA6E079410064006d0069006e006900730074007200610074006f007200\userpref_v2
- %TEMP%\winsks_safe\winsks_ok\config_data\Invisible\Driver_Data\AppData\360se6\User Data\Default\Preferences
Удаляет следующие файлы:
- %TEMP%\aut24.tmp
- %TEMP%\aut23.tmp
- %TEMP%\aut22.tmp
- %TEMP%\aut27.tmp
- %TEMP%\aut26.tmp
- %TEMP%\aut25.tmp
- %TEMP%\aut21.tmp
- %TEMP%\aut1D.tmp
- %TEMP%\aut1C.tmp
- %TEMP%\aut1B.tmp
- %TEMP%\aut20.tmp
- %TEMP%\aut1F.tmp
- %TEMP%\aut1E.tmp
- %TEMP%\aut31.tmp
- %TEMP%\aut30.tmp
- %TEMP%\aut2F.tmp
- %TEMP%\aut34.tmp
- %TEMP%\aut33.tmp
- %TEMP%\aut32.tmp
- %TEMP%\aut2E.tmp
- %TEMP%\aut2A.tmp
- %TEMP%\aut29.tmp
- %TEMP%\aut28.tmp
- %TEMP%\aut2D.tmp
- %TEMP%\aut2C.tmp
- %TEMP%\aut2B.tmp
- %TEMP%\autA.tmp
- %TEMP%\aut9.tmp
- %TEMP%\aut8.tmp
- %TEMP%\autD.tmp
- %TEMP%\autC.tmp
- %TEMP%\autB.tmp
- %TEMP%\aut7.tmp
- %TEMP%\aut3.tmp
- %TEMP%\aut2.tmp
- %TEMP%\aut1.tmp
- %TEMP%\aut6.tmp
- %TEMP%\aut5.tmp
- %TEMP%\aut4.tmp
- %TEMP%\aut17.tmp
- %TEMP%\aut16.tmp
- %TEMP%\aut15.tmp
- %TEMP%\aut1A.tmp
- %TEMP%\aut19.tmp
- %TEMP%\aut18.tmp
- %TEMP%\aut14.tmp
- %TEMP%\aut10.tmp
- %TEMP%\autF.tmp
- %TEMP%\autE.tmp
- %TEMP%\aut13.tmp
- %TEMP%\aut12.tmp
- %TEMP%\aut11.tmp
Другое:
Ищет следующие окна:
- ClassName: '(null)' WindowName: '(null)'
