Trojan.DownLoader9.53985

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'ydef' = '%ALLUSERSPROFILE%\Application Data\llydef\llydef.exe'

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\wencl] 'Start' = '00000002'

Вредоносные функции:

Создает и запускает на исполнение:

'%ALLUSERSPROFILE%\Application Data\lvc\psvc.exe'
'%TEMP%\_ir_sf_temp_0\irsetup.exe' __IRAOFF:662050 "__IRAFN:c:\FreeDesk_qingqing.exe" "__IRCT:1" "__IRTSS:0" "__IRSID:S-1-5-21-2052111302-484763869-725345543-1003"
'C:\kugoo.exe'
'%PROGRAM_FILES%\CoralExplorer\Coral.exe' --update=install
'%PROGRAM_FILES%\FreeDesk\FreeDesk.exe'
'%ALLUSERSPROFILE%\Application Data\llydef\llydef.exe'
'C:\setup3021.exe'
'C:\FreeDesk_qingqing.exe'
'C:\KAV11_18_5355.exe'
'C:\Loader_forqd535.exe'
'C:\CoralExplorer_200465.exe'
'C:\inst.exe'

Изменения в файловой системе:

Создает следующие файлы:

%PROGRAM_FILES%\CoralExplorer\StartPage\images\guide\04_img_01.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\guide\04_img_02.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\guide\03_img_03.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\guide\03_img_01.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\guide\03_img_02.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\guide\back.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\guide\bg.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\guide\05_img_02.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\guide\04_img_03.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\guide\05_img_01.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\guide\02_img_02.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\tick.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\tick.ico
%PROGRAM_FILES%\CoralExplorer\StartPage\images\switch_widbar_icon2.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\switch_combar_icon2.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\switch_widbar_icon1.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\guide\01_img_04.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\guide\02_img_01.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\guide\01_img_03.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\guide\01_img_01.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\guide\01_img_02.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\guide\menu4_1.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\guide\menu4_2.gif
%TEMP%\alpha-Link Select.cur
%PROGRAM_FILES%\CoralExplorer\StartPage\images\guide\menu3_2.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\guide\menu3_3.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\guide\menu5_2.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\guide\p_down.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\guide\menu5_1.gif
%TEMP%\alpha-Normal select.cur
%PROGRAM_FILES%\CoralExplorer\StartPage\images\guide\menu4_3.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\guide\menu3_1.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\guide\mainbg.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\guide\menu1_1.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\guide\logo.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\guide\ico.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\guide\kaishi.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\guide\menu2_2.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\guide\menu2_3.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\guide\menu2_1.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\guide\menu1_2.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\guide\menu1_3.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_logo_youdao.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_xl_arrow.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_logo_yahoo.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_logo_wsoso.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_logo_wwiki.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_toolbar_icon2.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_toolbar_icon3.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_toolbar_icon1.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_xl_background1.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_xl_background2.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_logo_wbaidu.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_logo_spaipai.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_logo_staobao.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_logo_soso.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_logo_sjyjo.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_logo_sogou.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_logo_vtudou.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_logo_vyouku.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_logo_vsoso.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_logo_vbaidu.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_logo_vgoogle.gif
%ALLUSERSPROFILE%\Application Data\llydef\llydef.exe
%PROGRAM_FILES%\CoralExplorer\StartPage\images\popup_dialog_list_icon4.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\popup_dialog_list_icon3.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\popup_dialog_list_icon1.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\popup_dialog_list_icon2.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\switch_bj.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\switch_combar_icon1.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\popup_dialog_list_tit_hover.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\popup_dialog_list_icon4_2.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\popup_dialog_list_tit.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\popup_dialog_list_icon.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\popup_dialog_background.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\popup_dialog_close.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_toolbar_icon6.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_toolbar_icon4.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_toolbar_icon5.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\popup_dialog_list_button2.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\popup_dialog_list_button3.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\popup_dialog_list_button.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\popup_dialog_edit_background.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\popup_dialog_edit_background2.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\guide\p_down.png
%APPDATA%\CoralExplorer\Users\Default\SmartUrl.data-journal
%APPDATA%\CoralExplorer\Users\Default\SmartUrl.data
%APPDATA%\CoralExplorer\Users\Default\StartPageConfig.data
%APPDATA%\CoralExplorer\Users\Default\Favorites.data
%APPDATA%\CoralExplorer\Users\Default\StartPageConfig.data-journal
%HOMEPATH%\Start Menu\珊瑚浏览器.lnk
%HOMEPATH%\Start Menu\Programs\珊瑚浏览器\珊瑚浏览器.lnk
%APPDATA%\CoralExplorer\Users\Default\Default.cfg
%APPDATA%\CoralExplorer\Users\Default\History.data-journal
%APPDATA%\CoralExplorer\Users\Default\History.data
%APPDATA%\CoralExplorer\Users\Default\Favorites.data-journal
%TEMP%\nse3.tmp\FileInfo.dll
%APPDATA%\CoralExplorer\Users\Default\AliasUrl.data-journal
%PROGRAM_FILES%\CoralExplorer\Uninstall.exe
%APPDATA%\CoralExplorer\FavIcon\home.ico
%APPDATA%\CoralExplorer\Users\Default\SystemUrl.data
%APPDATA%\CoralExplorer\Users\Default\Crash.data
%TEMP%\IRW5.tmp
%APPDATA%\CoralExplorer\Users\Default\Crash.data-journal
%APPDATA%\CoralExplorer\Users\Default\AliasUrl.data
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\wpad[2].dat
%ALLUSERSPROFILE%\Application Data\kingsoft\kis\KCLT\common_duba_installact1976713879.inf
%ALLUSERSPROFILE%\Application Data\kingsoft\kis\KCLT\common_duba_installact2279213879.inf
%ALLUSERSPROFILE%\Application Data\kingsoft\kis\KCLT\common_duba_installer1976563879.inf
%TEMP%\HZ~7.tmp
%ALLUSERSPROFILE%\Application Data\kingsoft\kis\KCLT\common_duba_installact1973123879.inf
%ALLUSERSPROFILE%\Application Data\kingsoft\kis\KCLT\common_duba_installdone2285003879.inf
%ALLUSERSPROFILE%\Application Data\kingsoft\kis\KCLT\common_duba_installdown2288903879.inf
%ALLUSERSPROFILE%\Application Data\kingsoft\kis\KCLT\common_duba_installact2282813879.inf
%ALLUSERSPROFILE%\Application Data\kingsoft\kis\KCLT\common_duba_installer_antivirus2280153879.inf
%ALLUSERSPROFILE%\Application Data\kingsoft\kis\KCLT\common_duba_installerc2280313879.inf
%APPDATA%\CoralExplorer\temp\pending.hzt
%HOMEPATH%\Desktop\珊瑚浏览器.lnk
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\珊瑚浏览器.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\珊瑚浏览器\卸载程序.lnk
%HOMEPATH%\Start Menu\Programs\珊瑚浏览器\卸载程序.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\珊瑚浏览器\珊瑚浏览器.lnk
%ALLUSERSPROFILE%\Application Data\FreeDesk\resdata.db
%ALLUSERSPROFILE%\Application Data\FreeDesk\resdata.db-journal
C:\Documents and Settings\LocalService\My Documents\My Videos\Desktop.ini
%ALLUSERSPROFILE%\Application Data\kingsoft\kis\log\uplive\klivesetup.log
%PROGRAM_FILES%\CoralExplorer\StartPage\images\home\taobao_big.jpg
%PROGRAM_FILES%\CoralExplorer\StartPage\images\home\taobao_small.jpg
%PROGRAM_FILES%\CoralExplorer\StartPage\images\home\sina_small.jpg
%PROGRAM_FILES%\CoralExplorer\StartPage\images\home\kaixin_small.jpg
%PROGRAM_FILES%\CoralExplorer\StartPage\images\home\sina_big.jpg
%PROGRAM_FILES%\CoralExplorer\StartPage\js\coral.js
%PROGRAM_FILES%\CoralExplorer\StartPage\js\createmenu.js
%PROGRAM_FILES%\CoralExplorer\StartPage\js\RCAddressBar.js
%PROGRAM_FILES%\CoralExplorer\StartPage\images\home\youku_big.jpg
%PROGRAM_FILES%\CoralExplorer\StartPage\images\home\youku_small.jpg
%PROGRAM_FILES%\CoralExplorer\StartPage\images\home\kaixin_big.jpg
%PROGRAM_FILES%\CoralExplorer\StartPage\images\guide\xiangd.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\guide\xiangd.png
%PROGRAM_FILES%\CoralExplorer\StartPage\images\guide\start.png
%PROGRAM_FILES%\CoralExplorer\StartPage\images\guide\shanhu.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\guide\start.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\home\baidu_big.jpg
%PROGRAM_FILES%\CoralExplorer\StartPage\images\home\baidu_small.jpg
%PROGRAM_FILES%\CoralExplorer\StartPage\images\home\2345_small.jpg
%PROGRAM_FILES%\CoralExplorer\StartPage\images\guide\zuij.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\home\2345_big.jpg
%APPDATA%\CoralExplorer\FavIcon\6E086A7049DD129DF69051413AC6AB3A.ico
%APPDATA%\CoralExplorer\FavIcon\81C6AF03AC3E2B181DD99A3C1AFD1AA3.ico
%APPDATA%\CoralExplorer\FavIcon\3D6A8AC8F2013B0D7A1EA53076E96320.ico
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\wpad[1].dat
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\wpad[1].dat
%APPDATA%\CoralExplorer\FavIcon\F2A7BED2A1035F9E4EC022B3ECA481A8.ico
%APPDATA%\CoralExplorer\FavIcon\default_page.ico
%APPDATA%\CoralExplorer\FavIcon\A4C4A052651124668E8F829A3AA6D63C.ico
%APPDATA%\CoralExplorer\FavIcon\85131C29C8F7B398A345BD7F1A51DAB1.ico
%APPDATA%\CoralExplorer\FavIcon\8FDEAD446A8D607C20207D38D669E349.ico
%PROGRAM_FILES%\CoralExplorer\Config\Users\Default\SystemUrl.data
%PROGRAM_FILES%\CoralExplorer\Config\FavIcon\81C6AF03AC3E2B181DD99A3C1AFD1AA3.ico
%PROGRAM_FILES%\CoralExplorer\Config\FavIcon\85131C29C8F7B398A345BD7F1A51DAB1.ico
%PROGRAM_FILES%\CoralExplorer\Config\FavIcon\6E086A7049DD129DF69051413AC6AB3A.ico
%PROGRAM_FILES%\CoralExplorer\StartPage\js\keySuggestion.js
%PROGRAM_FILES%\CoralExplorer\Config\FavIcon\3D6A8AC8F2013B0D7A1EA53076E96320.ico
%PROGRAM_FILES%\CoralExplorer\Config\FavIcon\default_page.ico
%PROGRAM_FILES%\CoralExplorer\Config\FavIcon\home.ico
%PROGRAM_FILES%\CoralExplorer\Config\FavIcon\F2A7BED2A1035F9E4EC022B3ECA481A8.ico
%PROGRAM_FILES%\CoralExplorer\Config\FavIcon\8FDEAD446A8D607C20207D38D669E349.ico
%PROGRAM_FILES%\CoralExplorer\Config\FavIcon\A4C4A052651124668E8F829A3AA6D63C.ico
%PROGRAM_FILES%\CoralExplorer\StartPage\home.htm
%PROGRAM_FILES%\CoralExplorer\StartPage\index.htm
%PROGRAM_FILES%\CoralExplorer\StartPage\guide.htm
%PROGRAM_FILES%\CoralExplorer\Skins\Coral.xml
%PROGRAM_FILES%\FreeDesk\bmp\taobao1.bmp
%PROGRAM_FILES%\CoralExplorer\StartPage\step2.htm
%PROGRAM_FILES%\FreeDesk\bmp\youku1.bmp
%PROGRAM_FILES%\CoralExplorer\StartPage\step1.htm
%PROGRAM_FILES%\FreeDesk\bmp\tuan1.bmp
%PROGRAM_FILES%\CoralExplorer\StartPage\search.htm
%PROGRAM_FILES%\FreeDesk\bmp\QQ1.bmp
%PROGRAM_FILES%\CoralExplorer\Skins\Coral.skn
%PROGRAM_FILES%\FreeDesk\bmp\Thumbs.db
%PROGRAM_FILES%\FreeDesk\version.ini
%PROGRAM_FILES%\CoralExplorer\Skins\Coral.dui
%PROGRAM_FILES%\FreeDesk\update.exe
%PROGRAM_FILES%\CoralExplorer\Skins\CoralIE.skn
%PROGRAM_FILES%\FreeDesk\bmp\popcap1.bmp
%PROGRAM_FILES%\FreeDesk\bmp\ku61.bmp
%PROGRAM_FILES%\FreeDesk\bmp\baidu1.bmp
%PROGRAM_FILES%\FreeDesk\bmp\ie1.bmp
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_grid_bar_bj.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_grid_bar_blank.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_content_error.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_bottombar_report2.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_bottombar_report3.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_grid_bar_edit_pressed.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_grid_bar_refresh.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_grid_bar_edit_hover.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_grid_bar_blank_hover.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_grid_bar_edit.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_bottombar_report.gif
%PROGRAM_FILES%\FreeDesk\skins\AquaOS.ssk
%PROGRAM_FILES%\CoralExplorer\StartPage\css\css.css
%PROGRAM_FILES%\CoralExplorer\StartPage\step5.htm
%PROGRAM_FILES%\CoralExplorer\StartPage\step3.htm
%PROGRAM_FILES%\CoralExplorer\StartPage\step4.htm
%PROGRAM_FILES%\CoralExplorer\StartPage\images\blank.gif
%PROGRAM_FILES%\FreeDesk\svcupdate.exe
%PROGRAM_FILES%\CoralExplorer\StartPage\images\all_search_icon_baidu.gif
%PROGRAM_FILES%\AutoInstall\AutoInstall.exe
%PROGRAM_FILES%\CoralExplorer\StartPage\css\home.css
%TEMP%\nse3.tmp\System.dll
%PROGRAM_FILES%\CoralExplorer\Coral.exe
%TEMP%\nse2.tmp
%ALLUSERSPROFILE%\Application Data\IceBox_Downloader_Tmp\PkgDownDLL.dll
C:\Log\inst20130627.log
%TEMP%\_ir_sf_temp_0\irsetup.dat
%PROGRAM_FILES%\CoralExplorer\CoralDownload.dll
%PROGRAM_FILES%\CoralExplorer\CoralDb.dll
%PROGRAM_FILES%\CoralExplorer\CoralApp.dll
%PROGRAM_FILES%\CoralExplorer\Coral.dll
%ALLUSERSPROFILE%\Application Data\IceBox_Downloader_Tmp\IOCPUdp.dll
C:\setup3021.exe
C:\FreeDesk_qingqing.exe
C:\CoralExplorer_200465.exe
C:\Loader_forqd535.exe
C:\inst.exe
%TEMP%\_ir_sf_temp_0\irsetup.exe
%ALLUSERSPROFILE%\Application Data\IceBox_Downloader_Tmp\IOCPTcp.dll
%ALLUSERSPROFILE%\Application Data\kingsoft\kis\hg.dat
C:\KAV11_18_5355.exe
C:\kugoo.exe
%PROGRAM_FILES%\uninstall.exe
%PROGRAM_FILES%\Uninstall\uninstall.xml
%PROGRAM_FILES%\Uninstall\uninstall.dat
%TEMP%\їмЅЭЧАГж Setup Log.txt
%PROGRAM_FILES%\Uninstall\uni4.tmp
%PROGRAM_FILES%\FreeDesk\SkinPlusPlus.dll
%PROGRAM_FILES%\FreeDesk\unrar.dll
%PROGRAM_FILES%\CoralExplorer\CoralUI2.dll
%PROGRAM_FILES%\FreeDesk\cfg.ini
%PROGRAM_FILES%\FreeDesk\FreeDesk.exe
%PROGRAM_FILES%\CoralExplorer\msvcr80.dll
%PROGRAM_FILES%\CoralExplorer\CoralTrident.dll
%PROGRAM_FILES%\CoralExplorer\CoralUI.dll
%TEMP%\_ir_sf_temp_0\IRIMG3.JPG
%TEMP%\_ir_sf_temp_0\IRIMG1.JPG
%TEMP%\_ir_sf_temp_0\IRIMG2.JPG
%PROGRAM_FILES%\CoralExplorer\珊瑚免责声明.txt
%PROGRAM_FILES%\CoralExplorer\Microsoft.VC80.CRT.manifest
%PROGRAM_FILES%\CoralExplorer\lang\CoralLang_chs.dll
%PROGRAM_FILES%\CoralExplorer\CoralUpdate.dll
%PROGRAM_FILES%\CoralExplorer\CoralRender.dll
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_grid_bar_refresh_hover.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_icon_staobao.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_icon_vbaidu.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_icon_spaipai.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_icon_sogou.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_icon_soso.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_icon_vyouku.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_icon_wbaidu.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_icon_vtudou.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_icon_vgoogle.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_icon_vsoso.gif
%ALLUSERSPROFILE%\Application Data\lvc\psvc.exe
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_icon_mbaidu.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_icon_mgoogle.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_icon_magoogle.gif
%HOMEPATH%\Start Menu\Programs\їмЅЭЧАГж\Uninstall їмЅЭЧАГж.lnk
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_icon_mabaidu.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_icon_sjyjo.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_icon_sodou.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_icon_sdangdang.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_icon_msoso.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_icon_sbuy360.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_logo_mabaidu.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_logo_magoogle.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_logo_isoso.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_logo_ibaidu.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_logo_igoogle.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_logo_sbuy360.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_logo_sdangdang.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_logo_msoso.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_logo_mbaidu.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_logo_mgoogle.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_logo_google.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_icon_youdao.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_logo_baidu.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_icon_yahoo.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_icon_wsoso.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_icon_wwiki.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_logo_dverycd.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_logo_dxunlei.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_logo_dshooter.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_logo_bing.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_logo_dduote.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_act_youdao.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_background1.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_act_yahoo.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_act_sogou.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_act_soso.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_background3.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_background4.gif
%HOMEPATH%\Start Menu\Programs\їмЅЭЧАГж\їмЅЭЧАГж.lnk
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_background2.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_background2b.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_act_google.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_grid_bar_remove_pressed.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_grid_item.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_grid_bar_remove_hover.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_grid_bar_refresh_pressed.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_grid_bar_remove.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_act_baidu.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_act_bing.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_grid_item_loading.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_grid_item_add.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_grid_item_hover.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_icon_dshooter.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_icon_dverycd.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_icon_dduote.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_icon_baidu.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_icon_bing.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_icon_igoogle.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_icon_isoso.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_icon_ibaidu.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_icon_dxunlei.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_icon_google.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_button.gif
%PROGRAM_FILES%\Uninstall\IRIMG2.JPG
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_bigicon_google.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_bigicon_bing.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_bigicon_baidu.gif
%PROGRAM_FILES%\Uninstall\IRIMG1.JPG
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_bigicon_yahoo.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_bigicon_youdao.gif
%PROGRAM_FILES%\Uninstall\IRIMG3.JPG
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_bigicon_sogou.gif
%PROGRAM_FILES%\CoralExplorer\StartPage\images\main_search_bigicon_soso.gif

Присваивает атрибут 'скрытый' для следующих файлов:

C:\Documents and Settings\LocalService\My Documents\My Videos\Desktop.ini
%PROGRAM_FILES%\FreeDesk\bmp\Thumbs.db

Удаляет следующие файлы:

%APPDATA%\CoralExplorer\Users\Default\Favorites.data-journal
%APPDATA%\CoralExplorer\Users\Default\StartPageConfig.data-journal
%TEMP%\IRW5.tmp
%APPDATA%\CoralExplorer\Users\Default\Crash.data-journal
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\wpad[2].dat
%APPDATA%\CoralExplorer\Users\Default\SmartUrl.data-journal
%TEMP%\_ir_sf_temp_0\IRIMG2.JPG
%TEMP%\_ir_sf_temp_0\IRIMG3.JPG
%TEMP%\_ir_sf_temp_0\IRIMG1.JPG
%APPDATA%\CoralExplorer\Users\Default\History.data-journal
%ALLUSERSPROFILE%\Application Data\FreeDesk\resdata.db-journal
%PROGRAM_FILES%\AutoInstall\AutoInstall.exe
%TEMP%\alpha-Link Select.cur
%PROGRAM_FILES%\Uninstall\uni4.tmp
%TEMP%\_ir_sf_temp_0\irsetup.exe
%TEMP%\_ir_sf_temp_0\irsetup.dat
%TEMP%\alpha-Normal select.cur
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\wpad[1].dat
%APPDATA%\CoralExplorer\Users\Default\AliasUrl.data-journal
%TEMP%\nse3.tmp\System.dll
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\wpad[1].dat
%TEMP%\nse3.tmp\FileInfo.dll

Перемещает следующие файлы:

%TEMP%\HZ~7.tmp в %APPDATA%\CoralExplorer\Users\Default\Default.cfg

Сетевая активность:

Подключается к:

'd2.###rotect.net':90
'localhost':1047
'localhost':1036
'wp#d':80

TCP:

Запросы HTTP GET:

wp#d/wpad.dat

UDP:

DNS ASK www.sy##.net.cn
DNS ASK cs#######-2-crl.verisign.com
DNS ASK www.ba##u.com
DNS ASK up####.shanhu99.com
DNS ASK www.1w##wan.com
DNS ASK cd###.www.duba.net
DNS ASK in##.duba.net
DNS ASK www.18##1.com
DNS ASK d2.###rotect.net
DNS ASK wp#d
DNS ASK IB#####rface.icebox.cn
DNS ASK do####ad.pplive.com
DNS ASK crl.verisign.com
DNS ASK xi####.kugou.com
'ib#####rface.icebox.cn':7910

Другое:

Ищет следующие окна:

ClassName: 'MDIClient' WindowName: '(null)'
ClassName: 'MS_WINHELP' WindowName: '(null)'
ClassName: 'EDIT' WindowName: '(null)'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней