Техническая информация
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\taskkill.exe' /f /im cmd.exe
Завершает или пытается завершить
следующие системные процессы:
- <SYSTEM32>\cmd.exe
Изменения в файловой системе:
Создает следующие файлы:
- %PROGRAM_FILES%\OKHY\Cursors\aero_nwse.cur
- %PROGRAM_FILES%\OKHY\Cursors\aero_ns.cur
- %PROGRAM_FILES%\OKHY\Cursors\aero_unavail.cur
- %PROGRAM_FILES%\OKHY\Cursors\aero_pen.cur
- %PROGRAM_FILES%\OKHY\Cursors\aero_link.cur
- %PROGRAM_FILES%\OKHY\Cursors\aero_helpsel.cur
- %PROGRAM_FILES%\OKHY\Cursors\aero_nesw.cur
- %PROGRAM_FILES%\OKHY\Cursors\aero_move.cur
- %PROGRAM_FILES%\OKHY\okhy\endall.vbs
- %PROGRAM_FILES%\OKHY\okhy\systask.txt
- %PROGRAM_FILES%\OKHY\okhy\gpn.ini
- %PROGRAM_FILES%\OKHY\okhy\unokhy.ini
- %PROGRAM_FILES%\OKHY\Cursors\aero_working.ani
- %PROGRAM_FILES%\OKHY\Cursors\aero_up.cur
- %PROGRAM_FILES%\OKHY\okhy\reinstie6.ini
- %PROGRAM_FILES%\OKHY\okhy\Cursors.ini
- %PROGRAM_FILES%\OKHY\excel.ico
- %PROGRAM_FILES%\OKHY\okhy\ntsdexts.dll
- %PROGRAM_FILES%\OKHY\okhy\unok.vbs
- %PROGRAM_FILES%\OKHY\word.ico
- %PROGRAM_FILES%\OKHY\okhy\OEMLOGO.bmp
- %PROGRAM_FILES%\OKHY\okhy\OEMAX.bmp
- %PROGRAM_FILES%\OKHY\okhy\ntsd.exe
- %PROGRAM_FILES%\OKHY\okhy\OEMLTDN.bmp
- %PROGRAM_FILES%\OKHY\Cursors\aero_busy.ani
- %PROGRAM_FILES%\OKHY\Cursors\aero_beam.cur
- %PROGRAM_FILES%\OKHY\Cursors\aero_ew.cur
- %PROGRAM_FILES%\OKHY\Cursors\aero_cross.cur
- %PROGRAM_FILES%\OKHY\okhy\cmd.exe
- %PROGRAM_FILES%\OKHY\okhy\srcd.dll
- %PROGRAM_FILES%\OKHY\Cursors\aero_arrow.cur
- %PROGRAM_FILES%\OKHY\okhy\tasklist.exe
- %PROGRAM_FILES%\OKHY\okhy\RegDllView_lng.ini
- %PROGRAM_FILES%\OKHY\okhy\软件卸载工具.cfg
- %PROGRAM_FILES%\OKHY\okhy\RegDllView.exe
- %PROGRAM_FILES%\OKHY\okhy\acm.exe
- %PROGRAM_FILES%\OKHY\okhy\gpy.cmd
- %PROGRAM_FILES%\OKHY\okhy\gpn.cmd
- %PROGRAM_FILES%\OKHY\okhy\wait.vbs
- %PROGRAM_FILES%\OKHY\okhy\ntptime.exe
- %PROGRAM_FILES%\OKHY\okhy\shellico.ini
- %PROGRAM_FILES%\OKHY\okhy\oklogclr.exe
- %PROGRAM_FILES%\OKHY\okhy\Notepad2.exe
- %PROGRAM_FILES%\OKHY\okhy\notepad2.ini
- %PROGRAM_FILES%\OKHY\okhy\软件卸载工具_lng.ini
- %PROGRAM_FILES%\OKHY\okhy\cports.exe
- %PROGRAM_FILES%\OKHY\okhy\cports_lng.ini
- %PROGRAM_FILES%\OKHY\okhy\acm_lng.ini
- %PROGRAM_FILES%\OKHY\okhy\resetacl.cmd
- %PROGRAM_FILES%\OKHY\okhy\regdll.cmd
- %PROGRAM_FILES%\OKHY\okhy\Schedule.cmd
- %PROGRAM_FILES%\OKHY\okhy\runonce.cmd
- %PROGRAM_FILES%\OKHY\okhy\macreg.ini
- %PROGRAM_FILES%\OKHY\okhy\usrreg.ini
- %PROGRAM_FILES%\OKHY\okhy\prepair.cmd
- %PROGRAM_FILES%\OKHY\okhy\prepair.ini
- %PROGRAM_FILES%\OKHY\okhy\endall.cmd
- %PROGRAM_FILES%\OKHY\okhy\closeide.cmd
- %PROGRAM_FILES%\OKHY\okhy\getip.cmd
- %PROGRAM_FILES%\OKHY\okhy\fixlsp.cmd
- %PROGRAM_FILES%\OKHY\okhy\unokhy2.cmd
- %PROGRAM_FILES%\OKHY\okhy\task.cmd
- %PROGRAM_FILES%\OKHY\okhy\update.cmd
- %PROGRAM_FILES%\OKHY\okhy\unokhy.cmd
- %PROGRAM_FILES%\OKHY\okhy\gp.ini
- %PROGRAM_FILES%\OKHY\okhy\360SE.ini
- %PROGRAM_FILES%\OKHY\okhy\Maxthon.ini
- %PROGRAM_FILES%\OKHY\okhy\gpt.ini
- %PROGRAM_FILES%\OKHY\okhy\fix.vbs
- %PROGRAM_FILES%\OKHY\okhy\Registry.pol
- %PROGRAM_FILES%\OKHY\okhy\reboot.vbs
- %PROGRAM_FILES%\OKHY\okhy\instside.vbs
- %PROGRAM_FILES%\OKHY\okhy\TheWorld2.ini
- %PROGRAM_FILES%\OKHY\okhy\Schedule.ini
- %PROGRAM_FILES%\OKHY\okhy\unrb.ini
- %PROGRAM_FILES%\OKHY\okhy\TheWorld3.ini
- %PROGRAM_FILES%\OKHY\okhy\OEMAX.ini
- %PROGRAM_FILES%\OKHY\okhy\needrb.ini
- %PROGRAM_FILES%\OKHY\okhy\OEMLTDN.ini
- %PROGRAM_FILES%\OKHY\okhy\OEMINFO.ini
- %PROGRAM_FILES%\OKHY\setupxp.ini
- %PROGRAM_FILES%\OKHY\垃圾清理.cmd
- %PROGRAM_FILES%\OKHY\okhy\okhynew.txt
- %PROGRAM_FILES%\OKHY\lockshell.ini
- %PROGRAM_FILES%\OKHY\favicon.ico
- %PROGRAM_FILES%\OKHY\bbs.ico
- %PROGRAM_FILES%\OKHY\垃圾清理.ico
- %PROGRAM_FILES%\OKHY\Win2000.ico
- %PROGRAM_FILES%\OKHY\okhy\建议与错误报告.url
- %PROGRAM_FILES%\OKHY\okhy\okhy.htm
- %PROGRAM_FILES%\OKHY\okhy\NTREGOPT.LOC
- %PROGRAM_FILES%\OKHY\okhy\prefs.js
- %PROGRAM_FILES%\OKHY\temp\upxp.okr
- %PROGRAM_FILES%\OKHY\okhy\okres.ok
- %PROGRAM_FILES%\OKHY\okhy\TtConf.dat
- %PROGRAM_FILES%\OKHY\okhy\qqsbdata.dat
- %PROGRAM_FILES%\OKHY\okhy\taskkill.exe
- %PROGRAM_FILES%\OKHY\okhy\systeminfo.exe
- %PROGRAM_FILES%\OKHY\okhy\WICleanupC.EXE
- %PROGRAM_FILES%\OKHY\okhy\taskmgr.ok
- %PROGRAM_FILES%\OKHY\okhy\secedit.exe
- %PROGRAM_FILES%\OKHY\okhy\sc.exe
- %PROGRAM_FILES%\OKHY\okhy\shutdown.exe
- %PROGRAM_FILES%\OKHY\okhy\setacl.exe
- %PROGRAM_FILES%\OKHY\okhy\images\bg.gif
- %PROGRAM_FILES%\OKHY\okhy\images\baidu.gif
- %PROGRAM_FILES%\OKHY\okhy\images\seach.gif
- %PROGRAM_FILES%\OKHY\okhy\images\google.gif
- %PROGRAM_FILES%\OKHY\okhy\屏幕截图.EXE
- %PROGRAM_FILES%\OKHY\okhy\恢复IE快捷方式.exe
- %PROGRAM_FILES%\OKHY\okhy\自启动管理.exe
- %PROGRAM_FILES%\OKHY\okhy\软件卸载工具.exe
- %PROGRAM_FILES%\OKHY\okhy\fc.exe
- %PROGRAM_FILES%\OKHY\okhy\chkntfs.exe
- %PROGRAM_FILES%\OKHY\okhy\gpupdate.exe
- %PROGRAM_FILES%\OKHY\okhy\findstr.exe
- %PROGRAM_FILES%\OKHY\okhy\hosts1st
- %PROGRAM_FILES%\OKHY\okhy\whatsnew.txt
- %PROGRAM_FILES%\OKHY\okhy\at.exe
- %PROGRAM_FILES%\OKHY\okhy\hostsok
- %PROGRAM_FILES%\OKHY\okhy\NTREGOPT.EXE
- %PROGRAM_FILES%\OKHY\okhy\net.exe
- %PROGRAM_FILES%\OKHY\okhy\reg.exe
- %PROGRAM_FILES%\OKHY\okhy\ping.exe
- %PROGRAM_FILES%\OKHY\okhy\mshta.exe
- %PROGRAM_FILES%\OKHY\okhy\ipconfig.exe
- %PROGRAM_FILES%\OKHY\okhy\MsiZap.exe
- %PROGRAM_FILES%\OKHY\okhy\msicuu.exe
Удаляет следующие файлы:
- %PROGRAM_FILES%\OKHY\okhy\Notepad2.exe
Другое:
Ищет следующие окна:
- ClassName: '(null)' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'EDIT' WindowName: '(null)'
