Trojan.Click1.61200

Техническая информация

Для обеспечения автозапуска и распространения:

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\Kingsoft Antivirus WebShield Service] 'Start' = '00000002'

Вредоносные функции:

Создает и запускает на исполнение:

'%TEMP%\nsr7.tmp\nsB.tmp' %WINDIR%\3575~1\9897~1\KSWebShield.exe -start
'%TEMP%\nsr7.tmp\nsA.tmp' %WINDIR%\3575~1\9897~1\KSWebShield.exe -install
'%TEMP%\nsr7.tmp\nsD.tmp' cmd.exe /c attrib +h +s +r "%WINDIR%\3575~1\9897~1\APPLIC~1\kingsoft\kws\kws.ini"
'%TEMP%\nsr7.tmp\nsC.tmp' cmd.exe /c copy "%TEMP%\kws.ini" "%WINDIR%\3575~1\9897~1\APPLIC~1\kingsoft\kws\"
'%WINDIR%\kingsoft.exe'
'%TEMP%\nsw3.tmp\ns4.tmp' %WINDIR%\kingsoft.exe
'%TEMP%\nsr7.tmp\ns9.tmp' cmd.exe /c mkdir \\.\%WINDIR%\3575~1\9897..\
'%TEMP%\nsr7.tmp\ns8.tmp' cmd.exe /c mkdir \\.\%WINDIR%\3575..\

Запускает на исполнение:

'<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\3575~1\9897~1\APPLIC~1\kingsoft\kws\kws.ini"
'%PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE' http://go.#######69%6C%65%61.%69%6E%66%6F/?i=#######
'%PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE' http://go.#######69%6C%65%61.%69%6E%66%6F/?i=##################################

Изменения в файловой системе:

Создает следующие файлы:

%HOMEPATH%\Favorites\»ўДкФЛіМ.url
%HOMEPATH%\Favorites\ГАЕ®КУЖµ.url
%HOMEPATH%\Favorites\ІШН·К«ґК.url
%HOMEPATH%\Favorites\ёцРФЗ©Гы.url
%HOMEPATH%\Favorites\ЙМТµµјєЅ.url
%HOMEPATH%\Favorites\НшЦ·ґуИ«.url
%HOMEPATH%\Favorites\Фµ·ЦЕд¶Ф.url
%HOMEPATH%\Favorites\КЦ»ъЧЈёЈ.url
%HOMEPATH%\Favorites\МФ±¦№єОп.url
%WINDIR%\myfav\Radio Station Guide.url
%WINDIR%\myfav\Links\Customize Links.url
%WINDIR%\myfav\Desktop.ini
%WINDIR%\myfav\MSN.com.url
%WINDIR%\myfav\Links\Free Hotmail.url
%WINDIR%\myfav\Links\Windows.url
%HOMEPATH%\Favorites\°ЛШФЙ«Нј.url
%WINDIR%\myfav\Links\Windows Marketplace.url
%WINDIR%\myfav\Links\Windows Media.url
%HOMEPATH%\Favorites\ѕЙµДКХІШ\MSN.com.url
%HOMEPATH%\Favorites\ѕЙµДКХІШ\Radio Station Guide.url
%HOMEPATH%\Favorites\БґЅУ\Фµ·ЦЕд¶Ф.url
%HOMEPATH%\Favorites\ѕЙµДКХІШ\Desktop.ini
%HOMEPATH%\Favorites\ѕЙµДКХІШ\Links\Customize Links.url
%HOMEPATH%\Favorites\ѕЙµДКХІШ\Links\Windows Media.url
%HOMEPATH%\Favorites\ѕЙµДКХІШ\Links\Windows.url
%HOMEPATH%\Favorites\ѕЙµДКХІШ\Links\Free Hotmail.url
%HOMEPATH%\Favorites\ѕЙµДКХІШ\Links\Windows Marketplace.url
%HOMEPATH%\Favorites\БґЅУ\ёцРФЗ©Гы.url
%HOMEPATH%\Favorites\БґЅУ\»ўДкФЛіМ.url
%HOMEPATH%\Favorites\БґЅУ\°ЛШФЙ«Нј.url
%HOMEPATH%\Favorites\БґЅУ\ІШН·К«ґК.url
%HOMEPATH%\Favorites\БґЅУ\ГАЕ®КУЖµ.url
%HOMEPATH%\Favorites\БґЅУ\МФ±¦№єОп.url
%HOMEPATH%\Favorites\БґЅУ\НшЦ·ґуИ«.url
%HOMEPATH%\Favorites\БґЅУ\ЙМТµµјєЅ.url
%HOMEPATH%\Favorites\БґЅУ\КЦ»ъЧЈёЈ.url
%ALLUSERSPROFILE%\Desktop\Н¬іЗТмРФ.exe
%TEMP%\nsr7.tmp\ns9.tmp
%WINDIR%\3575.\9897.\kswebshield.dll
%TEMP%\nsr7.tmp\nsExec.dll
%TEMP%\nsr7.tmp\ns8.tmp
%WINDIR%\3575.\9897.\KSWebShield.exe
%WINDIR%\3575.\9897.\KSWBC.dll
%TEMP%\nsr7.tmp\nsA.tmp
%WINDIR%\3575.\9897.\kwssp.dll
%WINDIR%\3575.\9897.\kwsui.dll
%TEMP%\nsw3.tmp\System.dll
%WINDIR%\kingsoft.exe
%TEMP%\nsg2.tmp
%TEMP%\nsw3.tmp\time.dll
%TEMP%\nsw3.tmp\nsExec.dll
%TEMP%\nsr7.tmp\time.dll
%TEMP%\nsr7.tmp\nsRandom.dll
%TEMP%\nsw3.tmp\ns4.tmp
%TEMP%\nsb6.tmp
%TEMP%\nsw3.tmp\InetLoad.dll
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\31recall[1].htm
%TEMP%\nsr7.tmp\nsD.tmp
%TEMP%\nsw3.tmp\Math.dll
%WINDIR%\0
%ALLUSERSPROFILE%\Desktop\Й«ЗйµзУ°.exe
%ALLUSERSPROFILE%\Desktop\МФ±¦Нш.exe
%ALLUSERSPROFILE%\Desktop\2010ДкЦВё».exe
%ALLUSERSPROFILE%\Desktop\ГАЕ®ИИОи.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\go.lailea[1]
%WINDIR%\3575.\9897.\KWSSVC.log
%TEMP%\nsr7.tmp\nsB.tmp
%TEMP%\kws.ini
%WINDIR%\3575.\9897.\Application Data\kingsoft\kws\urlcache.dat
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\go.lailea[1]
%TEMP%\nsr7.tmp\nsC.tmp
%WINDIR%\3575.\9897.\Application Data\kingsoft\kws\kws.ini