Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Classes\https\shell\open\command] '' = '"%PROGRAM_FILES%\Tango3\tango3.exe" "%1"'
- <Служебный элемент>
- [<HKLM>\SOFTWARE\Clients\StartMenuInternet\tango3.exe\shell\open\command] '' = '%PROGRAM_FILES%\Tango3\tango3.exe'
- [<HKLM>\SOFTWARE\Classes\HTTP\shell\open\command] '' = '"%PROGRAM_FILES%\Tango3\tango3.exe" "%1"'
- [<HKLM>\SOFTWARE\Classes\htmlfile\shell\open\command] '' = '"%PROGRAM_FILES%\Tango3\tango3.exe" "%1"'
- [<HKLM>\SOFTWARE\Classes\InternetShortcut\shell\open\command] '' = '"%PROGRAM_FILES%\Tango3\tango3.exe" "%1"'
- [<HKLM>\SOFTWARE\Classes\mhtmlfile\shell\open\command] '' = '"%PROGRAM_FILES%\Tango3\tango3.exe" "%1"'
Вредоносные функции:
Создает и запускает на исполнение:
- '%PROGRAM_FILES%\Tango3\SetLink.exe'
- '%PROGRAM_FILES%\Tango3\tango3.exe' /setdefault
Изменения в файловой системе:
Создает следующие файлы:
- %PROGRAM_FILES%\Tango3\image\nopic2.ico
- %PROGRAM_FILES%\Tango3\image\nopic.ico
- %PROGRAM_FILES%\Tango3\image\nopop.ico
- %PROGRAM_FILES%\Tango3\image\openfolder.ico
- %PROGRAM_FILES%\Tango3\image\nopop2.ico
- %PROGRAM_FILES%\Tango3\image\noflash.ico
- %PROGRAM_FILES%\Tango3\image\nocheck.ico
- %PROGRAM_FILES%\Tango3\image\noflash2.ico
- %PROGRAM_FILES%\Tango3\image\nofloat2.ico
- %PROGRAM_FILES%\Tango3\image\nofloat.ico
- %PROGRAM_FILES%\Tango3\image\print.ico
- %PROGRAM_FILES%\Tango3\image\paste.ico
- %PROGRAM_FILES%\Tango3\image\private.ico
- %PROGRAM_FILES%\Tango3\image\qiantai.ico
- %PROGRAM_FILES%\Tango3\image\private2.ico
- %PROGRAM_FILES%\Tango3\image\openlink2.ico
- %PROGRAM_FILES%\Tango3\image\openlink.ico
- %PROGRAM_FILES%\Tango3\image\pagefind.ico
- %PROGRAM_FILES%\Tango3\image\page_zoom.ico
- %PROGRAM_FILES%\Tango3\image\page_world.ico
- %PROGRAM_FILES%\Tango3\image\newpage.ico
- %PROGRAM_FILES%\Tango3\image\find_next.ico
- %PROGRAM_FILES%\Tango3\image\find.ico
- %PROGRAM_FILES%\Tango3\image\find_prior.ico
- %PROGRAM_FILES%\Tango3\image\font_size.ico
- %PROGRAM_FILES%\Tango3\image\folder.ico
- %PROGRAM_FILES%\Tango3\image\fillform.ico
- %PROGRAM_FILES%\Tango3\image\favorites.ico
- %PROGRAM_FILES%\Tango3\image\filter.ico
- %PROGRAM_FILES%\Tango3\image\filterad2.ico
- %PROGRAM_FILES%\Tango3\image\filterad.ico
- %PROGRAM_FILES%\Tango3\image\jiasu2.ico
- %PROGRAM_FILES%\Tango3\image\jiasu1.ico
- %PROGRAM_FILES%\Tango3\image\localfile.ico
- %PROGRAM_FILES%\Tango3\image\msgpop.ico
- %PROGRAM_FILES%\Tango3\image\lock.ico
- %PROGRAM_FILES%\Tango3\image\history.ico
- %PROGRAM_FILES%\Tango3\image\highlight.ico
- %PROGRAM_FILES%\Tango3\image\home.ico
- %PROGRAM_FILES%\Tango3\image\ie.ico
- %PROGRAM_FILES%\Tango3\image\hungwnd.png
- %PROGRAM_FILES%\Tango3\skin\chrome.zip
- %PROGRAM_FILES%\Tango3\plugin\ЧФ¶ЇМо±н\tgplug.ini
- %PROGRAM_FILES%\Tango3\webicon\pindao.huoban.taobao.com_favicon.ico
- %PROGRAM_FILES%\Tango3\webicon\www.amazon.cn_favicon.ico
- %PROGRAM_FILES%\Tango3\webicon\union.dangdang.com_favicon.ico
- %PROGRAM_FILES%\Tango3\plugin\НвІїіМРт\tgplug.ini
- %PROGRAM_FILES%\Tango3\plugin\НвІїіМРт\tgplug.ico
- %PROGRAM_FILES%\Tango3\plugin\ЗеіэјЗВј\tgplug.ico
- %PROGRAM_FILES%\Tango3\plugin\ЧФ¶ЇМо±н\tgplug.ico
- %PROGRAM_FILES%\Tango3\plugin\ЗеіэјЗВј\tgplug.ini
- %HOMEPATH%\Start Menu\Programs\МЗ№ыдЇААЖч3\МЗ№ыдЇААЖч3№Щ·ЅЦчТі.lnk
- %HOMEPATH%\Start Menu\Programs\МЗ№ыдЇААЖч3\МЗ№ыдЇААЖч3.lnk
- %PROGRAM_FILES%\Tango3\uninst.exe
- %HOMEPATH%\Favorites\°Щ¶И.url
- %HOMEPATH%\Desktop\Internet Explorer.lnk
- %PROGRAM_FILES%\Tango3\webicon\www.baidu.com_favicon.ico
- %PROGRAM_FILES%\Tango3\webicon\www.tg1234.com_favicon.ico
- %PROGRAM_FILES%\Tango3\tango3.exe
- %PROGRAM_FILES%\Tango3\custom.ini
- %PROGRAM_FILES%\Tango3\SetLink.exe
- %PROGRAM_FILES%\Tango3\image\zoom.ico
- %PROGRAM_FILES%\Tango3\image\search.png
- %PROGRAM_FILES%\Tango3\image\search.ico
- %PROGRAM_FILES%\Tango3\image\searchbtn.png
- %PROGRAM_FILES%\Tango3\image\skin.ico
- %PROGRAM_FILES%\Tango3\image\shot.ico
- %PROGRAM_FILES%\Tango3\image\refresh.ico
- %PROGRAM_FILES%\Tango3\image\qiantai2.ico
- %PROGRAM_FILES%\Tango3\image\safe.ico
- %PROGRAM_FILES%\Tango3\image\save.ico
- %PROGRAM_FILES%\Tango3\image\safecheck.ico
- %PROGRAM_FILES%\Tango3\image\tgsoso.png
- %PROGRAM_FILES%\Tango3\image\tgsoso.ico
- %PROGRAM_FILES%\Tango3\image\uncheck.ico
- %PROGRAM_FILES%\Tango3\image\user.ico
- %PROGRAM_FILES%\Tango3\image\unknow.ico
- %PROGRAM_FILES%\Tango3\image\startlogo.gif
- %PROGRAM_FILES%\Tango3\image\split_screen.ico
- %PROGRAM_FILES%\Tango3\image\statistics.ico
- %PROGRAM_FILES%\Tango3\image\tango.ico
- %PROGRAM_FILES%\Tango3\image\stop.ico
- %PROGRAM_FILES%\Tango3\image\extendtool.ico
- %PROGRAM_FILES%\Tango3\doc\jiqiao_12.htm
- %PROGRAM_FILES%\Tango3\doc\jiqiao_11.htm
- %PROGRAM_FILES%\Tango3\doc\jiqiao_13.htm
- %PROGRAM_FILES%\Tango3\doc\jiqiao_15.htm
- %PROGRAM_FILES%\Tango3\doc\jiqiao_14.htm
- %PROGRAM_FILES%\Tango3\doc\help_9.htm
- %PROGRAM_FILES%\Tango3\doc\help_7.htm
- %PROGRAM_FILES%\Tango3\doc\help_faq.htm
- %PROGRAM_FILES%\Tango3\doc\jiqiao_10.htm
- %PROGRAM_FILES%\Tango3\doc\jiqiao.htm
- %PROGRAM_FILES%\Tango3\doc\jiqiao_3.htm
- %PROGRAM_FILES%\Tango3\doc\jiqiao_20.htm
- %PROGRAM_FILES%\Tango3\doc\jiqiao_4.htm
- %PROGRAM_FILES%\Tango3\doc\jiqiao_6.htm
- %PROGRAM_FILES%\Tango3\doc\jiqiao_5.htm
- %PROGRAM_FILES%\Tango3\doc\jiqiao_17.htm
- %PROGRAM_FILES%\Tango3\doc\jiqiao_16.htm
- %PROGRAM_FILES%\Tango3\doc\jiqiao_18.htm
- %PROGRAM_FILES%\Tango3\doc\jiqiao_2.htm
- %PROGRAM_FILES%\Tango3\doc\jiqiao_19.htm
- %PROGRAM_FILES%\Tango3\doc\help_5.htm
- %PROGRAM_FILES%\Tango3\inittoolbarurls.txt
- %PROGRAM_FILES%\Tango3\inittgfilter.txt
- %PROGRAM_FILES%\Tango3\bin\TGGDI2.dll
- %PROGRAM_FILES%\Tango3\bin\wmdll3.dll
- %PROGRAM_FILES%\Tango3\bin\TGHistory.dll
- %HOMEPATH%\Desktop\МЗ№ыдЇААЖч3.lnk
- %TEMP%\nsf2.tmp
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\МЗ№ыдЇААЖч3.lnk
- %PROGRAM_FILES%\Tango3\initsearcheng.txt
- %HOMEPATH%\Start Menu\МЗ№ыдЇААЖч3.lnk
- %PROGRAM_FILES%\Tango3\doc\help_12.htm
- %PROGRAM_FILES%\Tango3\doc\help_11.htm
- %PROGRAM_FILES%\Tango3\doc\help_13.htm
- %PROGRAM_FILES%\Tango3\doc\help_3.htm
- %PROGRAM_FILES%\Tango3\doc\help_2.htm
- %PROGRAM_FILES%\Tango3\doc\404top.htm
- %PROGRAM_FILES%\Tango3\bin\TangoWeb.exe
- %PROGRAM_FILES%\Tango3\doc\all.htm
- %PROGRAM_FILES%\Tango3\doc\help_10.htm
- %PROGRAM_FILES%\Tango3\doc\help_1.htm
- %PROGRAM_FILES%\Tango3\image\booko.ico
- %PROGRAM_FILES%\Tango3\image\book.ico
- %PROGRAM_FILES%\Tango3\image\catchhtml.ico
- %PROGRAM_FILES%\Tango3\image\close.ico
- %PROGRAM_FILES%\Tango3\image\clean.ico
- %PROGRAM_FILES%\Tango3\doc\view_8.htm
- %PROGRAM_FILES%\Tango3\doc\view_7.htm
- %PROGRAM_FILES%\Tango3\doc\view_9.htm
- %PROGRAM_FILES%\Tango3\image\alexa.ico
- %PROGRAM_FILES%\Tango3\image\ad_hunter.ico
- %PROGRAM_FILES%\Tango3\image\dsearch.ico
- %PROGRAM_FILES%\Tango3\image\default.ico
- %PROGRAM_FILES%\Tango3\image\encoding.ico
- %PROGRAM_FILES%\Tango3\image\exsearch.ico
- %PROGRAM_FILES%\Tango3\image\engset.ico
- %PROGRAM_FILES%\Tango3\image\copy.ico
- %PROGRAM_FILES%\Tango3\image\closed.ico
- %PROGRAM_FILES%\Tango3\image\cut.ico
- %PROGRAM_FILES%\Tango3\image\date.ico
- %PROGRAM_FILES%\Tango3\image\danger.ico
- %PROGRAM_FILES%\Tango3\doc\view_6.htm
- %PROGRAM_FILES%\Tango3\doc\quick_4.htm
- %PROGRAM_FILES%\Tango3\doc\quick_3.htm
- %PROGRAM_FILES%\Tango3\doc\quick_5.htm
- %PROGRAM_FILES%\Tango3\doc\quick_7.htm
- %PROGRAM_FILES%\Tango3\doc\quick_6.htm
- %PROGRAM_FILES%\Tango3\doc\jiqiao_8.htm
- %PROGRAM_FILES%\Tango3\doc\jiqiao_7.htm
- %PROGRAM_FILES%\Tango3\doc\jiqiao_9.htm
- %PROGRAM_FILES%\Tango3\doc\quick_2.htm
- %PROGRAM_FILES%\Tango3\doc\quick.htm
- %PROGRAM_FILES%\Tango3\doc\view_2.htm
- %PROGRAM_FILES%\Tango3\doc\view_12.htm
- %PROGRAM_FILES%\Tango3\doc\view_3.htm
- %PROGRAM_FILES%\Tango3\doc\view_5.htm
- %PROGRAM_FILES%\Tango3\doc\view_4.htm
- %PROGRAM_FILES%\Tango3\doc\tango2.css
- %PROGRAM_FILES%\Tango3\doc\tango.css
- %PROGRAM_FILES%\Tango3\doc\view.htm
- %PROGRAM_FILES%\Tango3\doc\view_11.htm
- %PROGRAM_FILES%\Tango3\doc\view_10.htm
