Trojan.Click3.5676

Техническая информация

Вредоносные функции:

Создает и запускает на исполнение:

'%TEMP%\GLJ3.tmp' %PROGRAM_FILES%\Freeze.com Toolbar\freeze_int.dll
'%TEMP%\GLB1.tmp' 4736 <Полный путь к вирусу>

Запускает на исполнение:

'%PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE' http://cl###.freeze.com/?cl####################################################################################################

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\{B7D3E479-CC68-42B5-A338-938ECE35F419}\freeze_int.inf
%TEMP%\{B7D3E479-CC68-42B5-A338-938ECE35F419}\freeze_int.crc
%TEMP%\{B7D3E479-CC68-42B5-A338-938ECE35F419}\icons.bmp
%TEMP%\{B7D3E479-CC68-42B5-A338-938ECE35F419}\frzToolbar_logo.bmp
%PROGRAM_FILES%\Freeze.com Toolbar\~GLH000f.TMP
%PROGRAM_FILES%\Freeze.com Toolbar\~GLH000e.TMP
%TEMP%\{B7D3E479-CC68-42B5-A338-938ECE35F419}\freeze.bmp
%TEMP%\{B7D3E479-CC68-42B5-A338-938ECE35F419}\basis.xml
%TEMP%\{B7D3E479-CC68-42B5-A338-938ECE35F419}\version.txt
%TEMP%\{B7D3E479-CC68-42B5-A338-938ECE35F419}\update.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\click.freeze[1].0
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\alive[1].aspx
%TEMP%\{B7D3E479-CC68-42B5-A338-938ECE35F419}\options.html
%TEMP%\{B7D3E479-CC68-42B5-A338-938ECE35F419}\info.txt
%TEMP%\{B7D3E479-CC68-42B5-A338-938ECE35F419}\uninstall.exe
%TEMP%\{B7D3E479-CC68-42B5-A338-938ECE35F419}\powered_yahoo_search.bmp
%PROGRAM_FILES%\Freeze.com Toolbar\~GLH000d.TMP
%PROGRAM_FILES%\Freeze.com Toolbar\~GLH0002.TMP
%PROGRAM_FILES%\Freeze.com Toolbar\~GLH0001.TMP
%PROGRAM_FILES%\Freeze.com Toolbar\~GLH0004.TMP
%PROGRAM_FILES%\Freeze.com Toolbar\~GLH0003.TMP
%TEMP%\GLC2.tmp
%TEMP%\GLB1.tmp
%PROGRAM_FILES%\Freeze.com Toolbar\~GLH0000.TMP
%TEMP%\GLJ3.tmp
%PROGRAM_FILES%\Freeze.com Toolbar\~GLH000a.TMP
%PROGRAM_FILES%\Freeze.com Toolbar\~GLH0009.TMP
%PROGRAM_FILES%\Freeze.com Toolbar\~GLH000c.TMP
%PROGRAM_FILES%\Freeze.com Toolbar\~GLH000b.TMP
%PROGRAM_FILES%\Freeze.com Toolbar\~GLH0006.TMP
%PROGRAM_FILES%\Freeze.com Toolbar\~GLH0005.TMP
%PROGRAM_FILES%\Freeze.com Toolbar\~GLH0008.TMP
%PROGRAM_FILES%\Freeze.com Toolbar\~GLH0007.TMP

Удаляет следующие файлы:

%TEMP%\{B7D3E479-CC68-42B5-A338-938ECE35F419}\options.html
%TEMP%\{B7D3E479-CC68-42B5-A338-938ECE35F419}\info.txt
%TEMP%\{B7D3E479-CC68-42B5-A338-938ECE35F419}\icons.bmp
%TEMP%\{B7D3E479-CC68-42B5-A338-938ECE35F419}\powered_yahoo_search.bmp
%TEMP%\{B7D3E479-CC68-42B5-A338-938ECE35F419}\version.txt
%TEMP%\{B7D3E479-CC68-42B5-A338-938ECE35F419}\update.exe
%TEMP%\{B7D3E479-CC68-42B5-A338-938ECE35F419}\uninstall.exe
%TEMP%\{B7D3E479-CC68-42B5-A338-938ECE35F419}\frzToolbar_logo.bmp
%TEMP%\GLB1.tmp
%TEMP%\GLC2.tmp
%TEMP%\GLJ3.tmp
%TEMP%\{B7D3E479-CC68-42B5-A338-938ECE35F419}\basis.xml
%TEMP%\{B7D3E479-CC68-42B5-A338-938ECE35F419}\freeze_int.inf
%TEMP%\{B7D3E479-CC68-42B5-A338-938ECE35F419}\freeze_int.crc
%TEMP%\{B7D3E479-CC68-42B5-A338-938ECE35F419}\freeze.bmp

Перемещает следующие файлы:

%PROGRAM_FILES%\Freeze.com Toolbar\~GLH000a.TMP в %PROGRAM_FILES%\Freeze.com Toolbar\powered_yahoo_search.bmp
%PROGRAM_FILES%\Freeze.com Toolbar\~GLH000b.TMP в %PROGRAM_FILES%\Freeze.com Toolbar\tbhelper.dll
%PROGRAM_FILES%\Freeze.com Toolbar\~GLH0008.TMP в %PROGRAM_FILES%\Freeze.com Toolbar\info.txt
%PROGRAM_FILES%\Freeze.com Toolbar\~GLH0009.TMP в %PROGRAM_FILES%\Freeze.com Toolbar\options.html
%PROGRAM_FILES%\Freeze.com Toolbar\~GLH000e.TMP в %PROGRAM_FILES%\Freeze.com Toolbar\version.txt
%PROGRAM_FILES%\Freeze.com Toolbar\~GLH000f.TMP в %PROGRAM_FILES%\Freeze.com Toolbar\whiteList_plugin.dll
%PROGRAM_FILES%\Freeze.com Toolbar\~GLH000c.TMP в %PROGRAM_FILES%\Freeze.com Toolbar\uninstall.exe
%PROGRAM_FILES%\Freeze.com Toolbar\~GLH000d.TMP в %PROGRAM_FILES%\Freeze.com Toolbar\update.exe
%PROGRAM_FILES%\Freeze.com Toolbar\~GLH0002.TMP в %PROGRAM_FILES%\Freeze.com Toolbar\freeze.bmp
%PROGRAM_FILES%\Freeze.com Toolbar\~GLH0003.TMP в %PROGRAM_FILES%\Freeze.com Toolbar\freeze_int.crc
%PROGRAM_FILES%\Freeze.com Toolbar\~GLH0000.TMP в %PROGRAM_FILES%\Freeze.com Toolbar\autosearch_plugin.dll
%PROGRAM_FILES%\Freeze.com Toolbar\~GLH0001.TMP в %PROGRAM_FILES%\Freeze.com Toolbar\basis.xml
%PROGRAM_FILES%\Freeze.com Toolbar\~GLH0006.TMP в %PROGRAM_FILES%\Freeze.com Toolbar\frzToolbar_logo.bmp
%PROGRAM_FILES%\Freeze.com Toolbar\~GLH0007.TMP в %PROGRAM_FILES%\Freeze.com Toolbar\icons.bmp
%PROGRAM_FILES%\Freeze.com Toolbar\~GLH0004.TMP в %PROGRAM_FILES%\Freeze.com Toolbar\freeze_int.dll
%PROGRAM_FILES%\Freeze.com Toolbar\~GLH0005.TMP в %PROGRAM_FILES%\Freeze.com Toolbar\freeze_int.inf

Сетевая активность:

Подключается к:

'cl###.freeze.com':80
'www.fr##ze.com':80
'localhost':1035

TCP:

Запросы HTTP GET:

cl###.freeze.com/?cl##################################
cl###.freeze.com/?cl####################################################################################################
www.fr##ze.com/toolbar/alive.aspx?id##################################################################

UDP: