Trojan.PWS.Siggen1.28095

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'KXGameBox' = '%PROGRAM_FILES%\KXWebGameBox\LoginTool.exe ShowMain'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '广告神盾' = '%PROGRAM_FILES%\广告神盾\AdShield.exe tray'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'wjplay2_News_20140227151608' = '"%PROGRAM_FILES%\wjplay2\20140227151608\WJSpeed.exe" -mini'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'wjplay2_20140227151608' = '"%PROGRAM_FILES%\wjplay2\20140227151608\wjplay.exe" -mini'

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\Winssvr Service] 'Start' = '00000002'

Вредоносные функции:

Для обхода брандмауэра удаляет или модифицирует следующие ключи реестра:

[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\meinvying\meinvying.exe' = '%PROGRAM_FILES%\meinvying\meinvying.exe:*:Enabled:ГАЕ®УЄ'
[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%TEMP%\nsy6.tmp\meinvying.exe' = '%TEMP%\nsy6.tmp\meinvying.exe:*:Enabled:ГАЕ®УЄ'

Создает и запускает на исполнение:

'%TEMP%\nsd4.tmp\ns9.tmp' sc create "Winssvr Service" binPath= "%PROGRAM_FILES%\aqingz3.7\Winsvr.exe" start= auto
'%PROGRAM_FILES%\wjplay2\20140227151608\WJSpeed.exe'
'%PROGRAM_FILES%\KXWebGameBox\LoginTool.exe'
'%PROGRAM_FILES%\KXWebGameBox\WebBoxBubbleTip.exe' 2
'%PROGRAM_FILES%\KXWebGameBox\WebBoxInstStatis.exe' webkxboxIntall123321
'%PROGRAM_FILES%\广告神盾\AdShield.exe' tray
'%PROGRAM_FILES%\广告神盾\server\AdShieldServer.exe' proxy.js -a
'%PROGRAM_FILES%\aqingz3.7\lovmon.exe' /s
'%TEMP%\nsd4.tmp\nsA.tmp' sc description "Winssvr Service" "Winssvr Service"
'%PROGRAM_FILES%\aqingz3.7\Aqingz3.7.exe'
'%PROGRAM_FILES%\Your Product\-8670_2508_mm.exe'
'%PROGRAM_FILES%\Your Product\QQЧЁ°жv1.exe'
'%PROGRAM_FILES%\Your Product\pczh_107_2508.exe'
'%TEMP%\_ir_sf_temp_0\irsetup.exe' __IRAOFF:674338 "__IRAFN:<Полный путь к вирусу>" "__IRCT:1" "__IRTSS:0" "__IRSID:S-1-5-21-2052111302-484763869-725345543-1003"
'%PROGRAM_FILES%\Your Product\setup_open_4705-2508.exe'
'%PROGRAM_FILES%\meinvying\meinvying.exe' /A
'%PROGRAM_FILES%\wjplay2\20140227151608\wjplay.exe' -mini
'%TEMP%\nsy6.tmp\meinvying.exe' /fix
'%PROGRAM_FILES%\Your Product\KXWebBox_3451_RBF.exe'
'%PROGRAM_FILES%\Your Product\setup_194a_p.exe'

Запускает на исполнение:

'<SYSTEM32>\sc.exe' description "Winssvr Service" "Winssvr Service"
'<SYSTEM32>\cmd.exe' /c ""%PROGRAM_FILES%\广告神盾\adclear.bat" "
'<SYSTEM32>\taskkill.exe' /F /im mvhd.exe
'<SYSTEM32>\sc.exe' create "Winssvr Service" binPath= "%PROGRAM_FILES%\aqingz3.7\Winsvr.exe" start= auto

Ищет ветки реестра, отвечающие за хранение паролей сторонними программами:

[<HKCU>\Software\FlashFXP]

Изменения в файловой системе:

Создает следующие файлы:

%HOMEPATH%\Desktop\НтКА.lnk
%PROGRAM_FILES%\广告神盾\res\img\t1_1.png
%HOMEPATH%\Start Menu\Programs\wjplay2\ЕдЦГ№¤ѕЯ\Р¶ФШwjplay2.lnk
%PROGRAM_FILES%\广告神盾\res\img\t1_1_1.png
%PROGRAM_FILES%\广告神盾\res\img\t2_1_1.png
%PROGRAM_FILES%\广告神盾\res\img\t2_1.png
%PROGRAM_FILES%\广告神盾\res\img\t2.png
%HOMEPATH%\Start Menu\Programs\wjplay2\№Щ·ЅЦчТі.lnk
%PROGRAM_FILES%\广告神盾\res\img\kai.png
%HOMEPATH%\Start Menu\Programs\wjplay2\wjplay2.lnk
%PROGRAM_FILES%\广告神盾\res\img\icon2.gif
%PROGRAM_FILES%\广告神盾\res\img\logo.png
%PROGRAM_FILES%\广告神盾\res\img\t1.png
%PROGRAM_FILES%\广告神盾\res\img\t.png
%PROGRAM_FILES%\广告神盾\res\img\logo36.png
%HOMEPATH%\Favorites\Гв·СЙПНшµјєЅ.url
%PROGRAM_FILES%\广告神盾\res\img\ykai.png
%PROGRAM_FILES%\广告神盾\res\img\yguan.png
%ALLUSERSPROFILE%\Start Menu\Programs\їбРЬТіУОґуМь\їбРЬТіУОґуМь.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\їбРЬТіУОґуМь\Р¶ФШ.lnk
%PROGRAM_FILES%\广告神盾\res\img\_0024_ȫ.png
%PROGRAM_FILES%\广告神盾\res\img\_0020_ѿ.png
%PROGRAM_FILES%\广告神盾\res\img\yun.png
%PROGRAM_FILES%\广告神盾\res\img\x.png
%PROGRAM_FILES%\广告神盾\res\img\t3_1.png
%PROGRAM_FILES%\广告神盾\res\img\t3.png
%HOMEPATH%\Favorites\МмТнѕьКВНш.url
%PROGRAM_FILES%\广告神盾\res\img\t3_1_1.png
%PROGRAM_FILES%\广告神盾\res\img\top2.png
%PROGRAM_FILES%\广告神盾\res\img\top1.png
%PROGRAM_FILES%\KXWebGameBox\comfig.ini
%ALLUSERSPROFILE%\Desktop\wjplay2.lnk
%PROGRAM_FILES%\广告神盾\res\img\1.png
%PROGRAM_FILES%\KXWebGameBox\webgameconfig\icon\42.ico
%ALLUSERSPROFILE%\Start Menu\Programs\ГАЕ®УЄ\Р¶ФШГАЕ®УЄ.lnk
%PROGRAM_FILES%\KXWebGameBox\webgameconfig\icon\43.ico
%PROGRAM_FILES%\KXWebGameBox\webgameconfig\icon\45.ico
%ALLUSERSPROFILE%\Desktop\ГАЕ®УЄ.lnk
%PROGRAM_FILES%\KXWebGameBox\webgameconfig\icon\44.ico
%PROGRAM_FILES%\KXWebGameBox\webgameconfig\icon\41.ico
%PROGRAM_FILES%\广告神盾\res\img\0007.gif
%PROGRAM_FILES%\KXWebGameBox\res\WebGameBoxRes.rss
%PROGRAM_FILES%\wjplay2\20140227151608\WJSpeed.exe
%PROGRAM_FILES%\KXWebGameBox\res\WebGameBoxRes.tmp
%PROGRAM_FILES%\KXWebGameBox\webgameconfig\Icon.ico
%PROGRAM_FILES%\KXWebGameBox\res\WebGameBoxUpdateRes.rss
%ALLUSERSPROFILE%\Start Menu\Programs\ГАЕ®УЄ\ГАЕ®УЄ.lnk
%PROGRAM_FILES%\KXWebGameBox\webgameconfig\icon\46.ico
%PROGRAM_FILES%\广告神盾\res\img\con1.png
%PROGRAM_FILES%\KXWebGameBox\webgameconfig\skin\68.rss
%PROGRAM_FILES%\KXWebGameBox\webgameconfig\icon\68.ico
%PROGRAM_FILES%\广告神盾\res\img\con2.png
%PROGRAM_FILES%\广告神盾\res\img\guan.png
%PROGRAM_FILES%\广告神盾\res\img\foot.png
%PROGRAM_FILES%\广告神盾\res\img\con3.png
%PROGRAM_FILES%\KXWebGameBox\webgameconfig\icon\62.ico
%PROGRAM_FILES%\广告神盾\res\img\2.png
%PROGRAM_FILES%\KXWebGameBox\webgameconfig\icon\48.ico
%PROGRAM_FILES%\KXWebGameBox\webgameconfig\icon\47.ico
%PROGRAM_FILES%\KXWebGameBox\webgameconfig\icon\49.ico
%PROGRAM_FILES%\KXWebGameBox\webgameconfig\icon\60.ico
%PROGRAM_FILES%\KXWebGameBox\webgameconfig\icon\59.ico
%PROGRAM_FILES%\KXWebGameBox\webgameconfig\icon\53.ico
%PROGRAM_FILES%\广告神盾\server\rules\1.txt
%PROGRAM_FILES%\广告神盾\server\res\v.js
%HOMEPATH%\AppData\LocalLow\MeiNvYing\Fav9.dat
%PROGRAM_FILES%\广告神盾\server\rules\ad.rul
%PROGRAM_FILES%\广告神盾\server\rules\free.txt
%PROGRAM_FILES%\广告神盾\server\rules\custom.rul
%PROGRAM_FILES%\广告神盾\server\rules\adblock.txt
%PROGRAM_FILES%\广告神盾\server\res\rule.pac
%PROGRAM_FILES%\广告神盾\server\node_modules\colors\themes\winston-dark.js
%PROGRAM_FILES%\广告神盾\server\node_modules\colors\test.js
%PROGRAM_FILES%\广告神盾\server\node_modules\colors\ReadMe.md
%PROGRAM_FILES%\广告神盾\server\node_modules\colors\themes\winston-light.js
%PROGRAM_FILES%\广告神盾\server\res\blank.gif
%TEMP%\nsd4.tmp\nsA.tmp
%PROGRAM_FILES%\广告神盾\server\proxy.js
%PROGRAM_FILES%\广告神盾\server\rules\vid.rul
%TEMP%\nsd4.tmp\Inetc.dll
%TEMP%\nsd4.tmp\md5dll.dll
%APPDATA%\zn2720142\set.ini
%HOMEPATH%\Start Menu\广告神盾\广告神盾.lnk
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\status[1]
%ALLUSERSPROFILE%\Desktop\广告神盾.lnk
%HOMEPATH%\Start Menu\广告神盾\卸载广告神盾.lnk
%APPDATA%\zn2720142\min.ini
%PROGRAM_FILES%\广告神盾\uninstall.ico
%PROGRAM_FILES%\广告神盾\UnInstall.exe
%PROGRAM_FILES%\广告神盾\server\start.bat
%HOMEPATH%\Desktop\їбРЬТіУОґуМь.lnk
%TEMP%\nsd4.tmp\Math.dll
%HOMEPATH%\Desktop\°®Зй.ЦЗ»Ы.3.7.lnk
%PROGRAM_FILES%\广告神盾\Update.exe
%PROGRAM_FILES%\广告神盾\server\node_modules\colors\package.json
%PROGRAM_FILES%\广告神盾\res\js\settings.js
%PROGRAM_FILES%\广告神盾\res\js\progress.js
%PROGRAM_FILES%\广告神盾\res\js\json2.js
%PROGRAM_FILES%\aqingz3.7\Aqingz3.7.exe
%PROGRAM_FILES%\aqingz3.7\lovmon.exe
%PROGRAM_FILES%\aqingz3.7\uninstall.exe
%PROGRAM_FILES%\广告神盾\res\msgbox.html
%PROGRAM_FILES%\广告神盾\res\js\jquery-1.10.2.min.js
%PROGRAM_FILES%\广告神盾\res\img\.jpg
%PROGRAM_FILES%\广告神盾\res\img\_0028_׵.png
%PROGRAM_FILES%\广告神盾\res\img\_0025_.png
%PROGRAM_FILES%\广告神盾\res\index.html
%PROGRAM_FILES%\广告神盾\res\js\index.js
%PROGRAM_FILES%\广告神盾\res\js\common.js
%PROGRAM_FILES%\广告神盾\res\InterceptedTip.html
%PROGRAM_FILES%\广告神盾\res\settings.html
%TEMP%\nsd4.tmp\ns9.tmp
%TEMP%\nsd4.tmp\nsExec.dll
%HOMEPATH%\Start Menu\Programs\°®Зй.ЦЗ»Ы.3.7\°®Зй.ЦЗ»Ы.3.7.lnk
%PROGRAM_FILES%\广告神盾\server\node_modules\colors\colors.js
%PROGRAM_FILES%\广告神盾\server\node_modules\colors\MIT-LICENSE.txt
%PROGRAM_FILES%\广告神盾\server\node_modules\colors\example.js
%PROGRAM_FILES%\广告神盾\server\node_modules\colors\example.html
%HOMEPATH%\Start Menu\Programs\°®Зй.ЦЗ»Ы.3.7\Р¶ФШ.lnk
%PROGRAM_FILES%\广告神盾\res\tip.htm
%PROGRAM_FILES%\广告神盾\res\sound\tip.wav
%PROGRAM_FILES%\aqingz3.7\Winsvr.exe
%PROGRAM_FILES%\广告神盾\res\tip.html
%PROGRAM_FILES%\广告神盾\server\AdShieldServer.exe
%PROGRAM_FILES%\广告神盾\res\window.html
%PROGRAM_FILES%\广告神盾\res\TrunOnRunTip.html
%PROGRAM_FILES%\KXWebGameBox\res\WebGameBoxActiveRes.rss
%TEMP%\nsq8.tmp\FindProcDLL.dll
%PROGRAM_FILES%\广告神盾\AdShield.exe
%PROGRAM_FILES%\广告神盾\adhkdll.dll
%PROGRAM_FILES%\广告神盾\BugReport.dll
%PROGRAM_FILES%\广告神盾\res\css\BackgroundTip.css
%PROGRAM_FILES%\广告神盾\res\BackgroundTip.html
%PROGRAM_FILES%\广告神盾\cfg.ini
%PROGRAM_FILES%\广告神盾\adclear.bat
%APPDATA%\FwNetwork\广告神盾\data.zip
%TEMP%\nsq8.tmp\processwork.dll
%TEMP%\nsq8.tmp\ExeConfig.ini
%TEMP%\nsq8.tmp\KillProcDLL.dll
%APPDATA%\FwNetwork\广告神盾\uninstall.exe
%APPDATA%\FwNetwork\广告神盾\setup.ini
%TEMP%\nsd4.tmp\NSISdl.dll
%PROGRAM_FILES%\KXWebGameBox\webgameconfig\WebBoxVersion.ini
%PROGRAM_FILES%\KXWebGameBox\Image\LoadGameKX.png
%PROGRAM_FILES%\广告神盾\res\css\index.css
%PROGRAM_FILES%\KXWebGameBox\Image\LoadGame.gif
%HOMEPATH%\Templates\272014215162828\YYM_955WD30.gif
%PROGRAM_FILES%\KXWebGameBox\Image\LoginAmim.gif
%PROGRAM_FILES%\meinvying\mvyy.exe
%PROGRAM_FILES%\KXWebGameBox\Image\LoadGamePic.png
%PROGRAM_FILES%\KXWebGameBox\Image\Btf.png
%PROGRAM_FILES%\KXWebGameBox\ConfigXml\ConfigXml.xml
%PROGRAM_FILES%\广告神盾\res\css\common.css
%PROGRAM_FILES%\KXWebGameBox\webgameconfig\LoginToolConfig.ini
%PROGRAM_FILES%\KXWebGameBox\ConfigXml\NetWork.xml
%PROGRAM_FILES%\KXWebGameBox\ConfigXml\XmlVersion.ini
%PROGRAM_FILES%\meinvying\meinvying.exe
%PROGRAM_FILES%\KXWebGameBox\ConfigXml\WebGameBox.xml
%TEMP%\nsq8.tmp\WebBoxVersion.ini
%PROGRAM_FILES%\Your Product\-8670_2508_mm.exe
%PROGRAM_FILES%\Your Product\QQЧЁ°жv1.exe
%PROGRAM_FILES%\Your Product\Uninstall\uninstall.xml
%PROGRAM_FILES%\Your Product\setup_open_4705-2508.exe
%PROGRAM_FILES%\Your Product\pczh_107_2508.exe
%PROGRAM_FILES%\Your Product\KXWebBox_3451_RBF.exe
%PROGRAM_FILES%\Your Product\setup_194a_p.exe
%PROGRAM_FILES%\Your Product\uninstall.exe
%TEMP%\_ir_sf_temp_0\IRIMG1.JPG
%TEMP%\_ir_sf_temp_0\irsetup.dat
%TEMP%\_ir_sf_temp_0\irsetup.exe
%TEMP%\_ir_sf_temp_0\IRIMG2.JPG
%PROGRAM_FILES%\Your Product\Uninstall\uninstall.dat
%PROGRAM_FILES%\Your Product\Uninstall\uni1.tmp
%TEMP%\Your Product Setup Log.txt
%HOMEPATH%\Start Menu\Programs\Your Product\QQЧЁ°ж.lnk
%TEMP%\nsy6.tmp\meinvying.exe
%TEMP%\nsy6.tmp\System.dll
%TEMP%\nsy3.tmp
%TEMP%\nsd4.tmp\Base64.dll
%TEMP%\nsq8.tmp\IpConfig.dll
%TEMP%\nsq8.tmp\System.dll
%TEMP%\nsd4.tmp\System.dll
%HOMEPATH%\Start Menu\Programs\Your Product\Uninstall Your Product.lnk
%HOMEPATH%\Start Menu\Programs\Your Product\№гёжЙс¶Ь°ІЧ°іМРт.lnk
%HOMEPATH%\Start Menu\Programs\Your Product\ОЮј«У°Тф°ІЧ°іМРт.lnk
%HOMEPATH%\Start Menu\Programs\Your Product\-8670_2508_mm.lnk
%HOMEPATH%\Start Menu\Programs\Your Product\їбРЬТіУОґуМь.lnk
%PROGRAM_FILES%\Your Product\Uninstall\IRIMG2.JPG
%PROGRAM_FILES%\Your Product\Uninstall\IRIMG1.JPG
%HOMEPATH%\Start Menu\Programs\Your Product\pczh_107_2508.lnk
%PROGRAM_FILES%\wjplay2\20140227151608\DuiLib.dll
%PROGRAM_FILES%\KXWebGameBox\WebBoxBubbleTip.exe
%PROGRAM_FILES%\wjplay2\20140227151608\Data\wj.ico
%PROGRAM_FILES%\KXWebGameBox\WebBoxInstStatis.exe
%PROGRAM_FILES%\wjplay2\20140227151608\locallist.xml
%PROGRAM_FILES%\KXWebGameBox\TimeToolWnd.exe
%PROGRAM_FILES%\KXWebGameBox\SendBreakLog.exe
%PROGRAM_FILES%\KXWebGameBox\WebGameBox.exe
%PROGRAM_FILES%\KXWebGameBox\StartTool.exe
%PROGRAM_FILES%\wjplay2\20140227151608\Data\loading.gif
%PROGRAM_FILES%\KXWebGameBox\WebBoxUninstall.exe
%PROGRAM_FILES%\wjplay2\20140227151608\Data\poptime_bg.png
%PROGRAM_FILES%\wjplay2\20140227151608\Data\User2.ini
%PROGRAM_FILES%\KXWebGameBox\MicroEndBrowser.exe
%PROGRAM_FILES%\wjplay2\20140227151608\Data\tab_more.png
%PROGRAM_FILES%\KXWebGameBox\UninstTool.exe
%PROGRAM_FILES%\wjplay2\20140227151608\Unins.exe
%PROGRAM_FILES%\广告神盾\res\img\0006.gif
%PROGRAM_FILES%\KXWebGameBox\res\StartTool.rss
%PROGRAM_FILES%\KXWebGameBox\res\UninstRes.rss
%PROGRAM_FILES%\meinvying\ГАЕ®УЄ.lnk
%PROGRAM_FILES%\KXWebGameBox\res\WebBoxBubbleTip.rss
%PROGRAM_FILES%\wjplay2\20140227151608\wjplay.exe
%PROGRAM_FILES%\wjplay2\20140227151608\SysConfig.ini
%PROGRAM_FILES%\wjplay2\20140227151608\playlist.xml
%PROGRAM_FILES%\KXWebGameBox\DeleteFile.exe
%PROGRAM_FILES%\wjplay2\20140227151608\PlayerUpdate.exe
%PROGRAM_FILES%\KXWebGameBox\LoginToolIndex.html
%PROGRAM_FILES%\wjplay2\20140227151608\stat.ini
%PROGRAM_FILES%\wjplay2\20140227151608\server.ini
%PROGRAM_FILES%\KXWebGameBox\res\SendBreakLogRes.rss
%PROGRAM_FILES%\wjplay2\20140227151608\Data\err.jpg
%PROGRAM_FILES%\广告神盾\res\css\TrunOnRunTip.css
%PROGRAM_FILES%\KXWebGameBox\libcurl.dll
%PROGRAM_FILES%\KXWebGameBox\Goal.dll
%PROGRAM_FILES%\KXWebGameBox\TongJICNZZ.dll
%PROGRAM_FILES%\KXWebGameBox\msvcr100.dll
%PROGRAM_FILES%\KXWebGameBox\msvcp100.dll
%PROGRAM_FILES%\KXWebGameBox\LogPrint.dll
%PROGRAM_FILES%\KXWebGameBox\ExeConfig.ini
%PROGRAM_FILES%\KXWebGameBox\Image\Marsh.png
%PROGRAM_FILES%\meinvying\uninst.exe
%PROGRAM_FILES%\KXWebGameBox\Image\LoginToolLoad.png
%PROGRAM_FILES%\KXWebGameBox\Image\SendMailState.gif
%PROGRAM_FILES%\KXWebGameBox\Image\smallgame.ico
%PROGRAM_FILES%\广告神盾\res\css\InterceptedTip.css
%PROGRAM_FILES%\KXWebGameBox\Image\small.ico
%PROGRAM_FILES%\KXWebGameBox\NetWork.dll
%PROGRAM_FILES%\wjplay2\20140227151608\Data\EKanR.dat
%PROGRAM_FILES%\KXWebGameBox\zipdll.dll
%PROGRAM_FILES%\wjplay2\20140227151608\Data\def.jpg
%PROGRAM_FILES%\KXWebGameBox\ConfigData.dll
%PROGRAM_FILES%\KXWebGameBox\LoginTool.exe
%PROGRAM_FILES%\KXWebGameBox\WebGameboxUpdate.exe
%PROGRAM_FILES%\wjplay2\20140227151608\Data\Err.html
%PROGRAM_FILES%\KXWebGameBox\WebGameData.dll
%PROGRAM_FILES%\KXWebGameBox\ProcessFile.dll
%PROGRAM_FILES%\wjplay2\20140227151608\bottom.xml
%PROGRAM_FILES%\广告神盾\res\css\window.css
%PROGRAM_FILES%\wjplay2\20140227151608\client.ini
%PROGRAM_FILES%\KXWebGameBox\Statistics.dll
%PROGRAM_FILES%\wjplay2\20140227151608\Data\Def.html
%PROGRAM_FILES%\KXWebGameBox\Shortcut.dll

Удаляет следующие файлы:

%APPDATA%\FwNetwork\广告神盾\data.zip
%TEMP%\nsd4.tmp\Base64.dll
%APPDATA%\FwNetwork\广告神盾\setup.ini
%TEMP%\nsd4.tmp\ns9.tmp
%TEMP%\nsd4.tmp\nsA.tmp
%TEMP%\nsd4.tmp\Inetc.dll
%TEMP%\nsd4.tmp\NSISdl.dll
%TEMP%\nsd4.tmp\System.dll
%TEMP%\nsd4.tmp\nsExec.dll
%TEMP%\nsd4.tmp\Math.dll
%TEMP%\nsd4.tmp\md5dll.dll
%HOMEPATH%\Templates\272014215162828\YYM_955WD30.gif
%TEMP%\nsy6.tmp\System.dll
%TEMP%\nsq8.tmp\ExeConfig.ini
%TEMP%\nsy6.tmp\meinvying.exe
%TEMP%\_ir_sf_temp_0\irsetup.dat
%PROGRAM_FILES%\Your Product\Uninstall\uni1.tmp
%TEMP%\nsq8.tmp\FindProcDLL.dll
%TEMP%\nsq8.tmp\System.dll
%TEMP%\nsq8.tmp\WebBoxVersion.ini
%TEMP%\nsq8.tmp\processwork.dll
%TEMP%\nsq8.tmp\IpConfig.dll
%TEMP%\nsq8.tmp\KillProcDLL.dll

Сетевая активность:

Подключается к:

'localhost':1056
'localhost':1055
'localhost':1057
'localhost':8585
'localhost':1058
'localhost':1053
'localhost':1040
'<IP-адрес в локальной сети>':445
'up####.aiqingzhihui.com':80
'localhost':1050
'localhost':1047

TCP:

Запросы HTTP GET:

up####.aiqingzhihui.com/0403/help1.html

UDP:

DNS ASK tj.###ingzhihui.com
DNS ASK tj.##dihe.com
DNS ASK www.ji##he.com
DNS ASK up###e.wuji.com
DNS ASK www.bi###sh8.com
DNS ASK tj###.meinvying.net
DNS ASK tv.###ingzhihui.com
DNS ASK www.ad###ndun.com
DNS ASK in#.###ol.sina.com.cn
DNS ASK rp.#v.cc
DNS ASK www.go#####analytics.com
DNS ASK up####.aiqingzhihui.com
DNS ASK xu#.###ogin2.tenpay.com
DNS ASK wj.#uji.com
DNS ASK we#.##invying.net
DNS ASK tj.#uji.com
DNS ASK tj#.##invying.net

Другое:

Ищет следующие окна:

ClassName: 'Progman' WindowName: '(null)'
ClassName: 'SHELLDLL_DefView' WindowName: '(null)'
ClassName: '(null)' WindowName: '(null)'
ClassName: 'WujiPlayer' WindowName: '????????'
ClassName: 'SysListView32' WindowName: '(null)'
ClassName: '' WindowName: '(null)'
ClassName: 'IEFrame' WindowName: '(null)'
ClassName: '(null)' WindowName: 'Microsoft Internet Explorer'
ClassName: 'MS_WINHELP' WindowName: '(null)'
ClassName: 'MS_WebcheckMonitor' WindowName: '(null)'
ClassName: 'TMeiNvYMainForm' WindowName: '(null)'
ClassName: 'THtmFormShow' WindowName: '(null)'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: '#32770' WindowName: '????'
ClassName: 'TFormMini' WindowName: '(null)'
ClassName: 'TFormHuodongMini' WindowName: '(null)'
ClassName: 'MS_AutodialMonitor' WindowName: '(null)'
ClassName: 'TFormTips' WindowName: '(null)'
ClassName: 'TFormLoginTips' WindowName: '(null)'

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней