Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'ЕЈЕЈЧАГж№ЬАнґуК¦' = '"%PROGRAM_FILES%\OX\ox.exe" -autorun'
Вредоносные функции:
Создает и запускает на исполнение:
- '%PROGRAM_FILES%\OX\OX.exe'
- '%PROGRAM_FILES%\OX\OX.exe' -Install <Имя вируса>
Устанавливает процедуры перхвата сообщений
о нажатии клавиш клавиатуры:
- Библиотека-обработчик для всех процессов: %PROGRAM_FILES%\OX\TaskKeyHook.dll
Изменения в файловой системе:
Создает следующие файлы:
- %PROGRAM_FILES%\OX\Skin\head\32.png
- %PROGRAM_FILES%\OX\Skin\head\31.png
- %PROGRAM_FILES%\OX\Skin\head\30.png
- %PROGRAM_FILES%\OX\Skin\head\33.png
- %PROGRAM_FILES%\OX\Skin\head\36.png
- %PROGRAM_FILES%\OX\Skin\head\35.png
- %PROGRAM_FILES%\OX\Skin\head\34.png
- %PROGRAM_FILES%\OX\Skin\head\26.png
- %PROGRAM_FILES%\OX\Skin\head\25.png
- %PROGRAM_FILES%\OX\Skin\head\24.png
- %PROGRAM_FILES%\OX\Skin\head\27.png
- %PROGRAM_FILES%\OX\Skin\head\3.png
- %PROGRAM_FILES%\OX\Skin\head\29.png
- %PROGRAM_FILES%\OX\Skin\head\28.png
- %PROGRAM_FILES%\OX\Skin\head\45.png
- %PROGRAM_FILES%\OX\Skin\head\44.png
- %PROGRAM_FILES%\OX\Skin\head\43.png
- %PROGRAM_FILES%\OX\Skin\head\46.png
- %PROGRAM_FILES%\OX\Skin\head\49.png
- %PROGRAM_FILES%\OX\Skin\head\48.png
- %PROGRAM_FILES%\OX\Skin\head\47.png
- %PROGRAM_FILES%\OX\Skin\head\39.png
- %PROGRAM_FILES%\OX\Skin\head\38.png
- %PROGRAM_FILES%\OX\Skin\head\37.png
- %PROGRAM_FILES%\OX\Skin\head\4.png
- %PROGRAM_FILES%\OX\Skin\head\42.png
- %PROGRAM_FILES%\OX\Skin\head\41.png
- %PROGRAM_FILES%\OX\Skin\head\40.png
- %PROGRAM_FILES%\OX\Skin\head\23.png
- %PROGRAM_FILES%\OX\Skin\classes\6.png
- %PROGRAM_FILES%\OX\Skin\classes\5.png
- %PROGRAM_FILES%\OX\Skin\classes\4.png
- %PROGRAM_FILES%\OX\Skin\classes\7.png
- %PROGRAM_FILES%\OX\Skin\head\1.png
- %PROGRAM_FILES%\OX\Skin\classes\9.png
- %PROGRAM_FILES%\OX\Skin\classes\8.png
- %PROGRAM_FILES%\OX\Skin\classes\24.png
- %PROGRAM_FILES%\OX\Skin\classes\23.png
- %PROGRAM_FILES%\OX\Skin\classes\22.png
- %PROGRAM_FILES%\OX\Skin\classes\25.png
- %PROGRAM_FILES%\OX\Skin\classes\3.png
- %PROGRAM_FILES%\OX\Skin\classes\27.png
- %PROGRAM_FILES%\OX\Skin\classes\26.png
- %PROGRAM_FILES%\OX\Skin\head\19.png
- %PROGRAM_FILES%\OX\Skin\head\18.png
- %PROGRAM_FILES%\OX\Skin\head\17.png
- %PROGRAM_FILES%\OX\Skin\head\2.png
- %PROGRAM_FILES%\OX\Skin\head\22.png
- %PROGRAM_FILES%\OX\Skin\head\21.png
- %PROGRAM_FILES%\OX\Skin\head\20.png
- %PROGRAM_FILES%\OX\Skin\head\12.png
- %PROGRAM_FILES%\OX\Skin\head\11.png
- %PROGRAM_FILES%\OX\Skin\head\10.png
- %PROGRAM_FILES%\OX\Skin\head\13.png
- %PROGRAM_FILES%\OX\Skin\head\16.png
- %PROGRAM_FILES%\OX\Skin\head\15.png
- %PROGRAM_FILES%\OX\Skin\head\14.png
- %PROGRAM_FILES%\OX\Skin\head\5.png
- %PROGRAM_FILES%\OX\Tools\jpgcompact.exe
- %PROGRAM_FILES%\OX\Tools\VirtualDriveManager.exe
- %PROGRAM_FILES%\OX\Skin\skinbackground\9.jpg
- %PROGRAM_FILES%\OX\Tools\toosls.xml
- %PROGRAM_FILES%\OX\todayfocus\miniPortal.exe
- %PROGRAM_FILES%\OX\todayfocus\mPortalm.exe
- %PROGRAM_FILES%\OX\todayfocus\mPortal.exe
- %PROGRAM_FILES%\OX\Skin\skinbackground\4.jpg
- %PROGRAM_FILES%\OX\Skin\skinbackground\3.jpg
- %PROGRAM_FILES%\OX\Skin\skinbackground\2.jpg
- %PROGRAM_FILES%\OX\Skin\skinbackground\5.jpg
- %PROGRAM_FILES%\OX\Skin\skinbackground\8.jpg
- %PROGRAM_FILES%\OX\Skin\skinbackground\7.jpg
- %PROGRAM_FILES%\OX\Skin\skinbackground\6.jpg
- %PROGRAM_FILES%\OX\Config\oxdata.bakup.db
- %PROGRAM_FILES%\OX\unins000.exe
- %PROGRAM_FILES%\OX\ЕЈЕЈЧАГж№ЬАнґуК¦.url
- %PROGRAM_FILES%\OX\Config\runinfo.db-journal
- %PROGRAM_FILES%\OX\Cache\Icon\Pic\0dcfd0092c68b3f4726a7e7586d08146.png
- %PROGRAM_FILES%\OX\Cache\Icon\Pic\15dd047faffb5b7d8c320c012ab11111.png
- %PROGRAM_FILES%\OX\Cache\Icon\Pic\7588a63183892e8a00882c6a8a49dedc.png
- %PROGRAM_FILES%\OX\Config\runinfo.db
- %PROGRAM_FILES%\OX\Config\oxdata.db
- %PROGRAM_FILES%\OX\Config\links.xml
- %HOMEPATH%\Start Menu\Programs\ЕЈЕЈЧАГж№ЬАнґуК¦\ЕЈЕЈЧАГж№ЬАнґуК¦.lnk
- %PROGRAM_FILES%\OX\Config\oxdata.db-journal
- %HOMEPATH%\Desktop\ЕЈЕЈЧАГж№ЬАнґуК¦.lnk
- %HOMEPATH%\Start Menu\Programs\ЕЈЕЈЧАГж№ЬАнґуК¦\Р¶ФШ ЕЈЕЈЧАГж№ЬАнґуК¦.lnk
- %PROGRAM_FILES%\OX\Skin\skinbackground\12.jpg
- %PROGRAM_FILES%\OX\Skin\head\8.png
- %PROGRAM_FILES%\OX\Skin\head\7.png
- %PROGRAM_FILES%\OX\Skin\head\6.png
- %PROGRAM_FILES%\OX\Skin\head\9.png
- %PROGRAM_FILES%\OX\Skin\menu\clearicon_m.png
- %PROGRAM_FILES%\OX\Skin\menu\checkupdate_m.png
- %PROGRAM_FILES%\OX\Skin\menu\about_m.png
- %PROGRAM_FILES%\OX\Skin\head\52.png
- %PROGRAM_FILES%\OX\Skin\head\51.png
- %PROGRAM_FILES%\OX\Skin\head\50.png
- %PROGRAM_FILES%\OX\Skin\head\53.png
- %PROGRAM_FILES%\OX\Skin\head\56.png
- %PROGRAM_FILES%\OX\Skin\head\55.png
- %PROGRAM_FILES%\OX\Skin\head\54.png
- %PROGRAM_FILES%\OX\Skin\menu\switchu_m.png
- %PROGRAM_FILES%\OX\Skin\menu\showox_m.png
- %PROGRAM_FILES%\OX\Skin\menu\showdesktop_m.png
- %PROGRAM_FILES%\OX\Skin\menu\topmost_m.png
- %PROGRAM_FILES%\OX\Skin\skinbackground\11.jpg
- %PROGRAM_FILES%\OX\Skin\skinbackground\10.jpg
- %PROGRAM_FILES%\OX\Skin\skinbackground\1.jpg
- %PROGRAM_FILES%\OX\Skin\menu\import_desk.png
- %PROGRAM_FILES%\OX\Skin\menu\help.png
- %PROGRAM_FILES%\OX\Skin\menu\exit_m.png
- %PROGRAM_FILES%\OX\Skin\menu\import_m.png
- %PROGRAM_FILES%\OX\Skin\menu\settting_m.png
- %PROGRAM_FILES%\OX\Skin\menu\onkeyrestore_m.png
- %PROGRAM_FILES%\OX\Skin\menu\logout_m.png
- %PROGRAM_FILES%\OX\Skin\check_selected.png
- %PROGRAM_FILES%\OX\Skin\check_normal.png
- %PROGRAM_FILES%\OX\Skin\check_hot.png
- %PROGRAM_FILES%\OX\Skin\chessgame.ico
- %PROGRAM_FILES%\OX\Skin\dlgbg.png
- %PROGRAM_FILES%\OX\Skin\city.png
- %PROGRAM_FILES%\OX\Skin\chessgame.png
- %PROGRAM_FILES%\OX\Skin\button_down.png
- %PROGRAM_FILES%\OX\Skin\button_disabled.png
- %PROGRAM_FILES%\OX\Skin\btnImport_hover.png
- %PROGRAM_FILES%\OX\Skin\button_hot.png
- %PROGRAM_FILES%\OX\Skin\check_disabled.png
- %PROGRAM_FILES%\OX\Skin\changeskin.png
- %PROGRAM_FILES%\OX\Skin\button_normal.png
- %PROGRAM_FILES%\OX\Skin\frame_btn_max.png
- %PROGRAM_FILES%\OX\Skin\frame_btn_close_normal.png
- %PROGRAM_FILES%\OX\Skin\frame_btn_close_hot.png
- %PROGRAM_FILES%\OX\Skin\frame_btn_min.png
- %PROGRAM_FILES%\OX\Skin\import_desk.png
- %PROGRAM_FILES%\OX\Skin\imgMessage.png
- %PROGRAM_FILES%\OX\Skin\home.png
- %PROGRAM_FILES%\OX\Skin\exp.png
- %PROGRAM_FILES%\OX\Skin\email.png
- %PROGRAM_FILES%\OX\Skin\duba_main.png
- %PROGRAM_FILES%\OX\Skin\feedback.ico
- %PROGRAM_FILES%\OX\Skin\frame_btn_close_down.png
- %PROGRAM_FILES%\OX\Skin\frame_btn_close_disable.png
- %PROGRAM_FILES%\OX\Skin\feedback.png
- %PROGRAM_FILES%\OX\Skin\btnImport_down.png
- %PROGRAM_FILES%\OX\ChineseSpell.dll
- %PROGRAM_FILES%\OX\ChineseCode.dll
- %PROGRAM_FILES%\OX\upnp.exe
- %PROGRAM_FILES%\OX\HookDll.dll
- %PROGRAM_FILES%\OX\miniupnpc.dll
- %PROGRAM_FILES%\OX\TaskKeyHook.dll
- %PROGRAM_FILES%\OX\OXuiLib.dll
- %PROGRAM_FILES%\OX\OX.exe
- %TEMP%\nsr3.tmp\System.dll
- %TEMP%\nsw2.tmp
- %PROGRAM_FILES%\OX\OXImport.exe
- %PROGRAM_FILES%\OX\oxweb.exe
- %PROGRAM_FILES%\OX\dns.exe
- %PROGRAM_FILES%\OX\OXUpdate.exe
- %PROGRAM_FILES%\OX\Skin\addgroup.png
- %PROGRAM_FILES%\OX\Skin\addbtn.png
- %PROGRAM_FILES%\OX\Skin\about.png
- %PROGRAM_FILES%\OX\Skin\addrecord.png
- %PROGRAM_FILES%\OX\Skin\bg.png
- %PROGRAM_FILES%\OX\Skin\baike.png
- %PROGRAM_FILES%\OX\Skin\addskin.bmp
- %PROGRAM_FILES%\OX\network.dll
- %PROGRAM_FILES%\OX\msvcr100.dll
- %PROGRAM_FILES%\OX\msvcp100.dll
- %PROGRAM_FILES%\OX\p2sp.dll
- %PROGRAM_FILES%\OX\Skin\Combo_over.bmp
- %PROGRAM_FILES%\OX\Skin\Combo_nor.bmp
- %PROGRAM_FILES%\OX\sqlite3.dll
- %PROGRAM_FILES%\OX\Skin\iox.png
- %PROGRAM_FILES%\OX\Skin\webnavbtn.png
- %PROGRAM_FILES%\OX\Skin\virtualdrive.png
- %PROGRAM_FILES%\OX\Skin\viewchoosebtn.png
- %PROGRAM_FILES%\OX\Skin\whitebg.png
- %PROGRAM_FILES%\OX\Skin\classes\0.png
- %PROGRAM_FILES%\OX\Skin\Extra\url.png
- %PROGRAM_FILES%\OX\Skin\Extra\dir.png
- %PROGRAM_FILES%\OX\Skin\view1_hover.png
- %PROGRAM_FILES%\OX\Skin\view1.png
- %PROGRAM_FILES%\OX\Skin\unknow.png
- %PROGRAM_FILES%\OX\Skin\view2.png
- %PROGRAM_FILES%\OX\Skin\view3_hover.png
- %PROGRAM_FILES%\OX\Skin\view3.png
- %PROGRAM_FILES%\OX\Skin\view2_hover.png
- %PROGRAM_FILES%\OX\Skin\classes\18.png
- %PROGRAM_FILES%\OX\Skin\classes\17.png
- %PROGRAM_FILES%\OX\Skin\classes\16.png
- %PROGRAM_FILES%\OX\Skin\classes\19.png
- %PROGRAM_FILES%\OX\Skin\classes\21.png
- %PROGRAM_FILES%\OX\Skin\classes\20.png
- %PROGRAM_FILES%\OX\Skin\classes\2.png
- %PROGRAM_FILES%\OX\Skin\classes\11.png
- %PROGRAM_FILES%\OX\Skin\classes\10.png
- %PROGRAM_FILES%\OX\Skin\classes\1.png
- %PROGRAM_FILES%\OX\Skin\classes\12.png
- %PROGRAM_FILES%\OX\Skin\classes\15.png
- %PROGRAM_FILES%\OX\Skin\classes\14.png
- %PROGRAM_FILES%\OX\Skin\classes\13.png
- %PROGRAM_FILES%\OX\Skin\tools.png
- %PROGRAM_FILES%\OX\Skin\music.ico
- %PROGRAM_FILES%\OX\Skin\menu_hot_bk.png
- %PROGRAM_FILES%\OX\Skin\menu_bk.png
- %PROGRAM_FILES%\OX\Skin\music.png
- %PROGRAM_FILES%\OX\Skin\ox_main.png
- %PROGRAM_FILES%\OX\Skin\noneweather.png
- %PROGRAM_FILES%\OX\Skin\niubi.png
- %PROGRAM_FILES%\OX\Skin\level.png
- %PROGRAM_FILES%\OX\Skin\left_bg.png
- %PROGRAM_FILES%\OX\Skin\left.png
- %PROGRAM_FILES%\OX\Skin\loading.gif
- %PROGRAM_FILES%\OX\Skin\loginbg.png
- %PROGRAM_FILES%\OX\Skin\lock.png
- %PROGRAM_FILES%\OX\Skin\loadwait.png
- %PROGRAM_FILES%\OX\Skin\screenlock.png
- %PROGRAM_FILES%\OX\Skin\rmd_tao.png
- %PROGRAM_FILES%\OX\Skin\rmd_nav.png
- %PROGRAM_FILES%\OX\Skin\search.png
- %PROGRAM_FILES%\OX\Skin\slider.png
- %PROGRAM_FILES%\OX\Skin\shopping.png
- %PROGRAM_FILES%\OX\Skin\setting.png
- %PROGRAM_FILES%\OX\Skin\radio_disabled.png
- %PROGRAM_FILES%\OX\Skin\progress.png
- %PROGRAM_FILES%\OX\Skin\picdeal.png
- %PROGRAM_FILES%\OX\Skin\radio_hot.png
- %PROGRAM_FILES%\OX\Skin\rmd_baidu.png
- %PROGRAM_FILES%\OX\Skin\radio_selected.png
- %PROGRAM_FILES%\OX\Skin\radio_normal.png
Удаляет следующие файлы:
- %PROGRAM_FILES%\OX\Config\runinfo.db-journal
- %TEMP%\nsr3.tmp\System.dll
- %PROGRAM_FILES%\OX\Config\oxdata.db-journal
Сетевая активность:
Подключается к:
- 'ti####.#imefreq.bldrdoc.gov':37
UDP:
- DNS ASK nt##.fau.de
- DNS ASK ti##.ien.it
- DNS ASK ni#####y.ustiming.org
- DNS ASK ni#####a.ustiming.org
- DNS ASK ni#####j.ustiming.org
- DNS ASK www.91##.com
- DNS ASK ti####.#imefreq.bldrdoc.gov
- DNS ASK un###.91ox.com
- DNS ASK ap#.#1ox.net
- DNS ASK ut#####.colorado.edu
- '21#.#44.95.43':5200
- 'un###.91ox.com':6101
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: '(null)' WindowName: '????????????????'
