Trojan.DownLoader11.20569

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\Cpls] 'LavaNet DNA' = '%CommonProgramFiles%\DianJi\LavaNet DNA\lnengn.cpl'
[<HKLM>\SOFTWARE\Classes\ppfilm\shell\open\command] '' = '%PROGRAM_FILES%\pipi\jfCacheMgr.exe %1'
[<HKLM>\SOFTWARE\Classes\oyfile\shell\open\command] '' = 'explorer "%PROGRAM_FILES%\Information%S\Internat Explorer"'
[<HKLM>\SOFTWARE\Classes\KmMediaPlayer\shell\open\command] '' = '"%PROGRAM_FILES%\pipi\PIPIPlayer.exe" "%L"'

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\PIPI_Update.job

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\PIPIStartSvr] 'Start' = '00000002'

Вредоносные функции:

Для обхода брандмауэра удаляет или модифицирует следующие ключи реестра:

[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\pipi\KmLiveUpdate.exe' = '%PROGRAM_FILES%\pipi\KmLiveUpdate.exe:*:Enabled:PIPI LiveUpdate'
[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\pipi\HttpDownLoad.exe' = '%PROGRAM_FILES%\pipi\HttpDownLoad.exe:*:Enabled:HttpDownLoad'
[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\pipi\jfCacheMgr.exe' = '%PROGRAM_FILES%\pipi\jfCacheMgr.exe:*:Enabled:PIPI CacheMgr'
[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\pipi\PIPIPlayer.exe' = '%PROGRAM_FILES%\pipi\PIPIPlayer.exe:*:Enabled:PIPIPlayer'

Создает и запускает на исполнение:

'%PROGRAM_FILES%\pipi\PIPIPlayer.exe'
'%TEMP%\is-LRLIP.tmp\pipi_setup_473.tmp' /SL5="$40092,6213480,71168,%TEMP%\pipi_setup_473.exe" /verysilent
'%PROGRAM_FILES%\pipi\jfCacheMgr.exe'
'%PROGRAM_FILES%\pipi\PIPIStartSvr.exe' -i
'%PROGRAM_FILES%\D43A6CCC\pipi_dae_473.exe'
'%PROGRAM_FILES%\D43A6CCC\LavaGame_Online2.2.exe'
'%TEMP%\pipi_setup_473.exe' /verysilent
'%TEMP%\pipi_dae_473.exe'

Запускает на исполнение:

'<SYSTEM32>\cmd.exe' /c "%PROGRAM_FILES%\D43A6CCC\uninspipi.bat"
'<SYSTEM32>\netsh.exe' firewall add allowedprogram program = "%CommonProgramFiles%\DianJi\LavaNet DNA\DNAService.exe" name = "LavaNet DNA" mode = ENABLE profile = ALL
'<SYSTEM32>\regsvr32.exe' /s "%PROGRAM_FILES%\pipi\codec\CoreAAC.ax"
'<SYSTEM32>\regsvr32.exe' /s "%PROGRAM_FILES%\pipi\codec\MPCVideoDec.ax"
'<SYSTEM32>\regsvr32.exe' /s "%PROGRAM_FILES%\pipi\codec\CoreAVC.ax"
'<SYSTEM32>\regsvr32.exe' /s "%PROGRAM_FILES%\pipi\PIPIWebPlayer.ocx"
'<SYSTEM32>\wscript.exe' "%PROGRAM_FILES%\D43A6CCC\F96835D1.jse"
'<SYSTEM32>\attrib.exe' +s "%PROGRAM_FILES%\Information1\Internat Explorer"
'<SYSTEM32>\cmd.exe' /c <Текущая директория>\pipiuni.bat
'<SYSTEM32>\regsvr32.exe' /s "%PROGRAM_FILES%\pipi\MCCKMPlayerX.dll"
'<SYSTEM32>\regsvr32.exe' /s "%PROGRAM_FILES%\pipi\JfCheck.dll"

Изменения в файловой системе:

Создает следующие файлы:

%PROGRAM_FILES%\pipi\config\is-DENKH.tmp
%PROGRAM_FILES%\pipi\config\is-DF54C.tmp
%PROGRAM_FILES%\pipi\config\is-VA7SQ.tmp
%PROGRAM_FILES%\pipi\config\is-VF88H.tmp
%PROGRAM_FILES%\pipi\config\is-2CMCP.tmp
%PROGRAM_FILES%\pipi\config\is-BTSOT.tmp
%PROGRAM_FILES%\pipi\codec\rm\is-DF0JT.tmp
%PROGRAM_FILES%\pipi\config\is-ERPSA.tmp
%PROGRAM_FILES%\pipi\config\is-EP4G9.tmp
%PROGRAM_FILES%\pipi\Plugins\is-UEKVE.tmp
%PROGRAM_FILES%\pipi\Plugins\is-79F6A.tmp
%PROGRAM_FILES%\pipi\Plugins\is-ES5BU.tmp
%PROGRAM_FILES%\pipi\Plugins\is-45Q5A.tmp
%PROGRAM_FILES%\pipi\config\is-B6TD4.tmp
%PROGRAM_FILES%\pipi\config\is-BLCR9.tmp
%PROGRAM_FILES%\pipi\config\is-S3CJH.tmp
%PROGRAM_FILES%\pipi\config\is-1GIBO.tmp
%PROGRAM_FILES%\pipi\config\is-QJ1HA.tmp
%PROGRAM_FILES%\pipi\codec\rm\is-1VRNU.tmp
%PROGRAM_FILES%\pipi\codec\rm\is-AQFM9.tmp
%PROGRAM_FILES%\pipi\codec\rm\is-5JQ1F.tmp
%PROGRAM_FILES%\pipi\codec\rm\is-5S0L9.tmp
%PROGRAM_FILES%\pipi\codec\rm\is-D8M2I.tmp
%PROGRAM_FILES%\pipi\codec\rm\is-BJL55.tmp
%PROGRAM_FILES%\pipi\codec\is-UTHRI.tmp
%PROGRAM_FILES%\pipi\codec\is-9GA2V.tmp
%PROGRAM_FILES%\pipi\codec\rm\is-3IV8O.tmp
%PROGRAM_FILES%\pipi\codec\rm\is-0KIHN.tmp
%PROGRAM_FILES%\pipi\codec\rm\is-IJIED.tmp
%PROGRAM_FILES%\pipi\codec\rm\is-KK1QL.tmp
%PROGRAM_FILES%\pipi\codec\rm\is-KQCGQ.tmp
%PROGRAM_FILES%\pipi\codec\rm\is-TVMUE.tmp
%PROGRAM_FILES%\pipi\codec\rm\is-CQUSB.tmp
%PROGRAM_FILES%\pipi\codec\rm\is-NQ8NL.tmp
%PROGRAM_FILES%\pipi\codec\rm\is-INIT5.tmp
%PROGRAM_FILES%\pipi\codec\rm\is-SKEM4.tmp
%PROGRAM_FILES%\pipi\codec\rm\is-AV2SH.tmp
%ALLUSERSPROFILE%\Start Menu\Programs\PIPI\PIPI Player.lnk
%CommonProgramFiles%\DianJi\LavaNet DNA\llsetup.ini
%ALLUSERSPROFILE%\Start Menu\Programs\µг»чИнјю\Р¶ФШLavaNet DNA.lnk
%PROGRAM_FILES%\pipi\pipisp.url
%CommonProgramFiles%\DianJi\LavaNet DNA\verinfo.dat
%PROGRAM_FILES%\D43A6CCC\uninspipi.bat
<SYSTEM32>\d3d9caps.tmp
%PROGRAM_FILES%\pipi\config\mcckmplayervod.ini
%CommonProgramFiles%\DianJi\LavaNet DNA\lava.ini
%TEMP%\nsn3.tmp\ExtractDLLEx.dll
%HOMEPATH%\Cookies\%USERNAME%@.ppmovie[1].txt
%HOMEPATH%\Cookies\%USERNAME%@.pipi[1].txt
%HOMEPATH%\Cookies\%USERNAME%@.pipi[2].txt
%HOMEPATH%\Cookies\%USERNAME%@.ppfilm[1].txt
%HOMEPATH%\Cookies\%USERNAME%@.kamun[1].txt
%PROGRAM_FILES%\pipi\topWizardSmallImageFile.bmp
%PROGRAM_FILES%\pipi\FileAssocBak.cfg
%PROGRAM_FILES%\pipi\MachineInfo.cfg
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\mini3[1].html
%PROGRAM_FILES%\pipi\config\player.stat
%ALLUSERSPROFILE%\Start Menu\Programs\PIPI\Uninstall PIPI.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\PIPI\88488 Web Directory.lnk
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\PIPI Player.lnk
%HOMEPATH%\Desktop\PIPI Player.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\PIPI\FAQ on the web.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\PIPI\PIPI WebPlayer.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\PIPI\Media File Association.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\PIPI\PIPI on the web.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\PIPI\Online Shopping.lnk
%PROGRAM_FILES%\pipi\config\skin.ini
<SYSTEM32>\d3d9caps.dat
%PROGRAM_FILES%\pipi\config\config.ini
<SYSTEM32>\pncrt.dll
<SYSTEM32>\config\mcckmplayervod.ini
%PROGRAM_FILES%\pipi\unins000.dat
%PROGRAM_FILES%\pipi\jfCacheMgr.url
%TEMP%\nsn3.tmp\lavagame.dsi
%PROGRAM_FILES%\pipi\config\partner.ini
%PROGRAM_FILES%\pipi\codec\is-8U2RA.tmp
%TEMP%\is-S63SJ.tmp\setupwelcome.jpg
%TEMP%\is-S63SJ.tmp\gtapi_signed.dll
%TEMP%\is-S63SJ.tmp\baidu_logo.jpg
%TEMP%\is-S63SJ.tmp\google_logo.jpg
%TEMP%\is-S63SJ.tmp\PIPIRecommend.dll
%TEMP%\is-S63SJ.tmp\_isetup\_RegDLL.tmp
%TEMP%\is-LRLIP.tmp\pipi_setup_473.tmp
%TEMP%\is-S63SJ.tmp\jpg2bmp.dll
%TEMP%\is-S63SJ.tmp\_isetup\_shfoldr.dll
%TEMP%\is-S63SJ.tmp\setupwelcome.bmp
%TEMP%\is-S63SJ.tmp\topWizardSmallImageFile.jpg
%TEMP%\is-S63SJ.tmp\baidu_logo.bmp
%TEMP%\is-S63SJ.tmp\google_logo.bmp
<Текущая директория>\pipiuni.bat
%TEMP%\is-S63SJ.tmp\wizard_recommand.jpg
<SYSTEM32>\fswf.ico
%PROGRAM_FILES%\D43A6CCC\F96835D1.jse
<SYSTEM32>\tbao.ico
%TEMP%\nsn3.tmp\dnaSetup.dsi
%TEMP%\djhist.log
%TEMP%\nsn3.tmp\System.dll
%TEMP%\nsn3.tmp\left.bmp
%TEMP%\nsn3.tmp\ad.bmp
%TEMP%\djruncon.log
%PROGRAM_FILES%\D43A6CCC\LavaGame_Online2.2.exe
C:\1C5C9765.log
%TEMP%\nsn3.tmp\djcomm.dll
%TEMP%\nss2.tmp
%PROGRAM_FILES%\Information1\Internat Explorer\target.lnk
%PROGRAM_FILES%\Information1\Internat Explorer\desktop.ini
%TEMP%\pipi_setup_473.exe
%TEMP%\pipi_dae_473.exe
%PROGRAM_FILES%\D43A6CCC\pipi_dae_473.exe
%TEMP%\nsn3.tmp\licenseDNA.rtf
%TEMP%\nsn3.tmp\io3.ini
%TEMP%\nsn3.tmp\NSISdl.dll
%TEMP%\nsn3.tmp\license.rtf
%TEMP%\is-S63SJ.tmp\wizard_recommand.bmp
%PROGRAM_FILES%\pipi\is-VO2JR.tmp
%PROGRAM_FILES%\pipi\is-LARSN.tmp
%PROGRAM_FILES%\pipi\is-GPKUT.tmp
%PROGRAM_FILES%\pipi\is-8DD0L.tmp
%PROGRAM_FILES%\pipi\is-18VMI.tmp
%PROGRAM_FILES%\pipi\is-DTHT2.tmp
%PROGRAM_FILES%\pipi\is-39QR7.tmp
%PROGRAM_FILES%\pipi\is-EPTAP.tmp
%PROGRAM_FILES%\pipi\is-A6O2F.tmp
%PROGRAM_FILES%\pipi\is-K5T00.tmp
%PROGRAM_FILES%\pipi\is-V2OAG.tmp
%PROGRAM_FILES%\pipi\is-0N3P7.tmp
%PROGRAM_FILES%\pipi\is-8HM1L.tmp
%PROGRAM_FILES%\pipi\is-PB6G2.tmp
%PROGRAM_FILES%\pipi\is-L6CAJ.tmp
%PROGRAM_FILES%\pipi\is-258DF.tmp
%PROGRAM_FILES%\pipi\is-MHIE1.tmp
%PROGRAM_FILES%\pipi\is-SBL1F.tmp
%PROGRAM_FILES%\pipi\is-3U613.tmp
%PROGRAM_FILES%\pipi\is-DAN5Q.tmp
%PROGRAM_FILES%\pipi\is-LD6JS.tmp
%PROGRAM_FILES%\pipi\is-J5Q90.tmp
%PROGRAM_FILES%\pipi\is-FJMHQ.tmp
%PROGRAM_FILES%\pipi\is-9TMM4.tmp
%PROGRAM_FILES%\pipi\is-VR4H7.tmp
%TEMP%\is-S63SJ.tmp\topWizardSmallImageFile.bmp
%PROGRAM_FILES%\pipi\is-E4LP1.tmp
%PROGRAM_FILES%\pipi\is-M0O9F.tmp
%PROGRAM_FILES%\pipi\is-OB6N5.tmp
%PROGRAM_FILES%\pipi\is-LTOOT.tmp
%PROGRAM_FILES%\pipi\is-J04MN.tmp
%PROGRAM_FILES%\pipi\is-1QK1N.tmp
%PROGRAM_FILES%\pipi\is-A8TKT.tmp
%PROGRAM_FILES%\pipi\is-OO2RC.tmp
%PROGRAM_FILES%\pipi\is-JTN56.tmp
%PROGRAM_FILES%\pipi\is-LVUHU.tmp
%PROGRAM_FILES%\pipi\is-ERDOJ.tmp

Присваивает атрибут 'скрытый' для следующих файлов:

%PROGRAM_FILES%\D43A6CCC\F96835D1.jse

Удаляет следующие файлы:

%TEMP%\is-S63SJ.tmp\setupwelcome.jpg
%TEMP%\is-S63SJ.tmp\topWizardSmallImageFile.bmp
%TEMP%\is-S63SJ.tmp\topWizardSmallImageFile.jpg
%TEMP%\is-S63SJ.tmp\jpg2bmp.dll
%TEMP%\is-S63SJ.tmp\PIPIRecommend.dll
%TEMP%\is-S63SJ.tmp\setupwelcome.bmp
%TEMP%\is-S63SJ.tmp\_isetup\_shfoldr.dll
%TEMP%\is-LRLIP.tmp\pipi_setup_473.tmp
%TEMP%\pipi_setup_473.exe
%TEMP%\is-S63SJ.tmp\wizard_recommand.bmp
%TEMP%\is-S63SJ.tmp\wizard_recommand.jpg
%TEMP%\is-S63SJ.tmp\_isetup\_RegDLL.tmp
%TEMP%\is-S63SJ.tmp\gtapi_signed.dll
%PROGRAM_FILES%\D43A6CCC\pipi_dae_473.exe
%PROGRAM_FILES%\pipi\wizard_recommand.JPG
%PROGRAM_FILES%\pipi\baidu_logo.JPG
%PROGRAM_FILES%\pipi\jfCacheMgr.exe
%PROGRAM_FILES%\pipi\unins000.exe
<SYSTEM32>\d3d9caps.dat
%TEMP%\is-S63SJ.tmp\baidu_logo.jpg
%TEMP%\is-S63SJ.tmp\google_logo.bmp
%TEMP%\is-S63SJ.tmp\google_logo.jpg
%PROGRAM_FILES%\pipi\google_logo.JPG
%PROGRAM_FILES%\pipi\setupwelcome.JPG
%TEMP%\is-S63SJ.tmp\baidu_logo.bmp

Перемещает следующие файлы:

%PROGRAM_FILES%\pipi\codec\rm\is-SKEM4.tmp в %PROGRAM_FILES%\pipi\codec\rm\pncrt.dll
%PROGRAM_FILES%\pipi\codec\rm\is-CQUSB.tmp в %PROGRAM_FILES%\pipi\codec\rm\raac.dll
%PROGRAM_FILES%\pipi\codec\rm\is-NQ8NL.tmp в %PROGRAM_FILES%\pipi\codec\rm\drvc.dll
%PROGRAM_FILES%\pipi\codec\rm\is-AV2SH.tmp в %PROGRAM_FILES%\pipi\codec\rm\hxltcolor.dll
%PROGRAM_FILES%\pipi\codec\rm\is-KK1QL.tmp в %PROGRAM_FILES%\pipi\codec\rm\ralf.dll
%PROGRAM_FILES%\pipi\codec\rm\is-KQCGQ.tmp в %PROGRAM_FILES%\pipi\codec\rm\rv30.dll
%PROGRAM_FILES%\pipi\codec\rm\is-1VRNU.tmp в %PROGRAM_FILES%\pipi\codec\rm\rv40.dll
%PROGRAM_FILES%\pipi\codec\rm\is-IJIED.tmp в %PROGRAM_FILES%\pipi\codec\rm\rv10.dll
%PROGRAM_FILES%\pipi\codec\rm\is-TVMUE.tmp в %PROGRAM_FILES%\pipi\codec\rm\rv20.dll
%PROGRAM_FILES%\pipi\codec\rm\is-3IV8O.tmp в %PROGRAM_FILES%\pipi\codec\rm\28_83260.dll
%PROGRAM_FILES%\pipi\codec\rm\is-BJL55.tmp в %PROGRAM_FILES%\pipi\codec\rm\atrc.dll
%PROGRAM_FILES%\pipi\codec\is-UTHRI.tmp в %PROGRAM_FILES%\pipi\codec\MPCVideoDec.ax
%PROGRAM_FILES%\pipi\codec\rm\is-0KIHN.tmp в %PROGRAM_FILES%\pipi\codec\rm\14_43260.dll
%PROGRAM_FILES%\pipi\codec\rm\is-5JQ1F.tmp в %PROGRAM_FILES%\pipi\codec\rm\cook.dll
%PROGRAM_FILES%\pipi\codec\rm\is-5S0L9.tmp в %PROGRAM_FILES%\pipi\codec\rm\drv1.dll
%PROGRAM_FILES%\pipi\codec\rm\is-INIT5.tmp в %PROGRAM_FILES%\pipi\codec\rm\drv2.dll
%PROGRAM_FILES%\pipi\codec\rm\is-AQFM9.tmp в %PROGRAM_FILES%\pipi\codec\rm\ddnt3260.dll
%PROGRAM_FILES%\pipi\codec\rm\is-D8M2I.tmp в %PROGRAM_FILES%\pipi\codec\rm\dnet3260.dll
%PROGRAM_FILES%\pipi\codec\rm\is-DF0JT.tmp в %PROGRAM_FILES%\pipi\codec\rm\sipr.dll
%PROGRAM_FILES%\pipi\config\is-1GIBO.tmp в %PROGRAM_FILES%\pipi\config\tab2_norm.bmp
%PROGRAM_FILES%\pipi\config\is-B6TD4.tmp в %PROGRAM_FILES%\pipi\config\tab2_over.bmp
%PROGRAM_FILES%\pipi\config\is-BLCR9.tmp в %PROGRAM_FILES%\pipi\config\partner.ini
%PROGRAM_FILES%\pipi\config\is-QJ1HA.tmp в %PROGRAM_FILES%\pipi\config\tab2_down.bmp
%PROGRAM_FILES%\pipi\Plugins\is-79F6A.tmp в %PROGRAM_FILES%\pipi\Plugins\KmHashFile.dll
%PROGRAM_FILES%\pipi\Plugins\is-ES5BU.tmp в %PROGRAM_FILES%\pipi\Plugins\KmUdx.dll
<SYSTEM32>\d3d9caps.tmp в <SYSTEM32>\d3d9caps.dat
%PROGRAM_FILES%\pipi\Plugins\is-UEKVE.tmp в %PROGRAM_FILES%\pipi\Plugins\KmLiveStream.dll
%PROGRAM_FILES%\pipi\Plugins\is-45Q5A.tmp в %PROGRAM_FILES%\pipi\Plugins\KmTransmit.dll
%PROGRAM_FILES%\pipi\config\is-ERPSA.tmp в %PROGRAM_FILES%\pipi\config\acl.crtc.conf
%PROGRAM_FILES%\pipi\config\is-2CMCP.tmp в %PROGRAM_FILES%\pipi\config\acl.edu.conf
%PROGRAM_FILES%\pipi\config\is-BTSOT.tmp в %PROGRAM_FILES%\pipi\config\acl.cmcc.conf
%PROGRAM_FILES%\pipi\config\is-EP4G9.tmp в %PROGRAM_FILES%\pipi\config\acl.cnc.conf
%PROGRAM_FILES%\pipi\config\is-DF54C.tmp в %PROGRAM_FILES%\pipi\config\acl.greatwall.conf
%PROGRAM_FILES%\pipi\config\is-VA7SQ.tmp в %PROGRAM_FILES%\pipi\config\config.ini
%PROGRAM_FILES%\pipi\config\is-S3CJH.tmp в %PROGRAM_FILES%\pipi\config\enumwindow.ini
%PROGRAM_FILES%\pipi\config\is-DENKH.tmp в %PROGRAM_FILES%\pipi\config\acl.telecom.conf
%PROGRAM_FILES%\pipi\config\is-VF88H.tmp в %PROGRAM_FILES%\pipi\config\clienttype.ini
%PROGRAM_FILES%\pipi\codec\is-9GA2V.tmp в %PROGRAM_FILES%\pipi\codec\CoreAVC.ax
%PROGRAM_FILES%\pipi\is-LVUHU.tmp в %PROGRAM_FILES%\pipi\jpg2bmp.dll
%PROGRAM_FILES%\pipi\is-A8TKT.tmp в %PROGRAM_FILES%\pipi\KmBugslayerUtil.dll
%PROGRAM_FILES%\pipi\is-OO2RC.tmp в %PROGRAM_FILES%\pipi\JfCheck.dll
%PROGRAM_FILES%\pipi\is-ERDOJ.tmp в %PROGRAM_FILES%\pipi\jfres_plug.dll
%PROGRAM_FILES%\pipi\is-LTOOT.tmp в %PROGRAM_FILES%\pipi\KmFileTypeSetting.exe
%PROGRAM_FILES%\pipi\is-J04MN.tmp в %PROGRAM_FILES%\pipi\libdb43.dll
%PROGRAM_FILES%\pipi\is-3U613.tmp в %PROGRAM_FILES%\pipi\MCCKMPlayerX.dll
%PROGRAM_FILES%\pipi\is-OB6N5.tmp в %PROGRAM_FILES%\pipi\KmLiveEngine.dll
%PROGRAM_FILES%\pipi\is-1QK1N.tmp в %PROGRAM_FILES%\pipi\KmLiveUpdate.exe
%PROGRAM_FILES%\pipi\is-E4LP1.tmp в %PROGRAM_FILES%\pipi\baidu_logo.JPG
%PROGRAM_FILES%\pipi\is-9TMM4.tmp в %PROGRAM_FILES%\pipi\dbghelp.dll
%PROGRAM_FILES%\pipi\is-VR4H7.tmp в %PROGRAM_FILES%\pipi\unins000.exe
%PROGRAM_FILES%\pipi\is-M0O9F.tmp в %PROGRAM_FILES%\pipi\jfCacheMgr.exe
%PROGRAM_FILES%\pipi\is-LD6JS.tmp в %PROGRAM_FILES%\pipi\google_logo.JPG
%PROGRAM_FILES%\pipi\is-J5Q90.tmp в %PROGRAM_FILES%\pipi\jfCacheMgr.exe
%PROGRAM_FILES%\pipi\is-JTN56.tmp в %PROGRAM_FILES%\pipi\jfcheck.conf
%PROGRAM_FILES%\pipi\is-DAN5Q.tmp в %PROGRAM_FILES%\pipi\gtapi_signed.dll
%PROGRAM_FILES%\pipi\is-FJMHQ.tmp в %PROGRAM_FILES%\pipi\HttpDownLoad.exe
%PROGRAM_FILES%\pipi\is-39QR7.tmp в %PROGRAM_FILES%\pipi\MFC71.dll
%PROGRAM_FILES%\pipi\is-MHIE1.tmp в %PROGRAM_FILES%\pipi\setupwelcome.JPG
%PROGRAM_FILES%\pipi\is-PB6G2.tmp в %PROGRAM_FILES%\pipi\sqlite3.dll
%PROGRAM_FILES%\pipi\is-L6CAJ.tmp в %PROGRAM_FILES%\pipi\pphelp.url
%PROGRAM_FILES%\pipi\is-SBL1F.tmp в %PROGRAM_FILES%\pipi\ppwebnav.url
%PROGRAM_FILES%\pipi\is-V2OAG.tmp в %PROGRAM_FILES%\pipi\topWizardSmallImageFile.jpg
%PROGRAM_FILES%\pipi\is-0N3P7.tmp в %PROGRAM_FILES%\pipi\wizard_recommand.JPG
%PROGRAM_FILES%\pipi\codec\is-8U2RA.tmp в %PROGRAM_FILES%\pipi\codec\CoreAAC.ax
%PROGRAM_FILES%\pipi\is-K5T00.tmp в %PROGRAM_FILES%\pipi\uninstall.ico
%PROGRAM_FILES%\pipi\is-8HM1L.tmp в %PROGRAM_FILES%\pipi\webplayer.url
%PROGRAM_FILES%\pipi\is-EPTAP.tmp в %PROGRAM_FILES%\pipi\PIPIPlayer.exe
%PROGRAM_FILES%\pipi\is-18VMI.tmp в %PROGRAM_FILES%\pipi\PIPIRecommend.dll
%PROGRAM_FILES%\pipi\is-DTHT2.tmp в %PROGRAM_FILES%\pipi\msvcp71.dll
%PROGRAM_FILES%\pipi\is-A6O2F.tmp в %PROGRAM_FILES%\pipi\msvcr71.dll
%PROGRAM_FILES%\pipi\is-LARSN.tmp в %PROGRAM_FILES%\pipi\pipisp.ico
%PROGRAM_FILES%\pipi\is-GPKUT.tmp в %PROGRAM_FILES%\pipi\PIPIWebPlayer.ocx
%PROGRAM_FILES%\pipi\is-258DF.tmp в %PROGRAM_FILES%\pipi\player.swf
%PROGRAM_FILES%\pipi\is-VO2JR.tmp в %PROGRAM_FILES%\pipi\pipisp.url
%PROGRAM_FILES%\pipi\is-8DD0L.tmp в %PROGRAM_FILES%\pipi\PIPIStartSvr.exe

Самоудаляется.

Сетевая активность:

Подключается к:

'mi##.pipi.cn':80
'localhost':1040
'do#####d.lava-lava.com':80

TCP:

Запросы HTTP GET:

mi##.pipi.cn/mini3.html
do#####d.lava-lava.com/lgb2078.dsi
do#####d.lava-lava.com/dnas678.dsi

UDP:

DNS ASK mi##.pipi.cn
DNS ASK www.pi#i.cn
DNS ASK www.pi###ite.com
DNS ASK do#####d.lava-lava.com
DNS ASK re####end.pipi.cn
're####end.pipi.cn':1868

Другое:

Ищет следующие окна:

ClassName: 'MsnMsgrUIManager' WindowName: '(null)'
ClassName: 'MPWClass' WindowName: '(null)'
ClassName: 'MS_WebcheckMonitor' WindowName: '(null)'
ClassName: 'MS_AutodialMonitor' WindowName: '(null)'
ClassName: 'SysListView32' WindowName: '(null)'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'ppfilm_class' WindowName: '(null)'
ClassName: '(null)' WindowName: 'ppfilm_class_cachemgr_title'
ClassName: 'progman' WindowName: 'Program Manager'

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней