Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Funshion' = '%PROGRAM_FILES%\Funshion Online\Funshion\Funshion.exe /tray'
- [<HKLM>\SOFTWARE\Classes\Funshion Task\shell\open\Command] '' = '"%PROGRAM_FILES%\Funshion Online\Funshion\Funshion.exe" "%1" /dummy'
- [<HKLM>\SOFTWARE\Classes\fsp\shell\open\command] '' = '"%PROGRAM_FILES%\Funshion Online\Funshion\Funshion.exe" "%1"'
Изменяет следующие исполняемые системные файлы:
- <DRIVERS>\tcpip.sys
Вредоносные функции:
Для обхода брандмауэра удаляет или модифицирует следующие ключи реестра:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\Funshion Online\Funshion\FunshionUpgrade.exe' = '%PROGRAM_FILES%\Funshion Online\Funshion\FunshionUpgrade.exe:*:Enabled:FunshionUpgrade'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\Funshion Online\Funshion\FunshionService.exe' = '%PROGRAM_FILES%\Funshion Online\Funshion\FunshionService.exe:*:Enabled:FunshionService'
Создает и запускает на исполнение:
- '%PROGRAM_FILES%\Funshion Online\Funshion\XPSP2Patch\evid4226-vc80-mt.exe'
- '%PROGRAM_FILES%\Funshion Online\Funshion\Funshion.exe'
- '%PROGRAM_FILES%\Funshion Online\Funshion\XPSP2Patch\funshion_clone.exe' 1 2 3
- '%TEMP%\FunshionInstall_C64045.exe' /S
- '%TEMP%\xml2fspdata.exe' "%PROGRAM_FILES%\Funshion Online\Funshion\control\\"
- '%PROGRAM_FILES%\Funshion Online\Funshion\XPSP2Patch\FunshionInstall.exe'
Запускает на исполнение:
- '<SYSTEM32>\taskkill.exe' /f /im "FunshionUpgrade.exe"
- '<SYSTEM32>\taskkill.exe' /f /im "FunshionUpdate.exe"
- '<SYSTEM32>\regsvr32.exe' /s "<SYSTEM32>\CoreAAC.ax"
- '<SYSTEM32>\cmd.exe' /c "%PROGRAM_FILES%\Funshion Online\Funshion\XPSP2Patch\selfdel.bat"
- '<SYSTEM32>\regsvr32.exe' /s "<SYSTEM32>\quartz.dll"
- '<SYSTEM32>\taskkill.exe' /f /im "Funshion.exe"
- '%WINDIR%\explorer.exe' "http://re#.#qkuyou.cn/"
- '<SYSTEM32>\taskkill.exe' /f /im "FSPServer.exe"
- '<SYSTEM32>\taskkill.exe' /f /im "Updater.exe"
- '<SYSTEM32>\taskkill.exe' /f /im "FunshionService.exe"
Изменения в файловой системе:
Создает следующие файлы:
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\TaskManagerCloseBtn.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\TaskManagerCloseTxtBtn.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\TaskListStatIcons.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\TaskListStatSelIcon.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\TaskMgnBarLScrollBtn.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\TaskMgnBarList.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\TaskMgnBarBk.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\TaskMgnBarItem.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\StatusBarSplid.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\TaskBarBtnIcon.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\StatusBarLeft.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\StatusBarRight.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\TaskBarBtnShowPlayer.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\TaskBarTipDownArrow.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\TaskBarBtnMenu.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\TaskBarBtnOpenLcl.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\TaskToolBarPlay.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\TaskToolBarRestore.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\TaskToolBarDownload.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\TaskToolBarDownloadEn.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\TaskToolBarStopEn.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\TextBtnBk.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\TaskToolBarRestoreEn.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\TaskToolBarStop.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\TaskMgnTitleLeft.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\TaskMgnTitleRight.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\TaskMgnBarRScrollBtn.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\TaskMgnTitleBkgnd.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\TaskToolBarDelete.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\TaskToolBarDeleteEn.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\TaskTabBkgnd.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\TaskToolBarBkgnd.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\StatusBarBkgnd.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\RadioBtnBox.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\RadioBtnPt.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayerHideBtn.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayerTipCloseBtn.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\ScrollBarDownArrow.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\ScrollBarDownArrowRound.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\RpcLoading.gif
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\RpcStartDlgBk.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayerBarBtnSimple.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayerBarBtnStop.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayerBarBtnPreSmall.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayerBarBtnSetting.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayerBarBtnVolumeSmall.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayerBarSplid.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayerBarBtnTop.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayerBarBtnVolume.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\ScrollBarVerWidgetTrailHover.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\ScrollLinkBkgnd.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\ScrollBarVerWidgetMidHover.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\ScrollBarVerWidgetTrail.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\SplidBarBkgnd.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\SplidBarMark.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\ScrollLinkFrm.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\SettingDlgIcon.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\ScrollBarVerBkgnd.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\ScrollBarVerWidgetBkgnd.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\ScrollBarUpArrow.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\ScrollBarUpArrowRound.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\ScrollBarVerWidgetHeadHover.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\ScrollBarVerWidgetMid.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\ScrollBarVerWidgetBkgndHover.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\ScrollBarVerWidgetHead.bmp
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Funshion.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\Funshion\Funshion.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\Funshion\Update History.lnk
- %ALLUSERSPROFILE%\Desktop\Funshion.lnk
- %PROGRAM_FILES%\Funshion Online\Funshion\Media\Install Latest Funshion.lnk
- %PROGRAM_FILES%\Funshion Online\Funshion\Uninstall.exe
- %ALLUSERSPROFILE%\Start Menu\Funshion.lnk
- %PROGRAM_FILES%\Funshion Online\Funshion\Media\Start Funshion.lnk
- %ALLUSERSPROFILE%\Desktop\Pop Game.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\Funshion\Pop Game.lnk
- %PROGRAM_FILES%\Funshion Online\Funshion\Funshion-install.ico
- %PROGRAM_FILES%\Funshion Online\Funshion\FunshionGame2.ico
- %ALLUSERSPROFILE%\Start Menu\Programs\Funshion\Shopping Sites.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\Funshion\Funshion Use Help.lnk
- %PROGRAM_FILES%\Funshion Online\Funshion\Funshop2.ico
- %ALLUSERSPROFILE%\Desktop\Shopping Sites.lnk
- %TEMP%\nicdescr.dat
- %PROGRAM_FILES%\Funshion Online\Funshion\XPSP2Patch\install.ini
- %HOMEPATH%\funshion\install.ini
- %TEMP%\getmacaddress.dll
- %PROGRAM_FILES%\Funshion Online\Funshion\XPSP2Patch\funshion_clone.exe
- %PROGRAM_FILES%\Funshion Online\Funshion\XPSP2Patch\selfdel.bat
- %HOMEPATH%\Cookies\%USERNAME%@funshion[2].txt
- %PROGRAM_FILES%\Funshion Online\Funshion\GUID6A887907214449C3B4050D9243EE9093.txt
- %TEMP%\xml2fspdata.exe
- %TEMP%\nsk3.tmp\ExecDos.dll
- %ALLUSERSPROFILE%\Start Menu\Programs\Funshion\Uninstall Funshion.lnk
- %HOMEPATH%\Cookies\%USERNAME%@funshion[1].txt
- %TEMP%\nsk3.tmp\NSISdl.dll
- %TEMP%\post.dat
- %PROGRAM_FILES%\Funshion Online\Funshion\128
- %TEMP%\nsk3.tmp\md5dll.dll
- %HOMEPATH%\funshion\cache\Cacheflash\blankFs.swf
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\UpdateIconFail.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\UpdateIconInit.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\UpdateCapCloseBtn.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\UpdateCaption.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\WebCloseBtnRgn.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\taskdown.ico
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\UpdateIconSuc.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\WebCloseBtn.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\TipTopArrow.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\UpdateBtmBkgnd.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\TipBottomArrow.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\TipRightArrow.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\UpdateBtmUpdateBtn.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\UpdateCapBkgnd.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\UpdateBtmCloseBtn.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\UpdateBtmIgoreBtn.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\cook.dll
- %PROGRAM_FILES%\Funshion Online\Funshion\drvc.dll
- %PROGRAM_FILES%\Funshion Online\Funshion\pndx5032.dll
- %PROGRAM_FILES%\Funshion Online\Funshion\rmoc3260.dll
- %TEMP%\funshion.ini
- %HOMEPATH%\funshion\cache\Cacheflash\donghuanew_18.swf
- <SYSTEM32>\CoreAAC.ax
- %PROGRAM_FILES%\Funshion Online\Funshion\coreavc.ax
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\taskstop.ico
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\taskupload.ico
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\taskpause.ico
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\taskplaying.ico
- %PROGRAM_FILES%\Funshion Online\Funshion\pncrt.dll
- %PROGRAM_FILES%\Funshion Online\Funshion\pndx5016.dll
- <SYSTEM32>\funshion.ini
- %HOMEPATH%\funshion.ini
- %PROGRAM_FILES%\Funshion Online\Funshion\XPSP2Patch\bmps\6.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\XPSP2Patch\bmps\Dialog.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\XPSP2Patch\bmps\4.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\XPSP2Patch\bmps\5.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\XPSP2Patch\bmps\en_fin.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\XPSP2Patch\bmps\en_rcmd.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\XPSP2Patch\bmps\ch_fin.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\XPSP2Patch\bmps\ch_rcmd.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\detector.dll
- %PROGRAM_FILES%\Funshion Online\Funshion\FunshionUpgrade.exe
- %PROGRAM_FILES%\Funshion Online\Funshion\fpsrv.dll
- %PROGRAM_FILES%\Funshion Online\Funshion\fptassrv.dll
- %PROGRAM_FILES%\Funshion Online\Funshion\XPSP2Patch\InstallLangAm.dll
- %PROGRAM_FILES%\Funshion Online\Funshion\XPSP2Patch\bmps\3.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\XPSP2Patch\evid4226-vc80-mt.exe
- %PROGRAM_FILES%\Funshion Online\Funshion\XPSP2Patch\FunshionInstall.exe
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\CheckBox_Box.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\CheckBox_Check.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\CaptionText.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\CaptionTextEn.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\IeToolBarBack.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\IeToolBarBackEn.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\DiskWarnning.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\DragCorner.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\CaptionCloseBtn.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\CaptionMaxBtn.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\Buffering.gif
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\CaptionBkgnd.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\CaptionMinBtn.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\CaptionNormalBtn.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\CaptionMenuBtn.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\CaptionMenuBtnEn.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\nicdescr.dat
- %TEMP%\instpath.ini
- %TEMP%\blank.bmp
- %TEMP%\nsk3.tmp\InstPath.ini
- %TEMP%\welcomepage.ini
- %TEMP%\licensecn.bmp
- %TEMP%\licenseen.bmp
- %TEMP%\welcome.bmp
- %TEMP%\welcomekugou.bmp
- %TEMP%\nse2.tmp
- %TEMP%\nsk3.tmp\System.dll
- %TEMP%\FunshionInstall_C64045.exe
- %TEMP%\nsk3.tmp\ExecCmd.dll
- %TEMP%\nsk3.tmp\WelcomePage.ini
- %TEMP%\nsk3.tmp\FindProcDLL.dll
- %TEMP%\nsk3.tmp\KillProcDLL.dll
- %PROGRAM_FILES%\Funshion Online\Funshion\quality.dll
- %PROGRAM_FILES%\Funshion Online\Funshion\RouterSetting.dll
- %PROGRAM_FILES%\Funshion Online\Funshion\FunshionService.exe
- %PROGRAM_FILES%\Funshion Online\Funshion\LangResEnAmerican.dll
- %PROGRAM_FILES%\Funshion Online\Funshion\GetMACAddress.dll
- %PROGRAM_FILES%\Funshion Online\Funshion\Dump.dll
- %PROGRAM_FILES%\Funshion Online\Funshion\upnp.dll
- %PROGRAM_FILES%\Funshion Online\Funshion\dbghelp.dll
- %TEMP%\installfilescn.bmp
- %TEMP%\installfilesen.bmp
- %TEMP%\installpathcn.bmp
- %TEMP%\installpathen.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\Funshion.exe
- %PROGRAM_FILES%\Funshion Online\Funshion\funshionplugin2.dll
- %PROGRAM_FILES%\Funshion Online\Funshion\CrashReport.exe
- %PROGRAM_FILES%\Funshion Online\Funshion\Encrypt.dll
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\PlaySplidBarDownload.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\PlaySplidBarDownloadSmall.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\PlaySplidBarBkgnd.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\PlaySplidBarBkgndSmall.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\PlaySplidBarThumb.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\PlaySplidBarThumbSmall.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\PlaySplidBarHead.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\PlaySplidBarHeadSmall.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayInfoHeaderBkgnd.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayInfoTitleBk.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayInfoBtnMenu.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayInfoCurPlay.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\PlaySplidBarBefore.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\PlaySplidBarBeforeSmall.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayListAddBtn.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayListRemove.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayerBarBtnPause.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayerBarBtnPauseSmall.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayerBarBtnNonTop.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayerBarBtnNormal.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayerBarBtnPlaySmall.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayerBarBtnPre.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayerBarBtnPlay.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayerBarBtnPlayList.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayerBarBkgnd.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayerBarBtnFullView.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\PlaySplidBarTrail.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\PlaySplidBarTrailSmall.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayerBarBtnNext.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayerBarBtnNextSmall.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayerBarBtnMute.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayerBarBtnMuteSmall.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayInfoBtmBar.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\MainNcFrameLeft.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\MainNcFrameRight.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\ListHeaderSplid.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\MainNcFrameBtm.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\MainNcLeftTopCorner.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\MainNcRightBtmCorner.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\MainNcFrameTop.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\MainNcLeftBtmCorner.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\IeToolBarForwardEn.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\IeToolBarHomePage.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\IeToolBarBkgnd.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\IeToolBarForward.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\IeToolBarRefreshEn.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\ListHeaderBkgnd.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\IeToolBarHomePageEn.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\IeToolBarRefresh.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayBufferInfoWndBkgnd.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayBufferInfoWndLeft.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayBarVolumeBarThumb.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayBarVolumeBarThumbSmall.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayInfoBkgnd.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayInfoBkgndSel.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayBufferInfoWndRight.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayFlickerBtn.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\PauseFlickerBtn.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayBarSplidRgn.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\MainNcRightTopCorner.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\PauseAdCloseBtn.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayBarVolumeBarBkgndRightSmall.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayBarVolumeBarBkgndSmall.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayBarVolumeBarBkgnd.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayBarVolumeBarBkgndRight.bmp
Удаляет следующие файлы:
- %PROGRAM_FILES%\Funshion Online\Funshion\XPSP2Patch\bmps\3.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\XPSP2Patch\install.ini
- %PROGRAM_FILES%\Funshion Online\Funshion\XPSP2Patch\bmps\5.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\XPSP2Patch\bmps\4.bmp
- %HOMEPATH%\Cookies\%USERNAME%@funshion[1].txt
- %TEMP%\nsk3.tmp\NSISdl.dll
- %TEMP%\nsk3.tmp\md5dll.dll
- %TEMP%\nsk3.tmp\WelcomePage.ini
- %TEMP%\nsk3.tmp\System.dll
- %PROGRAM_FILES%\Funshion Online\Funshion\XPSP2Patch\FunshionInstall.exe
- %PROGRAM_FILES%\Funshion Online\Funshion\XPSP2Patch\bmps\en_rcmd.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\XPSP2Patch\InstallLangAm.dll
- %PROGRAM_FILES%\Funshion Online\Funshion\XPSP2Patch\funshion_clone.exe
- %PROGRAM_FILES%\Funshion Online\Funshion\XPSP2Patch\bmps\en_fin.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\XPSP2Patch\bmps\ch_fin.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\XPSP2Patch\bmps\6.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\XPSP2Patch\bmps\Dialog.bmp
- %PROGRAM_FILES%\Funshion Online\Funshion\XPSP2Patch\bmps\ch_rcmd.bmp
- %TEMP%\nsk3.tmp\KillProcDLL.dll
- %TEMP%\welcomekugou.bmp
- %TEMP%\welcome.bmp
- %TEMP%\licenseen.bmp
- %TEMP%\licensecn.bmp
- %TEMP%\instpath.ini
- %TEMP%\post.dat
- %TEMP%\xml2fspdata.exe
- %TEMP%\welcomepage.ini
- %TEMP%\funshion.ini
- %TEMP%\nsk3.tmp\ExecDos.dll
- %TEMP%\nsk3.tmp\ExecCmd.dll
- %TEMP%\nsk3.tmp\InstPath.ini
- %TEMP%\nsk3.tmp\FindProcDLL.dll
- %TEMP%\installfilesen.bmp
- %TEMP%\installpathen.bmp
- %TEMP%\installpathcn.bmp
- %TEMP%\installfilescn.bmp
- %TEMP%\blank.bmp
Сетевая активность:
Подключается к:
- 'localhost':1042
- '22#.#5.250.56':21
- 'pa#####.funshion.com':80
- 'localhost':1038
- 're#.#qkuyou.cn':80
TCP:
Запросы HTTP GET:
- pa#####.funshion.com/partner/query_binding_config.php?ch##############
- pa#####.funshion.com/partner/install_statistic.php?s=##################################################################################################################################################
- re#.#qkuyou.cn/
UDP:
- DNS ASK pa#####.funshion.com
- DNS ASK re#.#qkuyou.cn
Другое:
Ищет следующие окна:
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'funshion_player_tzdenjohn' WindowName: '?? 2.2.0.17'
- ClassName: '' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
