Trojan.DownLoader11.58929

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Classes\ppfilm\shell\open\command] '' = '%PROGRAM_FILES%\pipi\jfCacheMgr.exe %1'
[<HKLM>\SOFTWARE\Classes\KmMediaPlayer\shell\open\command] '' = '"%PROGRAM_FILES%\pipi\PIPIPlayer.exe" "%L"'

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\PIPI_Update.job

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\PIPIStartSvr] 'Start' = '00000002'

Вредоносные функции:

Для обхода брандмауэра удаляет или модифицирует следующие ключи реестра:

[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\pipi\KmLiveUpdate.exe' = '%PROGRAM_FILES%\pipi\KmLiveUpdate.exe:*:Enabled:PIPI LiveUpdate'
[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\pipi\HttpDownLoad.exe' = '%PROGRAM_FILES%\pipi\HttpDownLoad.exe:*:Enabled:HttpDownLoad'
[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\pipi\jfCacheMgr.exe' = '%PROGRAM_FILES%\pipi\jfCacheMgr.exe:*:Enabled:PIPI CacheMgr'
[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\pipi\PIPIPlayer.exe' = '%PROGRAM_FILES%\pipi\PIPIPlayer.exe:*:Enabled:PIPIPlayer'

Создает и запускает на исполнение:

'%PROGRAM_FILES%\pipi\PIPIStartSvr.exe' -i
'%PROGRAM_FILES%\pipi\jfCacheMgr.exe'
'<Текущая директория>\pipi_setup_clean_585.exe' /verysilent
'%TEMP%\is-LRSSD.tmp\pipi_setup_clean_585.tmp' /SL5="$40036,6213343,71168,<Текущая директория>\pipi_setup_clean_585.exe" /verysilent

Запускает на исполнение:

'<SYSTEM32>\regsvr32.exe' /s "%PROGRAM_FILES%\pipi\codec\CoreAAC.ax"
'<SYSTEM32>\regsvr32.exe' /s "%PROGRAM_FILES%\pipi\codec\CoreAVC.ax"
'<SYSTEM32>\regsvr32.exe' /s "%PROGRAM_FILES%\pipi\codec\MPCVideoDec.ax"
'<SYSTEM32>\regsvr32.exe' /s "%PROGRAM_FILES%\pipi\JfCheck.dll"
'<SYSTEM32>\regsvr32.exe' /s "%PROGRAM_FILES%\pipi\MCCKMPlayerX.dll"
'<SYSTEM32>\regsvr32.exe' /s "%PROGRAM_FILES%\pipi\PIPIWebPlayer.ocx"

Изменения в файловой системе:

Создает следующие файлы:

%PROGRAM_FILES%\pipi\config\is-7KTGP.tmp
%PROGRAM_FILES%\pipi\config\is-5M952.tmp
%PROGRAM_FILES%\pipi\config\is-LD5NO.tmp
%PROGRAM_FILES%\pipi\config\is-1DE5I.tmp
%PROGRAM_FILES%\pipi\config\is-0I0SU.tmp
%PROGRAM_FILES%\pipi\config\is-87BUQ.tmp
%PROGRAM_FILES%\pipi\config\is-UTD9I.tmp
%PROGRAM_FILES%\pipi\config\is-758ND.tmp
%ALLUSERSPROFILE%\Start Menu\Programs\PIPI\PIPI Player.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\PIPI\Media File Association.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\PIPI\PIPI WebPlayer.lnk
%PROGRAM_FILES%\pipi\Plugins\is-57QE8.tmp
%PROGRAM_FILES%\pipi\Plugins\is-A440U.tmp
%PROGRAM_FILES%\pipi\Plugins\is-NHI8U.tmp
%PROGRAM_FILES%\pipi\Plugins\is-LKUA4.tmp
%PROGRAM_FILES%\pipi\config\is-CHN30.tmp
%PROGRAM_FILES%\pipi\codec\rm\is-R9HNR.tmp
%PROGRAM_FILES%\pipi\codec\rm\is-4H4SF.tmp
%PROGRAM_FILES%\pipi\codec\rm\is-9A1GP.tmp
%PROGRAM_FILES%\pipi\codec\rm\is-6R5PC.tmp
%PROGRAM_FILES%\pipi\codec\rm\is-28F5Q.tmp
%PROGRAM_FILES%\pipi\codec\rm\is-673VA.tmp
%PROGRAM_FILES%\pipi\codec\rm\is-4TOFU.tmp
%PROGRAM_FILES%\pipi\codec\rm\is-0A98L.tmp
%PROGRAM_FILES%\pipi\config\is-GJ6CL.tmp
%PROGRAM_FILES%\pipi\config\is-TARQG.tmp
%PROGRAM_FILES%\pipi\config\is-IG2KS.tmp
%PROGRAM_FILES%\pipi\config\is-IOPTU.tmp
%PROGRAM_FILES%\pipi\codec\rm\is-TOIR7.tmp
%PROGRAM_FILES%\pipi\codec\rm\is-N4P09.tmp
%PROGRAM_FILES%\pipi\codec\rm\is-N9F2R.tmp
%ALLUSERSPROFILE%\Start Menu\Programs\PIPI\Online Shopping.lnk
%HOMEPATH%\Cookies\%USERNAME%@.ppfilm[1].txt
%HOMEPATH%\Cookies\%USERNAME%@.pipi[2].txt
%HOMEPATH%\Cookies\%USERNAME%@www.pipi[1].txt
%HOMEPATH%\Cookies\%USERNAME%@.ppmovie[1].txt
%PROGRAM_FILES%\pipi\MachineInfo.cfg
%HOMEPATH%\Cookies\%USERNAME%@.kamun[1].txt
%HOMEPATH%\Cookies\%USERNAME%@.pipi[1].txt
%HOMEPATH%\Cookies\%USERNAME%@.kamun[2].txt
%PROGRAM_FILES%\pipi\0\user.db
%PROGRAM_FILES%\pipi\KmLiveStream.log
%PROGRAM_FILES%\pipi\config\dnscache.dat
%PROGRAM_FILES%\pipi\0\__db.user.db
%HOMEPATH%\Cookies\%USERNAME%@.pipi[3].txt
%HOMEPATH%\Cookies\%USERNAME%@.ppmovie[2].txt
%HOMEPATH%\Cookies\%USERNAME%@.ppfilm[2].txt
%PROGRAM_FILES%\pipi\topWizardSmallImageFile.jpg
%HOMEPATH%\Desktop\PIPI Player.lnk
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\PIPI Player.lnk
%PROGRAM_FILES%\pipi\jfCacheMgr.url
%ALLUSERSPROFILE%\Start Menu\Programs\PIPI\Uninstall PIPI.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\PIPI\PIPI on the web.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\PIPI\FAQ on the web.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\PIPI\88488 Web Directory.lnk
%PROGRAM_FILES%\pipi\unins000.dat
%PROGRAM_FILES%\pipi\config\config.ini
%PROGRAM_FILES%\pipi\pipisp.url
%PROGRAM_FILES%\pipi\FileAssocBak.cfg
<SYSTEM32>\pncrt.dll
%PROGRAM_FILES%\pipi\config\partner.ini
<SYSTEM32>\config\mcckmplayervod.ini
%PROGRAM_FILES%\pipi\config\skin.ini
%PROGRAM_FILES%\pipi\is-QM506.tmp
%PROGRAM_FILES%\pipi\is-7K5FE.tmp
%PROGRAM_FILES%\pipi\is-KUDTT.tmp
%PROGRAM_FILES%\pipi\is-HL7CJ.tmp
%TEMP%\is-SO5M7.tmp\topWizardSmallImageFile.bmp
%PROGRAM_FILES%\pipi\is-CTAEH.tmp
%PROGRAM_FILES%\pipi\is-OOEEB.tmp
%PROGRAM_FILES%\pipi\is-30UHH.tmp
%PROGRAM_FILES%\pipi\is-GKSOR.tmp
%PROGRAM_FILES%\pipi\is-81UOK.tmp
%PROGRAM_FILES%\pipi\is-4LOHS.tmp
%PROGRAM_FILES%\pipi\is-HREJH.tmp
%PROGRAM_FILES%\pipi\is-8CPBQ.tmp
%PROGRAM_FILES%\pipi\is-24E8I.tmp
%PROGRAM_FILES%\pipi\is-PA8MH.tmp
%TEMP%\is-SO5M7.tmp\wizard_recommand.bmp
%TEMP%\is-SO5M7.tmp\jpg2bmp.dll
%TEMP%\is-SO5M7.tmp\PIPIRecommend.dll
%TEMP%\is-SO5M7.tmp\gtapi_signed.dll
%TEMP%\is-SO5M7.tmp\_isetup\_shfoldr.dll
<Текущая директория>\pipi_setup_clean_585.exe
%TEMP%\is-LRSSD.tmp\pipi_setup_clean_585.tmp
%TEMP%\is-SO5M7.tmp\_isetup\_RegDLL.tmp
%TEMP%\is-SO5M7.tmp\setupwelcome.jpg
%TEMP%\is-SO5M7.tmp\setupwelcome.bmp
%TEMP%\is-SO5M7.tmp\google_logo.bmp
%TEMP%\is-SO5M7.tmp\baidu_logo.bmp
%TEMP%\is-SO5M7.tmp\topWizardSmallImageFile.jpg
%TEMP%\is-SO5M7.tmp\google_logo.jpg
%TEMP%\is-SO5M7.tmp\baidu_logo.jpg
%TEMP%\is-SO5M7.tmp\wizard_recommand.jpg
%PROGRAM_FILES%\pipi\is-7NGJC.tmp
%PROGRAM_FILES%\pipi\is-4SQE4.tmp
%PROGRAM_FILES%\pipi\codec\is-ST6D3.tmp
%PROGRAM_FILES%\pipi\codec\is-O9VA5.tmp
%PROGRAM_FILES%\pipi\is-NI346.tmp
%PROGRAM_FILES%\pipi\is-01NU1.tmp
%PROGRAM_FILES%\pipi\is-KANDI.tmp
%PROGRAM_FILES%\pipi\is-Q781E.tmp
%PROGRAM_FILES%\pipi\codec\is-LAL6O.tmp
%PROGRAM_FILES%\pipi\codec\rm\is-8KVT1.tmp
%PROGRAM_FILES%\pipi\codec\rm\is-A8C5H.tmp
%PROGRAM_FILES%\pipi\codec\rm\is-OBGAC.tmp
%PROGRAM_FILES%\pipi\codec\rm\is-UBHSC.tmp
%PROGRAM_FILES%\pipi\codec\rm\is-359DS.tmp
%PROGRAM_FILES%\pipi\codec\rm\is-QUOAR.tmp
%PROGRAM_FILES%\pipi\codec\rm\is-64RPS.tmp
%PROGRAM_FILES%\pipi\is-GAE7V.tmp
%PROGRAM_FILES%\pipi\is-32UA1.tmp
%PROGRAM_FILES%\pipi\is-26QSL.tmp
%PROGRAM_FILES%\pipi\is-VLBBT.tmp
%PROGRAM_FILES%\pipi\is-36S5P.tmp
%PROGRAM_FILES%\pipi\is-954B0.tmp
%PROGRAM_FILES%\pipi\is-QPOID.tmp
%PROGRAM_FILES%\pipi\is-UCTDP.tmp
%PROGRAM_FILES%\pipi\is-JVDJG.tmp
%PROGRAM_FILES%\pipi\is-BRK1Q.tmp
%PROGRAM_FILES%\pipi\is-FPE1F.tmp
%PROGRAM_FILES%\pipi\is-0KBA0.tmp
%PROGRAM_FILES%\pipi\is-K5BPA.tmp
%PROGRAM_FILES%\pipi\is-TSG1N.tmp
%PROGRAM_FILES%\pipi\is-8JOI2.tmp
%PROGRAM_FILES%\pipi\is-LMOI2.tmp

Удаляет следующие файлы:

%TEMP%\is-SO5M7.tmp\_isetup\_RegDLL.tmp
%TEMP%\is-SO5M7.tmp\_isetup\_shfoldr.dll
%TEMP%\is-LRSSD.tmp\pipi_setup_clean_585.tmp
%TEMP%\is-SO5M7.tmp\wizard_recommand.jpg
%TEMP%\is-SO5M7.tmp\topWizardSmallImageFile.bmp
%TEMP%\is-SO5M7.tmp\topWizardSmallImageFile.jpg
%TEMP%\is-SO5M7.tmp\wizard_recommand.bmp
%HOMEPATH%\Cookies\%USERNAME%@.ppmovie[1].txt
%HOMEPATH%\Cookies\%USERNAME%@.ppfilm[1].txt
%HOMEPATH%\Cookies\%USERNAME%@.pipi[2].txt
%HOMEPATH%\Cookies\%USERNAME%@.pipi[1].txt
<Текущая директория>\pipi_setup_clean_585.exe
%HOMEPATH%\Cookies\%USERNAME%@.kamun[1].txt
%HOMEPATH%\Cookies\%USERNAME%@.kamun[2].txt
%TEMP%\is-SO5M7.tmp\setupwelcome.jpg
%PROGRAM_FILES%\pipi\setupwelcome.JPG
%PROGRAM_FILES%\pipi\topWizardSmallImageFile.jpg
%TEMP%\is-SO5M7.tmp\baidu_logo.bmp
%PROGRAM_FILES%\pipi\google_logo.JPG
%PROGRAM_FILES%\pipi\jfCacheMgr.exe
%PROGRAM_FILES%\pipi\wizard_recommand.JPG
%PROGRAM_FILES%\pipi\baidu_logo.JPG
%TEMP%\is-SO5M7.tmp\jpg2bmp.dll
%TEMP%\is-SO5M7.tmp\PIPIRecommend.dll
%TEMP%\is-SO5M7.tmp\setupwelcome.bmp
%TEMP%\is-SO5M7.tmp\gtapi_signed.dll
%TEMP%\is-SO5M7.tmp\baidu_logo.jpg
%TEMP%\is-SO5M7.tmp\google_logo.bmp
%TEMP%\is-SO5M7.tmp\google_logo.jpg

Перемещает следующие файлы:

%PROGRAM_FILES%\pipi\codec\rm\is-6R5PC.tmp в %PROGRAM_FILES%\pipi\codec\rm\pncrt.dll
%PROGRAM_FILES%\pipi\codec\rm\is-R9HNR.tmp в %PROGRAM_FILES%\pipi\codec\rm\raac.dll
%PROGRAM_FILES%\pipi\codec\rm\is-673VA.tmp в %PROGRAM_FILES%\pipi\codec\rm\drvc.dll
%PROGRAM_FILES%\pipi\codec\rm\is-4TOFU.tmp в %PROGRAM_FILES%\pipi\codec\rm\hxltcolor.dll
%PROGRAM_FILES%\pipi\codec\rm\is-4H4SF.tmp в %PROGRAM_FILES%\pipi\codec\rm\ralf.dll
%PROGRAM_FILES%\pipi\codec\rm\is-TOIR7.tmp в %PROGRAM_FILES%\pipi\codec\rm\rv30.dll
%PROGRAM_FILES%\pipi\codec\rm\is-N4P09.tmp в %PROGRAM_FILES%\pipi\codec\rm\rv40.dll
%PROGRAM_FILES%\pipi\codec\rm\is-9A1GP.tmp в %PROGRAM_FILES%\pipi\codec\rm\rv10.dll
%PROGRAM_FILES%\pipi\codec\rm\is-0A98L.tmp в %PROGRAM_FILES%\pipi\codec\rm\rv20.dll
%PROGRAM_FILES%\pipi\codec\rm\is-QUOAR.tmp в %PROGRAM_FILES%\pipi\codec\rm\28_83260.dll
%PROGRAM_FILES%\pipi\codec\rm\is-64RPS.tmp в %PROGRAM_FILES%\pipi\codec\rm\atrc.dll
%PROGRAM_FILES%\pipi\codec\is-LAL6O.tmp в %PROGRAM_FILES%\pipi\codec\MPCVideoDec.ax
%PROGRAM_FILES%\pipi\codec\rm\is-359DS.tmp в %PROGRAM_FILES%\pipi\codec\rm\14_43260.dll
%PROGRAM_FILES%\pipi\codec\rm\is-UBHSC.tmp в %PROGRAM_FILES%\pipi\codec\rm\cook.dll
%PROGRAM_FILES%\pipi\codec\rm\is-OBGAC.tmp в %PROGRAM_FILES%\pipi\codec\rm\drv1.dll
%PROGRAM_FILES%\pipi\codec\rm\is-28F5Q.tmp в %PROGRAM_FILES%\pipi\codec\rm\drv2.dll
%PROGRAM_FILES%\pipi\codec\rm\is-8KVT1.tmp в %PROGRAM_FILES%\pipi\codec\rm\ddnt3260.dll
%PROGRAM_FILES%\pipi\codec\rm\is-A8C5H.tmp в %PROGRAM_FILES%\pipi\codec\rm\dnet3260.dll
%PROGRAM_FILES%\pipi\codec\rm\is-N9F2R.tmp в %PROGRAM_FILES%\pipi\codec\rm\sipr.dll
%PROGRAM_FILES%\pipi\config\is-LD5NO.tmp в %PROGRAM_FILES%\pipi\config\tab2_norm.bmp
%PROGRAM_FILES%\pipi\config\is-758ND.tmp в %PROGRAM_FILES%\pipi\config\tab2_over.bmp
%PROGRAM_FILES%\pipi\config\is-7KTGP.tmp в %PROGRAM_FILES%\pipi\config\partner.ini
%PROGRAM_FILES%\pipi\config\is-5M952.tmp в %PROGRAM_FILES%\pipi\config\tab2_down.bmp
%PROGRAM_FILES%\pipi\Plugins\is-A440U.tmp в %PROGRAM_FILES%\pipi\Plugins\KmHashFile.dll
%PROGRAM_FILES%\pipi\Plugins\is-57QE8.tmp в %PROGRAM_FILES%\pipi\Plugins\KmUdx.dll
%PROGRAM_FILES%\pipi\0\__db.user.db в %PROGRAM_FILES%\pipi\0\user.db
%PROGRAM_FILES%\pipi\Plugins\is-NHI8U.tmp в %PROGRAM_FILES%\pipi\Plugins\KmLiveStream.dll
%PROGRAM_FILES%\pipi\Plugins\is-LKUA4.tmp в %PROGRAM_FILES%\pipi\Plugins\KmTransmit.dll
%PROGRAM_FILES%\pipi\config\is-TARQG.tmp в %PROGRAM_FILES%\pipi\config\acl.crtc.conf
%PROGRAM_FILES%\pipi\config\is-IG2KS.tmp в %PROGRAM_FILES%\pipi\config\acl.edu.conf
%PROGRAM_FILES%\pipi\config\is-IOPTU.tmp в %PROGRAM_FILES%\pipi\config\acl.cmcc.conf
%PROGRAM_FILES%\pipi\config\is-GJ6CL.tmp в %PROGRAM_FILES%\pipi\config\acl.cnc.conf
%PROGRAM_FILES%\pipi\config\is-CHN30.tmp в %PROGRAM_FILES%\pipi\config\acl.greatwall.conf
%PROGRAM_FILES%\pipi\config\is-UTD9I.tmp в %PROGRAM_FILES%\pipi\config\config.ini
%PROGRAM_FILES%\pipi\config\is-1DE5I.tmp в %PROGRAM_FILES%\pipi\config\enumwindow.ini
%PROGRAM_FILES%\pipi\config\is-0I0SU.tmp в %PROGRAM_FILES%\pipi\config\acl.telecom.conf
%PROGRAM_FILES%\pipi\config\is-87BUQ.tmp в %PROGRAM_FILES%\pipi\config\clienttype.ini
%PROGRAM_FILES%\pipi\codec\is-O9VA5.tmp в %PROGRAM_FILES%\pipi\codec\CoreAVC.ax
%PROGRAM_FILES%\pipi\is-GKSOR.tmp в %PROGRAM_FILES%\pipi\jpg2bmp.dll
%PROGRAM_FILES%\pipi\is-81UOK.tmp в %PROGRAM_FILES%\pipi\KmBugslayerUtil.dll
%PROGRAM_FILES%\pipi\is-PA8MH.tmp в %PROGRAM_FILES%\pipi\JfCheck.dll
%PROGRAM_FILES%\pipi\is-HREJH.tmp в %PROGRAM_FILES%\pipi\jfres_plug.dll
%PROGRAM_FILES%\pipi\is-4LOHS.tmp в %PROGRAM_FILES%\pipi\KmFileTypeSetting.exe
%PROGRAM_FILES%\pipi\is-QPOID.tmp в %PROGRAM_FILES%\pipi\libdb43.dll
%PROGRAM_FILES%\pipi\is-UCTDP.tmp в %PROGRAM_FILES%\pipi\MCCKMPlayerX.dll
%PROGRAM_FILES%\pipi\is-7NGJC.tmp в %PROGRAM_FILES%\pipi\KmLiveEngine.dll
%PROGRAM_FILES%\pipi\is-954B0.tmp в %PROGRAM_FILES%\pipi\KmLiveUpdate.exe
%PROGRAM_FILES%\pipi\is-HL7CJ.tmp в %PROGRAM_FILES%\pipi\baidu_logo.JPG
%PROGRAM_FILES%\pipi\is-QM506.tmp в %PROGRAM_FILES%\pipi\dbghelp.dll
%PROGRAM_FILES%\pipi\is-CTAEH.tmp в %PROGRAM_FILES%\pipi\unins000.exe
%PROGRAM_FILES%\pipi\is-OOEEB.tmp в %PROGRAM_FILES%\pipi\jfCacheMgr.exe
%PROGRAM_FILES%\pipi\is-7K5FE.tmp в %PROGRAM_FILES%\pipi\google_logo.JPG
%PROGRAM_FILES%\pipi\is-8CPBQ.tmp в %PROGRAM_FILES%\pipi\jfCacheMgr.exe
%PROGRAM_FILES%\pipi\is-24E8I.tmp в %PROGRAM_FILES%\pipi\jfcheck.conf
%PROGRAM_FILES%\pipi\is-KUDTT.tmp в %PROGRAM_FILES%\pipi\gtapi_signed.dll
%PROGRAM_FILES%\pipi\is-30UHH.tmp в %PROGRAM_FILES%\pipi\HttpDownLoad.exe
%PROGRAM_FILES%\pipi\is-36S5P.tmp в %PROGRAM_FILES%\pipi\MFC71.dll
%PROGRAM_FILES%\pipi\is-GAE7V.tmp в %PROGRAM_FILES%\pipi\setupwelcome.JPG
%PROGRAM_FILES%\pipi\is-01NU1.tmp в %PROGRAM_FILES%\pipi\sqlite3.dll
%PROGRAM_FILES%\pipi\is-FPE1F.tmp в %PROGRAM_FILES%\pipi\pphelp.url
%PROGRAM_FILES%\pipi\is-0KBA0.tmp в %PROGRAM_FILES%\pipi\ppwebnav.url
%PROGRAM_FILES%\pipi\is-KANDI.tmp в %PROGRAM_FILES%\pipi\topWizardSmallImageFile.jpg
%PROGRAM_FILES%\pipi\is-4SQE4.tmp в %PROGRAM_FILES%\pipi\wizard_recommand.JPG
%PROGRAM_FILES%\pipi\codec\is-ST6D3.tmp в %PROGRAM_FILES%\pipi\codec\CoreAAC.ax
%PROGRAM_FILES%\pipi\is-Q781E.tmp в %PROGRAM_FILES%\pipi\uninstall.ico
%PROGRAM_FILES%\pipi\is-NI346.tmp в %PROGRAM_FILES%\pipi\webplayer.url
%PROGRAM_FILES%\pipi\is-VLBBT.tmp в %PROGRAM_FILES%\pipi\PIPIPlayer.exe
%PROGRAM_FILES%\pipi\is-JVDJG.tmp в %PROGRAM_FILES%\pipi\PIPIRecommend.dll
%PROGRAM_FILES%\pipi\is-32UA1.tmp в %PROGRAM_FILES%\pipi\msvcp71.dll
%PROGRAM_FILES%\pipi\is-26QSL.tmp в %PROGRAM_FILES%\pipi\msvcr71.dll
%PROGRAM_FILES%\pipi\is-TSG1N.tmp в %PROGRAM_FILES%\pipi\pipisp.ico
%PROGRAM_FILES%\pipi\is-K5BPA.tmp в %PROGRAM_FILES%\pipi\PIPIWebPlayer.ocx
%PROGRAM_FILES%\pipi\is-BRK1Q.tmp в %PROGRAM_FILES%\pipi\player.swf
%PROGRAM_FILES%\pipi\is-8JOI2.tmp в %PROGRAM_FILES%\pipi\pipisp.url
%PROGRAM_FILES%\pipi\is-LMOI2.tmp в %PROGRAM_FILES%\pipi\PIPIStartSvr.exe

Сетевая активность:

Подключается к:

'qu###.pipisite.com':80
'qu###.pipisite.com':1865

UDP:

DNS ASK qu###.pipisite.com
'qu###.pipisite.com':1865

Другое:

Ищет следующие окна:

ClassName: '' WindowName: 'ppfilm_class_cachemgr_title'
ClassName: 'SysListView32' WindowName: ''
ClassName: 'ppfilm_class' WindowName: ''
ClassName: 'Shell_TrayWnd' WindowName: ''

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней