Техническая информация
Вредоносные функции:
Создает и запускает на исполнение:
- '%PROGRAM_FILES%\haozip1.exe'
- '%PROGRAM_FILES%\NetMeeting\msconf.exe'
- '%PROGRAM_FILES%\del.exe'
- '%PROGRAM_FILES%\dels.exe'
- '%PROGRAM_FILES%\winsoft9\test.exe'
- '%PROGRAM_FILES%\winsoft9\t2.exe'
- '%PROGRAM_FILES%\winsoft9\bho.exe'
- '%PROGRAM_FILES%\ј«ЛЩµзКУ\jisutv.exe'
- '%PROGRAM_FILES%\dels.exe' (загружен из сети Интернет)
- '%PROGRAM_FILES%\del.exe' (загружен из сети Интернет)
- '%PROGRAM_FILES%\NetMeeting\msconf.exe' (загружен из сети Интернет)
- '%PROGRAM_FILES%\haozip1.exe' (загружен из сети Интернет)
Запускает на исполнение:
- '<SYSTEM32>\reg.exe' add "HKEY_CLASSES_ROOT\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command" /v "" /d "%PROGRAM_FILES%\Internet Explorer\iexplore.exe http://www.nb##.com/?ha###### /f
- '<SYSTEM32>\wscript.exe' "%PROGRAM_FILES%\winsoft9\1.vbs"
- '%WINDIR%\regedit.exe' /s %WINDIR%\reg.reg
- '<SYSTEM32>\regsvr32.exe' /s "%PROGRAM_FILES%\ut\dlldvkfx.dll"
- '<SYSTEM32>\wscript.exe' "%PROGRAM_FILES%\winsoft9\3.vbs"
- '<SYSTEM32>\wscript.exe' "%PROGRAM_FILES%\winsoft9\2222.vbs"
- '<SYSTEM32>\reg.exe' del "HKEY_CLASSES_ROOT\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command" /v
- '<SYSTEM32>\cmd.exe' /c ""%PROGRAM_FILES%\winsoft9\3.bat" "
Изменения в файловой системе:
Создает следующие файлы:
- %PROGRAM_FILES%\ј«ЛЩµзКУ\Kernel\sopcast\skin\MUTE_HOVER.bmp
- %PROGRAM_FILES%\ј«ЛЩµзКУ\Kernel\sopcast\skin\MUTE_NORMAL.bmp
- %PROGRAM_FILES%\ј«ЛЩµзКУ\Kernel\sopcast\skin\MUTE_PRESSED.bmp
- %PROGRAM_FILES%\ј«ЛЩµзКУ\Kernel\sopcast\skin\FULLSCREEN_NORMAL.bmp
- %PROGRAM_FILES%\ј«ЛЩµзКУ\Kernel\sopcast\skin\FULLSCREEN_PRESSED.bmp
- %PROGRAM_FILES%\ј«ЛЩµзКУ\Kernel\sopcast\skin\MAIN_DIALOG.bmp
- %PROGRAM_FILES%\ј«ЛЩµзКУ\Kernel\sopcast\skin\PAUSE_HOVER.bmp
- %PROGRAM_FILES%\ј«ЛЩµзКУ\Kernel\sopcast\skin\PLAY_NORMAL.bmp
- %PROGRAM_FILES%\ј«ЛЩµзКУ\Kernel\sopcast\skin\PLAY_PRESSED.bmp
- %PROGRAM_FILES%\ј«ЛЩµзКУ\Kernel\sopcast\skin\SOPLOGO_HOVER.bmp
- %PROGRAM_FILES%\ј«ЛЩµзКУ\Kernel\sopcast\skin\PAUSE_NORMAL.bmp
- %PROGRAM_FILES%\ј«ЛЩµзКУ\Kernel\sopcast\skin\PAUSE_PRESSED.bmp
- %PROGRAM_FILES%\ј«ЛЩµзКУ\Kernel\sopcast\skin\PLAY_HOVER.bmp
- %PROGRAM_FILES%\ј«ЛЩµзКУ\Kernel\sopcast\skin\FULLSCREEN_HOVER.bmp
- %PROGRAM_FILES%\ј«ЛЩµзКУ\Kernel\sopcast\sopocx.ocx
- %PROGRAM_FILES%\ј«ЛЩµзКУ\Kernel\sopcast\sopvod.exe
- %PROGRAM_FILES%\ј«ЛЩµзКУ\Kernel\sopcast\skin\DURATION_SLIDER_HOVER.bmp
- %PROGRAM_FILES%\ј«ЛЩµзКУ\Kernel\uusee\seeplayer.ocx
- %PROGRAM_FILES%\ј«ЛЩµзКУ\Kernel\uusee\trafficlight.dll
- %PROGRAM_FILES%\ј«ЛЩµзКУ\Kernel\sopcast\config.xml
- %PROGRAM_FILES%\ј«ЛЩµзКУ\Kernel\sopcast\skin\DURATION_SLIDER_NORMAL.bmp
- %PROGRAM_FILES%\ј«ЛЩµзКУ\Kernel\sopcast\skin\EXPLAYER_NORMAL.bmp
- %PROGRAM_FILES%\ј«ЛЩµзКУ\Kernel\sopcast\skin\EXPLAYER_PRESSED.bmp
- %PROGRAM_FILES%\ј«ЛЩµзКУ\Kernel\sopcast\skin\FULLSCREEN_DISABLED.bmp
- %PROGRAM_FILES%\ј«ЛЩµзКУ\Kernel\sopcast\skin\DURATION_SLIDER_PRESSED.bmp
- %PROGRAM_FILES%\ј«ЛЩµзКУ\Kernel\sopcast\skin\EXPLAYER_DISABLED.bmp
- %PROGRAM_FILES%\ј«ЛЩµзКУ\Kernel\sopcast\skin\EXPLAYER_HOVER.bmp
- %PROGRAM_FILES%\ј«ЛЩµзКУ\Kernel\sopcast\adv\default\home.html
- %PROGRAM_FILES%\ј«ЛЩµзКУ\Kernel\sopcast\adv\default\index.html
- %HOMEPATH%\Start Menu\Programs\ј«ЛЩµзКУ\Uninstall.lnk
- %PROGRAM_FILES%\ј«ЛЩµзКУ\Kernel\sopcast\skin\sopcore.xml
- %PROGRAM_FILES%\ј«ЛЩµзКУ\Kernel\sopcast\adv\SopAdver.exe
- %PROGRAM_FILES%\ј«ЛЩµзКУ\Kernel\sopcast\adv\default\Thumbs.db
- %PROGRAM_FILES%\ј«ЛЩµзКУ\uninst.exe
- %WINDIR%\reg.reg
- %PROGRAM_FILES%\del.exe
- %PROGRAM_FILES%\dels.exe
- %PROGRAM_FILES%\NetMeeting\msconf.exe
- %PROGRAM_FILES%\ut\dlldvkfx.dll
- %PROGRAM_FILES%\haozip1.exe
- %PROGRAM_FILES%\ј«ЛЩµзКУ\Kernel\sopcast\skin\VOLUME_SLIDER_PRESSED.bmp
- %PROGRAM_FILES%\ј«ЛЩµзКУ\Kernel\sopcast\skin\STOP_DISABLED.bmp
- %PROGRAM_FILES%\ј«ЛЩµзКУ\Kernel\sopcast\skin\STOP_HOVER.bmp
- %PROGRAM_FILES%\ј«ЛЩµзКУ\Kernel\sopcast\skin\STOP_NORMAL.bmp
- %PROGRAM_FILES%\ј«ЛЩµзКУ\Kernel\sopcast\skin\SOPLOGO_NORMAL.bmp
- %PROGRAM_FILES%\ј«ЛЩµзКУ\Kernel\sopcast\skin\SOPLOGO_PRESSED.bmp
- %PROGRAM_FILES%\ј«ЛЩµзКУ\Kernel\sopcast\skin\SOPSTATUS_NORMAL.bmp
- %PROGRAM_FILES%\ј«ЛЩµзКУ\Kernel\sopcast\skin\STOP_PRESSED.bmp
- %PROGRAM_FILES%\ј«ЛЩµзКУ\Kernel\sopcast\skin\UNMUTE_PRESSED.bmp
- %PROGRAM_FILES%\ј«ЛЩµзКУ\Kernel\sopcast\skin\VOLUME_SLIDER_HOVER.bmp
- %PROGRAM_FILES%\ј«ЛЩµзКУ\Kernel\sopcast\skin\VOLUME_SLIDER_NORMAL.bmp
- %PROGRAM_FILES%\ј«ЛЩµзКУ\Kernel\sopcast\skin\Thumbs.db
- %PROGRAM_FILES%\ј«ЛЩµзКУ\Kernel\sopcast\skin\UNMUTE_HOVER.bmp
- %PROGRAM_FILES%\ј«ЛЩµзКУ\Kernel\sopcast\skin\UNMUTE_NORMAL.bmp
- %PROGRAM_FILES%\ј«ЛЩµзКУ\languages\Chinese GB.Ini
- %PROGRAM_FILES%\ј«ЛЩµзКУ\languages\English.Ini
- %PROGRAM_FILES%\ј«ЛЩµзКУ\languages\Japanese.ini
- %PROGRAM_FILES%\winsoft9\bho.exe
- %PROGRAM_FILES%\winsoft9\t2.exe
- %PROGRAM_FILES%\ј«ЛЩµзКУ\languages\Chinese BIG5.Ini
- %PROGRAM_FILES%\ј«ЛЩµзКУ\chis.ini
- %PROGRAM_FILES%\ј«ЛЩµзКУ\info.ini
- %PROGRAM_FILES%\ј«ЛЩµзКУ\readme.txt
- %PROGRAM_FILES%\ј«ЛЩµзКУ\Kernel\cctv\CCTVPlayer.ocx
- %HOMEPATH%\Start Menu\Programs\ј«ЛЩµзКУ\ј«ЛЩµзКУ.lnk
- %HOMEPATH%\Desktop\ФЪПЯµзУ°µзКУ.lnk
- %PROGRAM_FILES%\winsoft9\WINDOWS\time\mian.dll
- %PROGRAM_FILES%\winsoft9\77zb.ico
- %PROGRAM_FILES%\winsoft9\game.ico
- %PROGRAM_FILES%\winsoft9\kusila.ico
- %PROGRAM_FILES%\winsoft9\3.bat
- %PROGRAM_FILES%\winsoft9\3.vbs
- %PROGRAM_FILES%\winsoft9\9ptv.ico
- %PROGRAM_FILES%\winsoft9\qq.ico
- %PROGRAM_FILES%\winsoft9\2222.vbs
- %PROGRAM_FILES%\winsoft9\test.exe
- %PROGRAM_FILES%\winsoft9\WINDOWS\time\mian.dil
- %PROGRAM_FILES%\winsoft9\taobao.ico
- %PROGRAM_FILES%\winsoft9\mm.ico
- %PROGRAM_FILES%\winsoft9\1.vbs
- %PROGRAM_FILES%\ј«ЛЩµзКУ\Kernel\sina\zlib.dll
- %PROGRAM_FILES%\ј«ЛЩµзКУ\Kernel\sina\°ІЧ°.bat
- %HOMEPATH%\Favorites\ЧїФЅСЗВнС·НшЙП№єОпНјКйЈ¬КЦ»ъЈ¬КэВлЈ¬јТµзЈ¬»ЇЧ±Ж·Ј¬ЦУ±нЈ¬КЧКОµИФЪПЯПъКЫ.url
- %WINDIR%\userid.txt
- %HOMEPATH%\Favorites\µ±µ±НшЎЄНшЙП№єОпЦРРДЈєНјКйЎўДёУ¤ЎўГАЧ±ЎўјТѕУЎўКэВлЎўјТµзЎў·юЧ°ЎўР¬°ьµИЈ¬ХэЖ·µНјЫЈ¬»хµЅё¶їо.url
- %PROGRAM_FILES%\ј«ЛЩµзКУ\Kernel\sina\liveupdate.dll
- %HOMEPATH%\Favorites\їґїґµзКУѕзФЪПЯґуИ«,,,ЧоєГВМЙ«ЧоРВёЯЛЩГв·СµзКУѕзНшХѕ!!!.url
- %PROGRAM_FILES%\ј«ЛЩµзКУ\jisutv.exe
- %PROGRAM_FILES%\ј«ЛЩµзКУ\Kernel\uusee\in_net.dll
- %PROGRAM_FILES%\ј«ЛЩµзКУ\Kernel\uusee\out_mmshttp.dll
- %HOMEPATH%\Favorites\јх·КЈЎїмµЅИГДгјвЅРЈЎєюДПОАКУНЖјцЧуРэИвјојх·К!.url
- %HOMEPATH%\Favorites\ГАЕ®·бРШґуГШѕч-20МмДЪСёЛЩФцґуґуґу!.url
- %HOMEPATH%\Favorites\°¬іИЕ®Ч°--ЧоГААцК±ЙРµДЕ®Ч°.ГАЕ®ВтТВЈ¬ГлЙ±°¬іИЕ®Ч°!!!.url
- %PROGRAM_FILES%\ј«ЛЩµзКУ\Kernel\sina\downloader.dll
- %HOMEPATH%\Favorites\ЧоРВј«Ж·ВМЙ«єГµДµзУ°ївГв·С.ёЯЗеёЯЛЩЈЎМмМмёьРВ!!!.url
- %HOMEPATH%\Favorites\ЦР№ъёЈАыІКЖ±Ј¬МеУэІКЖ±µДН¶ЧўЦРРД.ІКЖ±ґуУ®јТЈЎ.url
- %HOMEPATH%\Favorites\ЧоРВФЪПЯРЎЛµГв·СµДФД¶Б.·бё»ДЪИЭЛЩ¶ИїмµДРЎЛµХѕ!!!.url
- %PROGRAM_FILES%\ј«ЛЩµзКУ\Kernel\cctv\CCTVUpdateInstall.dll
- %HOMEPATH%\Favorites\ј«єГµДФЪПЯНшВзµзКУ.lnk
- %HOMEPATH%\Favorites\ЖЇББµДГАГјНјµДґујЇ...Зеґїј«Ж·і¬ј¶ГАГДРґХжЈЎЈЎ.url
- %HOMEPATH%\Favorites\ИЛМеѕшГАµДТХКхХѕ.Ч·ЗуЧоГАИЛМеј«Ж·ЙгУ°ОЁГАРґХж!!.url
- %PROGRAM_FILES%\ј«ЛЩµзКУ\Kernel\sina\UCLiveCtrl.ocx
- %HOMEPATH%\Favorites\45575.comФЪПЯµДРЎУОП·.ЧоєГНжЧоРВЧоїмїбі¬ј¶РЎУОП·!!!.url
- %PROGRAM_FILES%\ј«ЛЩµзКУ\Kernel\sina\clear.bat
- %HOMEPATH%\Favorites\МФ±¦Нш - МФЈЎОТПІ»¶.url
- %PROGRAM_FILES%\ј«ЛЩµзКУ\Kernel\sina\State.dll
- %PROGRAM_FILES%\ј«ЛЩµзКУ\Kernel\sina\UCLiveCore.dll
Удаляет следующие файлы:
- %TEMP%\~DF5788.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\huachi[1].htm
Сетевая активность:
Подключается к:
- 'to####.dianxin.cn':80
- 'www.ku##la.com':80
- 'www.qq##uo.com':80
- 'www.61##.com':80
- 'localhost':1044
- 'localhost':1038
- 'localhost':1037
- 'gt####cd.3322.org':80
- 'localhost':1041
TCP:
Запросы HTTP GET:
- www.61##.com/down/360.htm
- www.qq##uo.com/yeyexing/shenge.htm
- www.61##.com/down/del.htm
- gt####cd.3322.org/huachi.htm
- www.ku##la.com/?ha#####
- to####.dianxin.cn/api/work.aspx?cm########################################################################################
UDP:
- DNS ASK to####.dianxin.cn
- DNS ASK www.61##.com
- DNS ASK www.qq##uo.com
- DNS ASK gt####cd.3322.org
- DNS ASK www.ku##la.com
- DNS ASK www.ba##u.com
Другое:
Ищет следующие окна:
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'RegEdit_RegEdit' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'EDIT' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: '' WindowName: '%HOMEPATH%\Desktop'
