Trojan.DownLoader12.2724

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Classes\kwfile_lrc\shell\open\command] '' = '"%PROGRAM_FILES%\kuwo\kuwomusic\KwMusic.exe" "%1"'
[<HKLM>\SOFTWARE\Classes\kwfile_dks\shell\open\command] '' = '"%PROGRAM_FILES%\kuwo\kuwomusic\KwMusic.exe" "%1"'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'kwmusic' = '"%PROGRAM_FILES%\kuwo\kuwomusic\Kwmusic.exe" /autorun'
[<HKLM>\SOFTWARE\Classes\kuwo\Shell\open\command] '' = '"%PROGRAM_FILES%\kuwo\kuwomusic\KwMusic.exe" "%1"'
[<HKLM>\SOFTWARE\Classes\PROTOCOLS\Handler\kuwo] 'CLSID' = '{3050f3DA-98B5-11CF-BB82-00AA00BDCE0C}'
[<HKLM>\SOFTWARE\Classes\kwfile_lrcx\shell\open\command] '' = '"%PROGRAM_FILES%\kuwo\kuwomusic\KwMusic.exe" "%1"'

Вредоносные функции:

Для обхода брандмауэра удаляет или модифицирует следующие ключи реестра:

[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\kuwo\kuwomusic\bin\KwService.exe' = '%PROGRAM_FILES%\kuwo\kuwomusic\bin\KwService.exe:*:Enabled:їбОТєЛРД·юОс'
[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\kuwo\kuwomusic\bin\KwMusic.exe' = '%PROGRAM_FILES%\kuwo\kuwomusic\bin\KwMusic.exe:*:Enabled:їбОТТфАЦ'

Создает и запускает на исполнение:

'%PROGRAM_FILES%\kuwo\kuwomusic\bin\KwService.exe'
'%PROGRAM_FILES%\kuwo\kuwomusic\bin\WriteMbox.exe'
'%PROGRAM_FILES%\kuwo\kuwomusic\bin\KwMusic.exe' /autorun /nologauto
'%PROGRAM_FILES%\kuwo\kuwomusic\bin\IESandBox.exe'

Запускает на исполнение:

'<SYSTEM32>\regsvr32.exe' /s "<SYSTEM32>\wmvdecod.dll"
'<SYSTEM32>\regsvr32.exe' /s "<SYSTEM32>\wmadmod.dll"
'<SYSTEM32>\regsvr32.exe' /s "<SYSTEM32>\wmvcore.dll"
'<SYSTEM32>\wbem\wmiadap.exe' /R /T
'<SYSTEM32>\regsvr32.exe' /s "%PROGRAM_FILES%\kuwo\kuwomusic\bin\Kuwo.QuickLaunch.dll"
'<SYSTEM32>\regsvr32.exe' /s "%PROGRAM_FILES%\kuwo\kuwomusic\bin\KwArd.ax"
'<SYSTEM32>\regsvr32.exe' /s "%PROGRAM_FILES%\kuwo\kuwomusic\bin\dump.ax"
'<SYSTEM32>\regsvr32.exe' /s "%PROGRAM_FILES%\kuwo\kuwomusic\bin\CoreAVC0.ax"
'<SYSTEM32>\netsh.exe' firewall add allowedprogram "%PROGRAM_FILES%\kuwo\kuwomusic\bin\KwService.exe" їбОТєЛРД·юОс ENABLE
'<SYSTEM32>\netsh.exe' firewall add allowedprogram "%PROGRAM_FILES%\kuwo\kuwomusic\bin\KwMusic.exe" їбОТТфАЦ ENABLE

Изменения в файловой системе:

Создает следующие файлы:

%ALLUSERSPROFILE%\Application Data\kuwodata\kwmusic2013\Res\DeskLyric\DL_COLOR_nomal.jpg
%ALLUSERSPROFILE%\Application Data\kuwodata\kwmusic2013\Res\DeskLyric\DL_PIC_highlight.jpg
%ALLUSERSPROFILE%\Application Data\kuwodata\kwmusic2013\Res\DeskLyric\DL_COLOR_highlight.jpg
%ALLUSERSPROFILE%\Application Data\kuwodata\kwmusic2013\ModuleData\ModWebUpdate\zip\vipMbox_new.zip
%ALLUSERSPROFILE%\Application Data\kuwodata\kwmusic2013\ModuleData\lyricshow\LyricTheme.xml
%ALLUSERSPROFILE%\Application Data\kuwodata\kwmusic2013\Res\DeskLyric\DL_PIC_nomal.jpg
%ALLUSERSPROFILE%\Application Data\kuwodata\kwmusic2013\Res\DeskLyric\DL_Themes_2b.png
%ALLUSERSPROFILE%\Application Data\kuwodata\kwmusic2013\Res\DeskLyric\DL_Themes_3a.png
%ALLUSERSPROFILE%\Application Data\kuwodata\kwmusic2013\Res\DeskLyric\DL_Themes_2a.png
%ALLUSERSPROFILE%\Application Data\kuwodata\kwmusic2013\Res\DeskLyric\DL_Themes_1a.png
%ALLUSERSPROFILE%\Application Data\kuwodata\kwmusic2013\Res\DeskLyric\DL_Themes_1b.png
%ALLUSERSPROFILE%\Application Data\kuwodata\kwmusic2013\ModuleData\ModWebUpdate\zip\userinfo2012.zip
%PROGRAM_FILES%\kuwo\kuwomusic\bin\skin\serverskin\6\conf.ini
%PROGRAM_FILES%\kuwo\kuwomusic\bin\skin\serverskin\6\small.jpg
%PROGRAM_FILES%\kuwo\kuwomusic\bin\skin\serverskin\6\bk.jpg
%PROGRAM_FILES%\kuwo\kuwomusic\bin\skin\serverskin\5\conf.ini
%PROGRAM_FILES%\kuwo\kuwomusic\bin\skin\serverskin\5\small.jpg
%PROGRAM_FILES%\kuwo\kuwomusic\bin\skin\startpage\Default.jpg
%ALLUSERSPROFILE%\Application Data\kuwodata\kwmusic2013\ModuleData\ModWebUpdate\zip\sharesong.zip
%ALLUSERSPROFILE%\Application Data\kuwodata\kwmusic2013\ModuleData\ModWebUpdate\zip\songcomment.zip
%ALLUSERSPROFILE%\Application Data\kuwodata\kwmusic2013\ModuleData\ModWebUpdate\zip\netsong.zip
%ALLUSERSPROFILE%\Application Data\kuwodata\kwmusic2013\ModuleData\ModMusicTool\conf.txt
%ALLUSERSPROFILE%\Application Data\kuwodata\kwmusic2013\ModuleData\ModResource\NetSong-artists.pl
%ALLUSERSPROFILE%\Application Data\kuwodata\kwmusic2013\Res\DeskLyric\DL_Themes_3b.png
%PROGRAM_FILES%\kuwo\kuwomusic\KWMUSIC\Res\DeskLyric\DL_PIC_highlight.jpg
%PROGRAM_FILES%\kuwo\kuwomusic\KWMUSIC\Res\DeskLyric\DL_PIC_nomal.jpg
%PROGRAM_FILES%\kuwo\kuwomusic\KWMUSIC\Res\DeskLyric\DL_COLOR_nomal.jpg
%PROGRAM_FILES%\kuwo\kuwomusic\KWMUSIC\ModuleData\lyricshow\LyricTheme.xml
%PROGRAM_FILES%\kuwo\kuwomusic\KWMUSIC\Res\DeskLyric\DL_COLOR_highlight.jpg
%PROGRAM_FILES%\kuwo\kuwomusic\KWMUSIC\Res\DeskLyric\DL_Themes_1a.png
%PROGRAM_FILES%\kuwo\kuwomusic\KWMUSIC\Res\DeskLyric\DL_Themes_3a.png
%PROGRAM_FILES%\kuwo\kuwomusic\KWMUSIC\Res\DeskLyric\DL_Themes_3b.png
%PROGRAM_FILES%\kuwo\kuwomusic\KWMUSIC\Res\DeskLyric\DL_Themes_2b.png
%PROGRAM_FILES%\kuwo\kuwomusic\KWMUSIC\Res\DeskLyric\DL_Themes_1b.png
%PROGRAM_FILES%\kuwo\kuwomusic\KWMUSIC\Res\DeskLyric\DL_Themes_2a.png
%PROGRAM_FILES%\kuwo\kuwomusic\KWMUSIC\ModuleData\ModWebUpdate\zip\vipMbox_new.zip
%ALLUSERSPROFILE%\Application Data\kuwodata\kwmusic2013\Res\DeskLyric\DL_Themes_5b.png
%ALLUSERSPROFILE%\Application Data\kuwodata\kwmusic2013\Res\cache\KW_SEARCH_SONG\jay.dat
%ALLUSERSPROFILE%\Application Data\kuwodata\kwmusic2013\Res\DeskLyric\DL_Themes_5a.png
%ALLUSERSPROFILE%\Application Data\kuwodata\kwmusic2013\Res\DeskLyric\DL_Themes_4a.png
%ALLUSERSPROFILE%\Application Data\kuwodata\kwmusic2013\Res\DeskLyric\DL_Themes_4b.png
%PROGRAM_FILES%\kuwo\kuwomusic\KWMUSIC\ModuleData\ModMusicTool\conf.txt
%PROGRAM_FILES%\kuwo\kuwomusic\KWMUSIC\ModuleData\ModWebUpdate\zip\songcomment.zip
%PROGRAM_FILES%\kuwo\kuwomusic\KWMUSIC\ModuleData\ModWebUpdate\zip\userinfo2012.zip
%PROGRAM_FILES%\kuwo\kuwomusic\KWMUSIC\ModuleData\ModWebUpdate\zip\sharesong.zip
%PROGRAM_FILES%\kuwo\kuwomusic\KWMUSIC\ModuleData\ModResource\NetSong-artists.pl
%PROGRAM_FILES%\kuwo\kuwomusic\KWMUSIC\ModuleData\ModWebUpdate\zip\netsong.zip
%PROGRAM_FILES%\kuwo\kuwomusic\bin\skin\serverskin\5\bk.jpg
%PROGRAM_FILES%\kuwo\kuwomusic\bin\skin\base\WallpaperTipWnd.xml
%PROGRAM_FILES%\kuwo\kuwomusic\bin\skin\base\WebPopupDlg.xml
%PROGRAM_FILES%\kuwo\kuwomusic\bin\skin\base\WallpaperPreviewWnd.xml
%PROGRAM_FILES%\kuwo\kuwomusic\bin\skin\base\UserLoginGuide.xml
%PROGRAM_FILES%\kuwo\kuwomusic\bin\skin\base\UserfaceWnd.xml
%PROGRAM_FILES%\kuwo\kuwomusic\bin\skin\base\WpAbmTip_Close.xml
%PROGRAM_FILES%\kuwo\kuwomusic\bin\skin\base\desktopInfoWnd.xml
%PROGRAM_FILES%\kuwo\kuwomusic\bin\skin\base\desktopTip.xml
%PROGRAM_FILES%\kuwo\kuwomusic\bin\skin\base\changeskinwnd.xml
%PROGRAM_FILES%\kuwo\kuwomusic\bin\skin\base\WpAbmTip_Start.xml
%PROGRAM_FILES%\kuwo\kuwomusic\bin\skin\base\changeautoskintimewnd.xml
%PROGRAM_FILES%\kuwo\kuwomusic\bin\skin\base\UserFeedbackDlg.xml
%PROGRAM_FILES%\kuwo\kuwomusic\bin\skin\base\ShutDownSettingDialog.xml
%PROGRAM_FILES%\kuwo\kuwomusic\bin\skin\base\ShutDownTipDialog.xml
%PROGRAM_FILES%\kuwo\kuwomusic\bin\skin\base\SaveLyricDeltaWnd.xml
%PROGRAM_FILES%\kuwo\kuwomusic\bin\skin\base\RemoteUserLoginAfter.xml
%PROGRAM_FILES%\kuwo\kuwomusic\bin\skin\base\RemoteUserLoginBefore.xml
%PROGRAM_FILES%\kuwo\kuwomusic\bin\skin\base\SynExistListTipDlg.xml
%PROGRAM_FILES%\kuwo\kuwomusic\bin\skin\base\UpdateTipDialog.xml
%PROGRAM_FILES%\kuwo\kuwomusic\bin\skin\base\UpdateTipDialogEx.xml
%PROGRAM_FILES%\kuwo\kuwomusic\bin\skin\base\UpLyricDlg.xml
%PROGRAM_FILES%\kuwo\kuwomusic\bin\skin\base\SynLsTipDlg.xml
%PROGRAM_FILES%\kuwo\kuwomusic\bin\skin\base\TipDlg.xml
%PROGRAM_FILES%\kuwo\kuwomusic\bin\skin\base\forcechangeskinwnd.xml
%PROGRAM_FILES%\kuwo\kuwomusic\bin\skin\base\cursor\hand-close.cur
%PROGRAM_FILES%\kuwo\kuwomusic\bin\skin\base\cursor\hand-open.cur
%PROGRAM_FILES%\kuwo\kuwomusic\bin\skin\base\startpage.xml
%PROGRAM_FILES%\kuwo\kuwomusic\bin\skin\base\skin.dat
%PROGRAM_FILES%\kuwo\kuwomusic\bin\skin\base\skin.xml
%PROGRAM_FILES%\kuwo\kuwomusic\bin\skin\serverskin\1\bk.jpg
%PROGRAM_FILES%\kuwo\kuwomusic\bin\skin\serverskin\2\conf.ini
%PROGRAM_FILES%\kuwo\kuwomusic\bin\skin\serverskin\2\small.jpg
%PROGRAM_FILES%\kuwo\kuwomusic\bin\skin\serverskin\2\bk.jpg
%PROGRAM_FILES%\kuwo\kuwomusic\bin\skin\serverskin\1\conf.ini
%PROGRAM_FILES%\kuwo\kuwomusic\bin\skin\serverskin\1\small.jpg
%PROGRAM_FILES%\kuwo\kuwomusic\bin\skin\base\searchtip.xml
%PROGRAM_FILES%\kuwo\kuwomusic\bin\skin\base\logindlg.xml
%PROGRAM_FILES%\kuwo\kuwomusic\bin\skin\base\logindlgex.xml
%PROGRAM_FILES%\kuwo\kuwomusic\bin\skin\base\iconTip.xml
%PROGRAM_FILES%\kuwo\kuwomusic\bin\skin\base\fullplaycontrol.xml
%PROGRAM_FILES%\kuwo\kuwomusic\bin\skin\base\functionwnd.xml
%PROGRAM_FILES%\kuwo\kuwomusic\bin\skin\base\minidlg.xml
%PROGRAM_FILES%\kuwo\kuwomusic\bin\skin\base\nowbg.gif
%PROGRAM_FILES%\kuwo\kuwomusic\bin\skin\base\playlist.gif
%PROGRAM_FILES%\kuwo\kuwomusic\bin\skin\base\mvmodbar.xml
%PROGRAM_FILES%\kuwo\kuwomusic\bin\skin\base\miniplaylist.xml
%PROGRAM_FILES%\kuwo\kuwomusic\bin\skin\base\msgbox.xml
%PROGRAM_FILES%\kuwo\kuwomusic\KWMUSIC\Res\DeskLyric\DL_Themes_4a.png
%TEMP%\netsong\dhj.html
%ALLUSERSPROFILE%\Application Data\kuwodata\kwmusic2013\ModuleData\ModWebUpdate\res\netsong\dhj.html
%ALLUSERSPROFILE%\Application Data\kuwodata\kwmusic2013\ModuleData\ModWebUpdate\res\netsong\css\zone.css
%ALLUSERSPROFILE%\Application Data\kuwodata\kwmusic2013\ModuleData\ModWebUpdate\res\netsong\css\two.css
%TEMP%\netsong\css\zone.css
%TEMP%\netsong\download.html
%TEMP%\netsong\error.html
%ALLUSERSPROFILE%\Application Data\kuwodata\kwmusic2013\ModuleData\ModWebUpdate\res\netsong\error.html
%ALLUSERSPROFILE%\Application Data\kuwodata\kwmusic2013\ModuleData\ModWebUpdate\res\netsong\downloadAD.html
%ALLUSERSPROFILE%\Application Data\kuwodata\kwmusic2013\ModuleData\ModWebUpdate\res\netsong\download.html
%TEMP%\netsong\downloadAD.html
%TEMP%\netsong\css\two.css
%TEMP%\netsong\css\index.css
%ALLUSERSPROFILE%\Application Data\kuwodata\kwmusic2013\ModuleData\ModWebUpdate\res\netsong\css\index.css
%ALLUSERSPROFILE%\Application Data\kuwodata\kwmusic2013\ModuleData\ModWebUpdate\res\netsong\css\download.css
%ALLUSERSPROFILE%\Application Data\kuwodata\kwmusic2013\ModuleData\ModWebUpdate\res\netsong\css\common.css
%TEMP%\netsong\css\download.css
%TEMP%\netsong\css\one.css
%TEMP%\netsong\css\topic.css
%ALLUSERSPROFILE%\Application Data\kuwodata\kwmusic2013\ModuleData\ModWebUpdate\res\netsong\css\topic.css
%ALLUSERSPROFILE%\Application Data\kuwodata\kwmusic2013\ModuleData\ModWebUpdate\res\netsong\css\original.css
%ALLUSERSPROFILE%\Application Data\kuwodata\kwmusic2013\ModuleData\ModWebUpdate\res\netsong\css\one.css
%TEMP%\netsong\css\original.css
%TEMP%\netsong\gedanpage.html
%TEMP%\netsong\img\addgedan.png
%ALLUSERSPROFILE%\Application Data\kuwodata\kwmusic2013\ModuleData\ModWebUpdate\res\netsong\img\addgedan.png
%ALLUSERSPROFILE%\Application Data\kuwodata\kwmusic2013\ModuleData\ModWebUpdate\res\netsong\img\add.png
%ALLUSERSPROFILE%\Application Data\kuwodata\kwmusic2013\ModuleData\ModWebUpdate\res\netsong\img\add.gif
%TEMP%\netsong\img\add.png
%TEMP%\netsong\img\addgedanhov.png
%TEMP%\netsong\img\addlist.png
%ALLUSERSPROFILE%\Application Data\kuwodata\kwmusic2013\ModuleData\ModWebUpdate\res\netsong\img\addlist.png
%ALLUSERSPROFILE%\Application Data\kuwodata\kwmusic2013\ModuleData\ModWebUpdate\res\netsong\img\addH.png
%ALLUSERSPROFILE%\Application Data\kuwodata\kwmusic2013\ModuleData\ModWebUpdate\res\netsong\img\addgedanhov.png
%TEMP%\netsong\img\addH.png
%TEMP%\netsong\img\add.gif
%TEMP%\netsong\img\abg.png
%ALLUSERSPROFILE%\Application Data\kuwodata\kwmusic2013\ModuleData\ModWebUpdate\res\netsong\img\abg.png
%ALLUSERSPROFILE%\Application Data\kuwodata\kwmusic2013\ModuleData\ModWebUpdate\res\netsong\hotzone.html
%ALLUSERSPROFILE%\Application Data\kuwodata\kwmusic2013\ModuleData\ModWebUpdate\res\netsong\gedanpage.html
%TEMP%\netsong\hotzone.html
%TEMP%\netsong\img\abg2.png
%TEMP%\netsong\img\ablue2.png
%ALLUSERSPROFILE%\Application Data\kuwodata\kwmusic2013\ModuleData\ModWebUpdate\res\netsong\img\ablue2.png
%ALLUSERSPROFILE%\Application Data\kuwodata\kwmusic2013\ModuleData\ModWebUpdate\res\netsong\img\ablue.png
%ALLUSERSPROFILE%\Application Data\kuwodata\kwmusic2013\ModuleData\ModWebUpdate\res\netsong\img\abg2.png
%TEMP%\netsong\img\ablue.png
%TEMP%\netsong\css\common.css
%ALLUSERSPROFILE%\Application Data\kuwodata\kwmusic2013\Res\cache\DOWNLOAD_ARTISTPIC\49FF334D.dat
%WINDIR%\KwYlx.dat
%PROGRAM_FILES%\kuwo\kuwomusic\KwMusicSetup.exe
%PROGRAM_FILES%\kuwo\kuwomusic\bin\skin\localskin\1\small.jpg
%ALLUSERSPROFILE%\Application Data\kuwodata\kwmusic2013\Conf\user\config.ini
%PROGRAM_FILES%\kuwo\kuwomusic\bin\mylkx.dat
%ALLUSERSPROFILE%\Start Menu\Programs\їбОТТфАЦ 2014\їбОТТфАЦ 2014.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\їбОТТфАЦ 2014\Р¶ФШїбОТТфАЦ.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\їбОТТфАЦ 2014.lnk
%ALLUSERSPROFILE%\Application Data\kuwodata\kwmusic2013\Conf\p2pconf\setup.xml
%ALLUSERSPROFILE%\Start Menu\їбОТТфАЦ 2014.lnk
%PROGRAM_FILES%\kuwo\kuwomusic\bin\skin\localskin\1\conf.ini
%PROGRAM_FILES%\kuwo\kuwomusic\KWMUSIC\Res\cache\KW_SEARCH_SONG\jay.dat
%PROGRAM_FILES%\kuwo\kuwomusic\bin\plugin\msvcr90.dll
%PROGRAM_FILES%\kuwo\kuwomusic\KWMUSIC\Res\DeskLyric\DL_Themes_5b.png
%PROGRAM_FILES%\kuwo\kuwomusic\KWMUSIC\Res\DeskLyric\DL_Themes_4b.png
%PROGRAM_FILES%\kuwo\kuwomusic\KWMUSIC\Res\DeskLyric\DL_Themes_5a.png
%PROGRAM_FILES%\kuwo\kuwomusic\bin\plugin\msvcp90.dll
%PROGRAM_FILES%\kuwo\kuwomusic\Microsoft.VC90.CRT.manifest
%PROGRAM_FILES%\kuwo\kuwomusic\bin\skin\localskin\1\bk.jpg
%PROGRAM_FILES%\kuwo\kuwomusic\msvcr90.dll
%PROGRAM_FILES%\kuwo\kuwomusic\bin\plugin\Microsoft.VC90.CRT.manifest
%PROGRAM_FILES%\kuwo\kuwomusic\msvcp90.dll
%ALLUSERSPROFILE%\Start Menu\Programs\їбОТТфАЦ 2014\ИнјюЛµГч.lnk
%TEMP%\netsong\artistpage.html
%ALLUSERSPROFILE%\Application Data\kuwodata\kwmusic2013\ModuleData\ModWebUpdate\res\netsong\artistpage.html
%ALLUSERSPROFILE%\Application Data\kuwodata\kwmusic2013\ModuleData\ModWebUpdate\res\netsong\ape.html
%ALLUSERSPROFILE%\Application Data\kuwodata\kwmusic2013\ModuleData\ModWebUpdate\res\netsong\albumpage.html
%TEMP%\netsong\ape.html
%TEMP%\netsong\baiduplayer.html
%TEMP%\netsong\css\base.css
%ALLUSERSPROFILE%\Application Data\kuwodata\kwmusic2013\ModuleData\ModWebUpdate\res\netsong\css\base.css
%ALLUSERSPROFILE%\Application Data\kuwodata\kwmusic2013\ModuleData\ModWebUpdate\res\netsong\bangpage.html
%ALLUSERSPROFILE%\Application Data\kuwodata\kwmusic2013\ModuleData\ModWebUpdate\res\netsong\baiduplayer.html
%TEMP%\netsong\bangpage.html
%TEMP%\netsong\albumpage.html
%TEMP%\KWMUSIC\BindConfig.ini
%TEMP%\nsf3.tmp\Base64.dll
%PROGRAM_FILES%\kuwo\kuwomusic\Uninstall.exe
%ALLUSERSPROFILE%\Desktop\їбОТТфАЦ 2014.lnk
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\їбОТТфАЦ 2014.lnk
%TEMP%\nsf3.tmp\inetc.dll
%ALLUSERSPROFILE%\Application Data\kuwodata\kwmusic2013\ModuleData\ModPlayList\ІҐ·ЕБР±н-БР±нЧй1-Д¬ИПБР±н.pl
%TEMP%\nsv6.tmp\System.dll
%PROGRAM_FILES%\kuwo\kuwomusic\1.txt
%PROGRAM_FILES%\kuwo\kuwomusic\bin\kid.ini
%PROGRAM_FILES%\kuwo\kuwomusic\bin\Log\act.log
%PROGRAM_FILES%\kuwo\kuwomusic\bin\skin\base\RecoTipDialog.xml
%PROGRAM_FILES%\kuwo\kuwomusic\bin\KwWallpaper.exe
%PROGRAM_FILES%\kuwo\kuwomusic\bin\MatroskaSplitter.ax
%PROGRAM_FILES%\kuwo\kuwomusic\bin\KwUpdate.dll
%PROGRAM_FILES%\kuwo\kuwomusic\bin\KwSongCache.dll
%PROGRAM_FILES%\kuwo\kuwomusic\bin\KwTagLib.dll
%PROGRAM_FILES%\kuwo\kuwomusic\bin\MediaInfo.dll
%PROGRAM_FILES%\kuwo\kuwomusic\bin\PlayerCore.dll
%PROGRAM_FILES%\kuwo\kuwomusic\bin\ReconEngine.exe
%PROGRAM_FILES%\kuwo\kuwomusic\bin\MpaDecFilter.ax
%PROGRAM_FILES%\kuwo\kuwomusic\bin\Microsoft.VC90.CRT.manifest
%PROGRAM_FILES%\kuwo\kuwomusic\bin\Module.xml
%PROGRAM_FILES%\kuwo\kuwomusic\bin\KwServiceProxy.dll
%PROGRAM_FILES%\kuwo\kuwomusic\bin\KwModPlaylist.dll
%PROGRAM_FILES%\kuwo\kuwomusic\bin\KwModSkinManage.dll
%PROGRAM_FILES%\kuwo\kuwomusic\bin\KwModLyricShow.dll
%PROGRAM_FILES%\kuwo\kuwomusic\bin\KwModLocalMusic.dll
%PROGRAM_FILES%\kuwo\kuwomusic\bin\KwModLyric.dll
%PROGRAM_FILES%\kuwo\kuwomusic\bin\KwModSynList.dll
%PROGRAM_FILES%\kuwo\kuwomusic\bin\KwRecoSong.dll
%PROGRAM_FILES%\kuwo\kuwomusic\bin\KwService.exe
%PROGRAM_FILES%\kuwo\kuwomusic\bin\KwMusicCore.dll
%PROGRAM_FILES%\kuwo\kuwomusic\bin\KwModUpdateWeb.dll
%PROGRAM_FILES%\kuwo\kuwomusic\bin\KwMusic.exe
%PROGRAM_FILES%\kuwo\kuwomusic\bin\ShellDl.exe
%PROGRAM_FILES%\kuwo\kuwomusic\bin\ccenter.dll
%PROGRAM_FILES%\kuwo\kuwomusic\bin\desk_compositor_x64.dll
%PROGRAM_FILES%\kuwo\kuwomusic\bin\Zlib.dll
%PROGRAM_FILES%\kuwo\kuwomusic\bin\Win7Trait.dll
%PROGRAM_FILES%\kuwo\kuwomusic\bin\WriteMbox.exe
%PROGRAM_FILES%\kuwo\kuwomusic\bin\desk_compositor_x86.dll
%PROGRAM_FILES%\kuwo\kuwomusic\bin\msvcp90.dll
%PROGRAM_FILES%\kuwo\kuwomusic\bin\msvcr90.dll
%PROGRAM_FILES%\kuwo\kuwomusic\bin\lidx.dll
%PROGRAM_FILES%\kuwo\kuwomusic\bin\hanzi_pinyin.dict
%PROGRAM_FILES%\kuwo\kuwomusic\bin\kwAdb.exe
%PROGRAM_FILES%\kuwo\kuwomusic\bin\Vol.dll
%PROGRAM_FILES%\kuwo\kuwomusic\bin\UIDownload.dll
%PROGRAM_FILES%\kuwo\kuwomusic\bin\UIMiniPanel.dll
%PROGRAM_FILES%\kuwo\kuwomusic\bin\UIDeskLyric.dll
%PROGRAM_FILES%\kuwo\kuwomusic\bin\UIAndroidUsbDevice.dll
%PROGRAM_FILES%\kuwo\kuwomusic\bin\UIAvMgr.dll
%PROGRAM_FILES%\kuwo\kuwomusic\bin\UIMusicTree.dll
%PROGRAM_FILES%\kuwo\kuwomusic\bin\UIPopupWnd.dll
%PROGRAM_FILES%\kuwo\kuwomusic\bin\UIVIPMan.dll
%PROGRAM_FILES%\kuwo\kuwomusic\bin\UIPlaylistPanel.dll
%PROGRAM_FILES%\kuwo\kuwomusic\bin\UINowPlaying.dll
%PROGRAM_FILES%\kuwo\kuwomusic\bin\UIPlayControl.dll
%PROGRAM_FILES%\kuwo\kuwomusic\bin\KwModGameEntry.dll
%TEMP%\KWMUSIC\mylk.dat
%PROGRAM_FILES%\kuwo\kuwomusic\KwMusic.exe
%TEMP%\nsf3.tmp\SimpleSC.dll
%TEMP%\nsf3.tmp\instAD\ad04.jpg
%TEMP%\nsf3.tmp\instAD\instAD.dat
%PROGRAM_FILES%\kuwo\kuwomusic\readme.txt
%PROGRAM_FILES%\kuwo\kuwomusic\bin\CWmpPlayer.dll
%PROGRAM_FILES%\kuwo\kuwomusic\bin\CoreAVC0.ax
%PROGRAM_FILES%\kuwo\kuwomusic\bin\CKuwoPlayer.dll
%PROGRAM_FILES%\kuwo\kuwomusic\bin\AdbWinApi.dll
%PROGRAM_FILES%\kuwo\kuwomusic\bin\AdbWinUsbApi.dll
%TEMP%\nsf3.tmp\instAD\ad03.jpg
%TEMP%\nsf3.tmp\nsisSlideshowx.dll
%TEMP%\nsf3.tmp\KillProcDLL.dll
%TEMP%\nsf3.tmp\KwMusicNsis.dll
%TEMP%\nsa2.tmp
%TEMP%\nsf3.tmp\System.dll
%TEMP%\KWMUSIC\DownloadUpdate.ini
%TEMP%\nsf3.tmp\instAD\ad01.jpg
%TEMP%\nsf3.tmp\instAD\ad02.jpg
%TEMP%\nsf3.tmp\w7tbp.dll
%TEMP%\nsf3.tmp\KuWoNsis_new.dll
%TEMP%\KWMUSIC\DownloadUpdate.exe
%PROGRAM_FILES%\kuwo\kuwomusic\bin\DshowPlayer.dll
%PROGRAM_FILES%\kuwo\kuwomusic\bin\KwLib.dll
%PROGRAM_FILES%\kuwo\kuwomusic\bin\KwLnkTipWnd.exe
%PROGRAM_FILES%\kuwo\kuwomusic\bin\KwInfos.exe
%PROGRAM_FILES%\kuwo\kuwomusic\bin\KwHttp.dll
%PROGRAM_FILES%\kuwo\kuwomusic\bin\KwHttpRequestMgr.dll
%PROGRAM_FILES%\kuwo\kuwomusic\bin\KwLog.dll
%PROGRAM_FILES%\kuwo\kuwomusic\bin\KwModConfig.dll
%PROGRAM_FILES%\kuwo\kuwomusic\bin\KwModDownload.dll
%PROGRAM_FILES%\kuwo\kuwomusic\bin\KwModAppStore.dll
%PROGRAM_FILES%\kuwo\kuwomusic\bin\KwMV.dll
%PROGRAM_FILES%\kuwo\kuwomusic\bin\KwModAndroidMgr.dll
%PROGRAM_FILES%\kuwo\kuwomusic\bin\KwDataDef.dll
%PROGRAM_FILES%\kuwo\kuwomusic\bin\IEProxy.dll
%PROGRAM_FILES%\kuwo\kuwomusic\bin\IESandBox.exe
%PROGRAM_FILES%\kuwo\kuwomusic\bin\Encode.exe
%PROGRAM_FILES%\kuwo\kuwomusic\bin\DuiLib.dll
%PROGRAM_FILES%\kuwo\kuwomusic\bin\DumpReport.exe
%PROGRAM_FILES%\kuwo\kuwomusic\bin\KWUpdate.exe
%PROGRAM_FILES%\kuwo\kuwomusic\bin\KwConfig.exe
%PROGRAM_FILES%\kuwo\kuwomusic\bin\KwDPGame.exe
%PROGRAM_FILES%\kuwo\kuwomusic\bin\KuwoSyncMobile.dll
%PROGRAM_FILES%\kuwo\kuwomusic\bin\Kuwo.QuickLaunch.dll
%PROGRAM_FILES%\kuwo\kuwomusic\bin\KuwoDaemon.apk
%PROGRAM_FILES%\kuwo\kuwomusic\bin\pd.dll
%PROGRAM_FILES%\kuwo\kuwomusic\bin\skin\base\KwKickDlg.xml
%PROGRAM_FILES%\kuwo\kuwomusic\bin\skin\base\KwLimitMvDlg.xml
%PROGRAM_FILES%\kuwo\kuwomusic\bin\skin\base\KwEqDlg.xml
%PROGRAM_FILES%\kuwo\kuwomusic\bin\skin\base\KwConfig.xml
%PROGRAM_FILES%\kuwo\kuwomusic\bin\skin\base\KwEmptyWebDlg.xml
%PROGRAM_FILES%\kuwo\kuwomusic\bin\skin\base\KwLimitSongDlg.xml
%PROGRAM_FILES%\kuwo\kuwomusic\bin\skin\base\KwPopupRbWebDlg.xml
%PROGRAM_FILES%\kuwo\kuwomusic\bin\skin\base\KwRestoreBackList.xml
%PROGRAM_FILES%\kuwo\kuwomusic\bin\skin\base\KwMusic.xml
%PROGRAM_FILES%\kuwo\kuwomusic\bin\skin\base\KwLimitVipDlg.xml
%PROGRAM_FILES%\kuwo\kuwomusic\bin\skin\base\KwMinisiteDlg.xml
%PROGRAM_FILES%\kuwo\kuwomusic\bin\skin\base\KwCloudCenterBox.xml
%PROGRAM_FILES%\kuwo\kuwomusic\bin\skin\base\DeskLyricUnlock.xml
%PROGRAM_FILES%\kuwo\kuwomusic\bin\skin\base\DownloadFinishTipDialog.xml
%PROGRAM_FILES%\kuwo\kuwomusic\bin\skin\base\DeskLyric.xml
%PROGRAM_FILES%\kuwo\kuwomusic\bin\skin\base\CopyNotifyDialog.xml
%PROGRAM_FILES%\kuwo\kuwomusic\bin\skin\base\CreateNewList.xml
%PROGRAM_FILES%\kuwo\kuwomusic\bin\skin\base\DownloadSettingDialog.xml
%PROGRAM_FILES%\kuwo\kuwomusic\bin\skin\base\KeywordSafeTip.xml
%PROGRAM_FILES%\kuwo\kuwomusic\bin\skin\base\KwAndroidUsbCopy.xml
%PROGRAM_FILES%\kuwo\kuwomusic\bin\skin\base\FirstPlayApeWnd.xml
%PROGRAM_FILES%\kuwo\kuwomusic\bin\skin\base\EqDlgAttribute.xml
%PROGRAM_FILES%\kuwo\kuwomusic\bin\skin\base\ExitTipDialog.xml
%PROGRAM_FILES%\kuwo\kuwomusic\bin\skin\base\KwTaskbarNotifierDialog.xml
%PROGRAM_FILES%\kuwo\kuwomusic\bin\skin\base\MusicToolDown.xml
%PROGRAM_FILES%\kuwo\kuwomusic\bin\skin\base\MusicTree.xml
%PROGRAM_FILES%\kuwo\kuwomusic\bin\skin\base\MusicTool.xml
%PROGRAM_FILES%\kuwo\kuwomusic\bin\skin\base\MuiscTreeInfoWnd.xml
%PROGRAM_FILES%\kuwo\kuwomusic\bin\skin\base\MultiLoginManager.xml
%PROGRAM_FILES%\kuwo\kuwomusic\bin\skin\base\OpenUploadLocal.xml
%PROGRAM_FILES%\kuwo\kuwomusic\bin\skin\base\PlaylistStyle3.xml
%PROGRAM_FILES%\kuwo\kuwomusic\bin\skin\base\RealEggSmashDlg.xml
%PROGRAM_FILES%\kuwo\kuwomusic\bin\skin\base\PlaylistRootPanel2.xml
%PROGRAM_FILES%\kuwo\kuwomusic\bin\skin\base\PathListDialog.xml
%PROGRAM_FILES%\kuwo\kuwomusic\bin\skin\base\PlaylistRootPanel.xml
%PROGRAM_FILES%\kuwo\kuwomusic\bin\skin\base\ModifyLyricRelationWnd.xml
%PROGRAM_FILES%\kuwo\kuwomusic\bin\skin\base\KwWallpaperNcWnd.xml
%PROGRAM_FILES%\kuwo\kuwomusic\bin\skin\base\KwWallpaperOpWnd.xml
%PROGRAM_FILES%\kuwo\kuwomusic\bin\skin\base\KwVipWebDlg.xml
%PROGRAM_FILES%\kuwo\kuwomusic\bin\skin\base\KwUserKick.xml
%PROGRAM_FILES%\kuwo\kuwomusic\bin\skin\base\KwVipOpenPage.xml
%PROGRAM_FILES%\kuwo\kuwomusic\bin\skin\base\KwWallpaperPlayerWnd.xml
%PROGRAM_FILES%\kuwo\kuwomusic\bin\skin\base\LrcUploadSuccTipDlg.xml
%PROGRAM_FILES%\kuwo\kuwomusic\bin\skin\base\MakeLyricDlg.xml
%PROGRAM_FILES%\kuwo\kuwomusic\bin\skin\base\LrcUploadFailTipDlg.xml
%PROGRAM_FILES%\kuwo\kuwomusic\bin\skin\base\Kwwebpopup.xml
%PROGRAM_FILES%\kuwo\kuwomusic\bin\skin\base\ListBuddyWnd.xml
%PROGRAM_FILES%\kuwo\kuwomusic\bin\skin\base\CloudLoginBallon.xml
%PROGRAM_FILES%\kuwo\kuwomusic\bin\plugin\out_kw_ds.dll
%PROGRAM_FILES%\kuwo\kuwomusic\bin\res\baidu.pl
%PROGRAM_FILES%\kuwo\kuwomusic\bin\plugin\in_mpg123.dll
%PROGRAM_FILES%\kuwo\kuwomusic\bin\plugin\in_ac3.dll
%PROGRAM_FILES%\kuwo\kuwomusic\bin\plugin\in_mp4.dll
%PROGRAM_FILES%\kuwo\kuwomusic\bin\res\casullisten.pl
%PROGRAM_FILES%\kuwo\kuwomusic\bin\res\DeskTipWndRes\EnterBtn.png
%PROGRAM_FILES%\kuwo\kuwomusic\bin\res\MakeLrcWndRes\lrc_finish_icon.png
%PROGRAM_FILES%\kuwo\kuwomusic\bin\res\DeskTipWndRes\CloseBtn.png
%PROGRAM_FILES%\kuwo\kuwomusic\bin\res\tyyykw.wav
%PROGRAM_FILES%\kuwo\kuwomusic\bin\res\DeskTipWndRes\BkImage.png
%PROGRAM_FILES%\kuwo\kuwomusic\bin\plugin\in_APE.dll
%PROGRAM_FILES%\kuwo\kuwomusic\bin\html\gameBoxLoading.htm
%PROGRAM_FILES%\kuwo\kuwomusic\bin\html\kwjserror.html
%PROGRAM_FILES%\kuwo\kuwomusic\bin\Conf\default\config.ini
%PROGRAM_FILES%\kuwo\kuwomusic\bin\runshelldraw_x64.exe
%PROGRAM_FILES%\kuwo\kuwomusic\bin\runshelldraw_x86.exe
%PROGRAM_FILES%\kuwo\kuwomusic\bin\html\loading.gif
%PROGRAM_FILES%\kuwo\kuwomusic\bin\plugin\Eq_Kweq.dll
%PROGRAM_FILES%\kuwo\kuwomusic\bin\plugin\In_Wma.dll
%PROGRAM_FILES%\kuwo\kuwomusic\bin\html\mvloading.swf
%PROGRAM_FILES%\kuwo\kuwomusic\bin\html\minierror.htm
%PROGRAM_FILES%\kuwo\kuwomusic\bin\html\mvloading.html
%PROGRAM_FILES%\kuwo\kuwomusic\bin\res\icons\GameIcon.ico
%PROGRAM_FILES%\kuwo\kuwomusic\bin\res\icons\ogg.ico
%PROGRAM_FILES%\kuwo\kuwomusic\bin\res\icons\tta.ico
%PROGRAM_FILES%\kuwo\kuwomusic\bin\res\icons\mp3.ico
%PROGRAM_FILES%\kuwo\kuwomusic\bin\res\icons\mid.ico
%PROGRAM_FILES%\kuwo\kuwomusic\bin\res\icons\mp1.ico
%PROGRAM_FILES%\kuwo\kuwomusic\bin\res\icons\wav.ico
%PROGRAM_FILES%\kuwo\kuwomusic\bin\skin\base\AutoRunShowTipWnd.xml
%PROGRAM_FILES%\kuwo\kuwomusic\bin\skin\base\BackToOldVer.xml
%PROGRAM_FILES%\kuwo\kuwomusic\bin\skin\base\AutoLoginTip.xml
%PROGRAM_FILES%\kuwo\kuwomusic\bin\res\icons\wma.ico
%PROGRAM_FILES%\kuwo\kuwomusic\bin\skin\base\AlreadDownloadDialog.xml
%PROGRAM_FILES%\kuwo\kuwomusic\bin\res\icons\m4a.ico
%PROGRAM_FILES%\kuwo\kuwomusic\bin\res\icons\aac.ico
%PROGRAM_FILES%\kuwo\kuwomusic\bin\res\icons\ac3.ico
%PROGRAM_FILES%\kuwo\kuwomusic\bin\res\icons\ThumbnailToolbar.bmp
%PROGRAM_FILES%\kuwo\kuwomusic\bin\res\icons\KwDownloadLnk.ico
%PROGRAM_FILES%\kuwo\kuwomusic\bin\res\icons\MP2.ico
%PROGRAM_FILES%\kuwo\kuwomusic\bin\res\icons\ape.ico
%PROGRAM_FILES%\kuwo\kuwomusic\bin\res\icons\flac.ico
%PROGRAM_FILES%\kuwo\kuwomusic\bin\res\icons\lrcx.ico
%PROGRAM_FILES%\kuwo\kuwomusic\bin\res\icons\dks.ico
%PROGRAM_FILES%\kuwo\kuwomusic\bin\res\icons\cda.ico
%PROGRAM_FILES%\kuwo\kuwomusic\bin\res\icons\cue.ico

Удаляет следующие файлы:

%TEMP%\netsong\dhj.html
%TEMP%\netsong\css\zone.css
%TEMP%\netsong\download.html
%TEMP%\netsong\error.html
%TEMP%\netsong\downloadAD.html
%TEMP%\netsong\css\two.css
%TEMP%\netsong\css\index.css
%TEMP%\netsong\css\download.css
%TEMP%\netsong\css\one.css
%TEMP%\netsong\css\topic.css
%TEMP%\netsong\css\original.css
%TEMP%\netsong\gedanpage.html
%TEMP%\netsong\img\addgedan.png
%TEMP%\netsong\img\add.png
%TEMP%\netsong\img\addgedanhov.png
%TEMP%\netsong\img\addlist.png
%TEMP%\netsong\img\addH.png
%TEMP%\netsong\img\add.gif
%TEMP%\netsong\img\abg.png
%TEMP%\netsong\hotzone.html
%TEMP%\netsong\img\abg2.png
%TEMP%\netsong\img\ablue2.png
%TEMP%\netsong\img\ablue.png
%TEMP%\nsf3.tmp\instAD\instAD.dat
%TEMP%\nsf3.tmp\instAD\ad04.jpg
%TEMP%\nsf3.tmp\KillProcDLL.dll
%TEMP%\nsf3.tmp\KwMusicNsis.dll
%TEMP%\nsf3.tmp\KuWoNsis_new.dll
%TEMP%\nsf3.tmp\instAD\ad03.jpg
%TEMP%\nsf3.tmp\Base64.dll
%PROGRAM_FILES%\kuwo\kuwomusic\1.txt
%TEMP%\nsf3.tmp\inetc.dll
%TEMP%\nsf3.tmp\instAD\ad02.jpg
%TEMP%\nsf3.tmp\instAD\ad01.jpg
%TEMP%\nsf3.tmp\nsisSlideshowx.dll
%TEMP%\netsong\baiduplayer.html
%TEMP%\netsong\artistpage.html
%TEMP%\netsong\bangpage.html
%TEMP%\netsong\css\common.css
%TEMP%\netsong\css\base.css
%TEMP%\netsong\ape.html
%TEMP%\nsf3.tmp\System.dll
%TEMP%\nsf3.tmp\SimpleSC.dll
%TEMP%\nsf3.tmp\w7tbp.dll
%TEMP%\netsong\albumpage.html
%TEMP%\nsv6.tmp\System.dll

Перемещает следующие файлы:

%ALLUSERSPROFILE%\Application Data\kuwodata\kwmusic2013\Res\cache\DOWNLOAD_ARTISTPIC\49FF334D.dat в %ALLUSERSPROFILE%\Application Data\kuwodata\kwmusic2013\Res\cache\DOWNLOAD_ARTISTPIC\1A8B2C0C.dat
%ALLUSERSPROFILE%\Application Data\kuwodata\kwmusic2013\Res\cache\KW_SEARCH_SONG\jay.dat в %ALLUSERSPROFILE%\Application Data\kuwodata\kwmusic2013\Res\cache\KW_SEARCH_SONG\74559DAD.dat

Сетевая активность:

Подключается к:

'lo#.kuwo.cn':80

TCP:

Запросы HTTP POST:

lo#.kuwo.cn/music.yl

UDP:

DNS ASK co###g.kuwo.cn
DNS ASK gx##.kuwo.cn
DNS ASK re#.kuwo.cn
DNS ASK uh#.kuwo.cn
DNS ASK de###er.kuwo.cn
DNS ASK lo#.kuwo.cn
DNS ASK up####page.kuwo.cn
DNS ASK to####ic.kuwo.cn

Другое:

Ищет следующие окна:

ClassName: 'kwcoreserviceclass' WindowName: 'kwcoreservice'
ClassName: 'KwWallpaper' WindowName: 'KwWallPaper'
ClassName: 'kwmusicmaindlg' WindowName: ''
ClassName: 'Shell_TrayWnd' WindowName: ''
ClassName: '#32770' WindowName: ''

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней