Техническая информация
Вредоносные функции:
Создает и запускает на исполнение:
- '%WINDIR%\Temp\TheWorld.exe'
Запускает на исполнение:
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\7ZSfx000.cmd" "
Изменения в файловой системе:
Создает следующие файлы:
- %PROGRAM_FILES%\TheWorld 2.0\ImgCache\MouseGesture_16.bmp
- %PROGRAM_FILES%\TheWorld 2.0\ImgCache\MouseGesture_17.bmp
- %PROGRAM_FILES%\TheWorld 2.0\ImgCache\MouseGesture_18.bmp
- %PROGRAM_FILES%\TheWorld 2.0\ImgCache\MouseGesture_13.bmp
- %PROGRAM_FILES%\TheWorld 2.0\ImgCache\MouseGesture_14.bmp
- %PROGRAM_FILES%\TheWorld 2.0\ImgCache\MouseGesture_15.bmp
- %PROGRAM_FILES%\TheWorld 2.0\ImgCache\MouseGesture_4.bmp
- %PROGRAM_FILES%\TheWorld 2.0\ImgCache\MouseGesture_5.bmp
- %PROGRAM_FILES%\TheWorld 2.0\ImgCache\MouseGesture_6.bmp
- %PROGRAM_FILES%\TheWorld 2.0\ImgCache\MouseGesture_19.bmp
- %PROGRAM_FILES%\TheWorld 2.0\ImgCache\MouseGesture_2.bmp
- %PROGRAM_FILES%\TheWorld 2.0\ImgCache\MouseGesture_3.bmp
- %PROGRAM_FILES%\TheWorld 2.0\skin\冰蓝一夏\tool_search.png
- %PROGRAM_FILES%\TheWorld 2.0\skin\冰蓝一夏\tool_sidebar.png
- %PROGRAM_FILES%\TheWorld 2.0\skin\冰蓝一夏\tool_stop.png
- %PROGRAM_FILES%\TheWorld 2.0\skin\冰蓝一夏\tool_new.png
- %PROGRAM_FILES%\TheWorld 2.0\skin\冰蓝一夏\tool_refresh.png
- %PROGRAM_FILES%\TheWorld 2.0\skin\冰蓝一夏\tool_restore.png
- %PROGRAM_FILES%\TheWorld 2.0\ImgCache\MouseGesture_10.bmp
- %PROGRAM_FILES%\TheWorld 2.0\ImgCache\MouseGesture_11.bmp
- %PROGRAM_FILES%\TheWorld 2.0\ImgCache\MouseGesture_12.bmp
- %PROGRAM_FILES%\TheWorld 2.0\skin\冰蓝一夏\bg_edit.bmp
- %PROGRAM_FILES%\TheWorld 2.0\ImgCache\MouseGesture_0.bmp
- %PROGRAM_FILES%\TheWorld 2.0\ImgCache\MouseGesture_1.bmp
- %PROGRAM_FILES%\TheWorld 2.0\TheWorld.ini
- %PROGRAM_FILES%\TheWorld 2.0\ImgCache\Thumbs.db
- %PROGRAM_FILES%\TheWorld 2.0\skin\冰蓝一夏\Thumbs.db
- %PROGRAM_FILES%\TheWorld 2.0\dailytips.ini
- %PROGRAM_FILES%\TheWorld 2.0\oem.ini
- %PROGRAM_FILES%\TheWorld 2.0\skin\冰蓝一夏\skin.ini
- %PROGRAM_FILES%\TheWorld 2.0\TheWorld.exe
- %PROGRAM_FILES%\TheWorld 2.0\UnInst.exe
- %TEMP%\7ZSfx000.cmd
- %PROGRAM_FILES%\TheWorld 2.0\theworld.ac
- %ALLUSERSPROFILE%\「开始」菜单\程序\世界之窗.lnk
- %ALLUSERSPROFILE%\桌面\世界之窗.lnk
- %PROGRAM_FILES%\TheWorld 2.0\skin\冰蓝一夏\address_url.ico
- %PROGRAM_FILES%\TheWorld 2.0\skin\冰蓝一夏\fav_directory.ico
- %PROGRAM_FILES%\TheWorld 2.0\skin\冰蓝一夏\fav_url.ico
- %PROGRAM_FILES%\TheWorld 2.0\ImgCache\MouseGesture_7.bmp
- %PROGRAM_FILES%\TheWorld 2.0\ImgCache\MouseGesture_8.bmp
- %PROGRAM_FILES%\TheWorld 2.0\ImgCache\MouseGesture_9.bmp
- %PROGRAM_FILES%\TheWorld 2.0\ImgCache\www.2345.com_favicon.ico
- %PROGRAM_FILES%\TheWorld 2.0\ImgCache\www.baidu.com_favicon.ico
- %PROGRAM_FILES%\TheWorld 2.0\ImgCache\www.ioage.com_favicon.ico
- %PROGRAM_FILES%\TheWorld 2.0\skin\冰蓝一夏\Icon_add_Favorite.ico
- %PROGRAM_FILES%\TheWorld 2.0\skin\冰蓝一夏\TheWorlds.ico
- %PROGRAM_FILES%\TheWorld 2.0\ImgCache\www.114la.com_favicon.ico
- %PROGRAM_FILES%\TheWorld 2.0\skin\冰蓝一夏\tool_navihistory.png
- %PROGRAM_FILES%\TheWorld 2.0\skin\冰蓝一夏\btn_title_min.png
- %PROGRAM_FILES%\TheWorld 2.0\skin\冰蓝一夏\chevron.png
- %PROGRAM_FILES%\TheWorld 2.0\skin\冰蓝一夏\il_download.png
- %PROGRAM_FILES%\TheWorld 2.0\skin\冰蓝一夏\btn_sidemode.png
- %PROGRAM_FILES%\TheWorld 2.0\skin\冰蓝一夏\btn_title_close.png
- %PROGRAM_FILES%\TheWorld 2.0\skin\冰蓝一夏\btn_title_max.png
- %PROGRAM_FILES%\TheWorld 2.0\skin\冰蓝一夏\il_sidedefitem.png
- %PROGRAM_FILES%\TheWorld 2.0\skin\冰蓝一夏\il_statusitem.png
- %PROGRAM_FILES%\TheWorld 2.0\skin\冰蓝一夏\img_progress.png
- %PROGRAM_FILES%\TheWorld 2.0\skin\冰蓝一夏\il_menuicon.png
- %PROGRAM_FILES%\TheWorld 2.0\skin\冰蓝一夏\il_searchhistory.png
- %PROGRAM_FILES%\TheWorld 2.0\skin\冰蓝一夏\il_sidebaritem.png
- %PROGRAM_FILES%\TheWorld 2.0\skin\冰蓝一夏\bg_address_safe.png
- %PROGRAM_FILES%\TheWorld 2.0\skin\冰蓝一夏\bg_bottombar.png
- %PROGRAM_FILES%\TheWorld 2.0\skin\冰蓝一夏\bg_combocool.png
- %TEMP%\aut1.tmp
- %WINDIR%\Temp\TheWorld.exe
- %PROGRAM_FILES%\TheWorld 2.0\skin\冰蓝一夏\bg_address.png
- %PROGRAM_FILES%\TheWorld 2.0\skin\冰蓝一夏\btn_select.png
- %PROGRAM_FILES%\TheWorld 2.0\skin\冰蓝一夏\btn_sideclose.png
- %PROGRAM_FILES%\TheWorld 2.0\skin\冰蓝一夏\btn_sidemenu.png
- %PROGRAM_FILES%\TheWorld 2.0\skin\冰蓝一夏\bg_topbar.png
- %PROGRAM_FILES%\TheWorld 2.0\skin\冰蓝一夏\btn_dropdown.png
- %PROGRAM_FILES%\TheWorld 2.0\skin\冰蓝一夏\btn_mask.png
- %PROGRAM_FILES%\TheWorld 2.0\skin\冰蓝一夏\tab_close.png
- %PROGRAM_FILES%\TheWorld 2.0\skin\冰蓝一夏\tab_item.png
- %PROGRAM_FILES%\TheWorld 2.0\skin\冰蓝一夏\tab_itemb.png
- %PROGRAM_FILES%\TheWorld 2.0\skin\冰蓝一夏\tab_btnnew.png
- %PROGRAM_FILES%\TheWorld 2.0\skin\冰蓝一夏\tab_btnnewb.png
- %PROGRAM_FILES%\TheWorld 2.0\skin\冰蓝一夏\tab_btnright.png
- %PROGRAM_FILES%\TheWorld 2.0\skin\冰蓝一夏\tool_forward.png
- %PROGRAM_FILES%\TheWorld 2.0\skin\冰蓝一夏\tool_go.png
- %PROGRAM_FILES%\TheWorld 2.0\skin\冰蓝一夏\tool_home.png
- %PROGRAM_FILES%\TheWorld 2.0\skin\冰蓝一夏\tab_progress.png
- %PROGRAM_FILES%\TheWorld 2.0\skin\冰蓝一夏\thumb.png
- %PROGRAM_FILES%\TheWorld 2.0\skin\冰蓝一夏\tool_backward.png
- %PROGRAM_FILES%\TheWorld 2.0\skin\冰蓝一夏\minitoolbar.png
- %PROGRAM_FILES%\TheWorld 2.0\skin\冰蓝一夏\Preview.png
- %PROGRAM_FILES%\TheWorld 2.0\skin\冰蓝一夏\size_status.png
- %PROGRAM_FILES%\TheWorld 2.0\skin\冰蓝一夏\IMG_SIDEBAND.png
- %PROGRAM_FILES%\TheWorld 2.0\skin\冰蓝一夏\img_sideols.png
- %PROGRAM_FILES%\TheWorld 2.0\skin\冰蓝一夏\menu_bg.png
- %PROGRAM_FILES%\TheWorld 2.0\skin\冰蓝一夏\tab_btnclose.png
- %PROGRAM_FILES%\TheWorld 2.0\skin\冰蓝一夏\tab_btnleft.png
- %PROGRAM_FILES%\TheWorld 2.0\skin\冰蓝一夏\tab_btnlist.png
- %PROGRAM_FILES%\TheWorld 2.0\skin\冰蓝一夏\tab_bg.png
- %PROGRAM_FILES%\TheWorld 2.0\skin\冰蓝一夏\tab_bg2.png
- %PROGRAM_FILES%\TheWorld 2.0\skin\冰蓝一夏\tab_bgb.png
Присваивает атрибут 'скрытый' для следующих файлов:
- %PROGRAM_FILES%\TheWorld 2.0\theworld.ac
Удаляет следующие файлы:
- %TEMP%\7ZSfx000.cmd
- %WINDIR%\Temp\TheWorld.exe
- %TEMP%\aut1.tmp
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
