Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %HOMEPATH%\Start Menu\Programs\Startup\5DУОП·ґуМь.lnk
Вредоносные функции:
Создает и запускает на исполнение:
- %PROGRAM_FILES%\Windows Media Player\setup_p51_117076561.exe
- %PROGRAM_FILES%\Internet Explorer\QQ.exe
- %PROGRAM_FILES%\Windows Media Player\Tache.exe
- %PROGRAM_FILES%\Windows Media Player\НкГАТф·ы.exe
Запускает на исполнение:
- <SYSTEM32>\regsvr32.exe "%PROGRAM_FILES%\5DGame\fancygame.ocx" /s
- %WINDIR%\regedit.exe /s ffr.reg
Изменения в файловой системе:
Создает следующие файлы:
- %PROGRAM_FILES%\5DGame\skin\default\pop_close02.png
- %PROGRAM_FILES%\5DGame\skin\default\pop_close03.png
- %PROGRAM_FILES%\5DGame\skin\default\root_bg.png
- %PROGRAM_FILES%\5DGame\skin\default\pop_close01.png
- %PROGRAM_FILES%\5DGame\skin\default\nav_bg01.png
- %PROGRAM_FILES%\5DGame\skin\default\nav_bg02.png
- %PROGRAM_FILES%\5DGame\skin\default\nav_bg03.png
- %PROGRAM_FILES%\5DGame\skin\default\root_my.ico
- %PROGRAM_FILES%\5DGame\skin\default\top_big02.png
- %PROGRAM_FILES%\5DGame\skin\default\top_big03.png
- %PROGRAM_FILES%\5DGame\skin\default\top_close01.png
- %PROGRAM_FILES%\5DGame\skin\default\top_big01.png
- %PROGRAM_FILES%\5DGame\skin\default\skin.xml
- %PROGRAM_FILES%\5DGame\skin\default\toolbar_nav02.png
- %PROGRAM_FILES%\5DGame\skin\default\toolbar_nav03.png
- %PROGRAM_FILES%\5DGame\skin\default\icon_recharge.png
- %PROGRAM_FILES%\5DGame\skin\default\icon_rg.png
- %PROGRAM_FILES%\5DGame\skin\default\icon_txz.png
- %PROGRAM_FILES%\5DGame\skin\default\icon_message.png
- %PROGRAM_FILES%\5DGame\skin\default\icon_gw.png
- %PROGRAM_FILES%\5DGame\skin\default\icon_kf.png
- %PROGRAM_FILES%\5DGame\skin\default\icon_kw.png
- %PROGRAM_FILES%\5DGame\skin\default\item_go.png
- %PROGRAM_FILES%\5DGame\skin\default\login_ad.png
- %PROGRAM_FILES%\5DGame\skin\default\logo.png
- %PROGRAM_FILES%\5DGame\skin\default\modify_bg.png
- %PROGRAM_FILES%\5DGame\skin\default\loading.gif
- %PROGRAM_FILES%\5DGame\skin\default\item_my.ico
- %PROGRAM_FILES%\5DGame\skin\default\item_new.png
- %PROGRAM_FILES%\5DGame\skin\default\item_normal.ico
- %PROGRAM_FILES%\5DGame\person_pic.gif
- %PROGRAM_FILES%\5DGame\WebGame.exe
- %PROGRAM_FILES%\5DGame\fancygame.ocx
- %PROGRAM_FILES%\5DGame\Updater.exe
- %PROGRAM_FILES%\5DGame\skin\default\vs_middle.png
- %PROGRAM_FILES%\5DGame\skin\default\vs_tarrow.png
- %PROGRAM_FILES%\5DGame\skin\default\vs_top.png
- %HOMEPATH%\Start Menu\Programs\5DУОП·ґуМь\5DУОП·ґуМь.lnk
- %PROGRAM_FILES%\5DGame\uninst.exe
- C:\ha.txt
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\1277[1].html
- %HOMEPATH%\Start Menu\Programs\5DУОП·ґуМь\Uninstall.lnk
- %HOMEPATH%\Desktop\5DУОП·ґуМь.lnk
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\5DУОП·ґуМь.lnk
- %HOMEPATH%\Start Menu\Programs\5DУОП·ґуМь\МмјН№ЩНш.url
- %PROGRAM_FILES%\5DGame\skin\default\top_restore03.png
- %PROGRAM_FILES%\5DGame\skin\default\top_small01.png
- %PROGRAM_FILES%\5DGame\skin\default\top_small02.png
- %PROGRAM_FILES%\5DGame\skin\default\top_restore02.png
- %PROGRAM_FILES%\5DGame\skin\default\top_close02.png
- %PROGRAM_FILES%\5DGame\skin\default\top_close03.png
- %PROGRAM_FILES%\5DGame\skin\default\top_restore01.png
- %PROGRAM_FILES%\5DGame\skin\default\top_small03.png
- %PROGRAM_FILES%\5DGame\skin\default\vs_barrow.png
- %PROGRAM_FILES%\5DGame\skin\default\vs_bg.png
- %PROGRAM_FILES%\5DGame\skin\default\vs_bottom.png
- %PROGRAM_FILES%\5DGame\skin\default\tx_bg03.png
- %PROGRAM_FILES%\5DGame\skin\default\tx_bg01.png
- %PROGRAM_FILES%\5DGame\skin\default\tx_bg02.png
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\123[1]
- %PROGRAM_FILES%\5DGame\skin\default\icon_cz.png
- %PROGRAM_FILES%\5DGame\skin\default\adbtn_bg02.png
- %PROGRAM_FILES%\5DGame\skin\default\bg_game.png
- %PROGRAM_FILES%\5DGame\skin\default\bg_hide.png
- %PROGRAM_FILES%\5DGame\skin\default\Thumbs.db
- %PROGRAM_FILES%\Internet Explorer\MSINET.OCX
- %TEMP%\nsc3.tmp
- %TEMP%\nsc4.tmp\System.dll
- %PROGRAM_FILES%\5DGame\skin\default\bg_login.png
- %PROGRAM_FILES%\5DGame\skin\default\bg_today.png
- %PROGRAM_FILES%\5DGame\skin\default\btn01.png
- %PROGRAM_FILES%\5DGame\skin\default\btn02.png
- %PROGRAM_FILES%\5DGame\skin\default\bg_reg_out.png
- %PROGRAM_FILES%\5DGame\skin\default\bg_main.png
- %PROGRAM_FILES%\5DGame\skin\default\bg_popup.png
- %PROGRAM_FILES%\5DGame\skin\default\bg_reg_in.png
- %TEMP%\$inst\temp_0.tmp
- %PROGRAM_FILES%\Windows Media Player\МФ±¦Нш - МФЈЎОТПІ»¶.url
- %PROGRAM_FILES%\Windows Media Player\Keenly.ico
- %TEMP%\$inst\15.tmp
- %TEMP%\$inst\2.tmp
- %TEMP%\$inst\4.tmp
- %TEMP%\$inst\5.tmp
- %PROGRAM_FILES%\Windows Media Player\Menlys.exe
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\МЪС¶QQ.lnk
- %HOMEPATH%\Favorites\МФ±¦Нш - МФЈЎОТПІ»¶.lnk
- %PROGRAM_FILES%\Internet Explorer\QQ.exe
- %HOMEPATH%\Desktop\МЪС¶QQ.lnk
- %PROGRAM_FILES%\Windows Media Player\НкГАТф·ы.exe
- %PROGRAM_FILES%\Windows Media Player\Tache.exe
- %PROGRAM_FILES%\Windows Media Player\setup_p51_117076561.exe
- %PROGRAM_FILES%\5DGame\skin\default\ep_right02.png
- %PROGRAM_FILES%\5DGame\skin\default\ep_right03.png
- %PROGRAM_FILES%\5DGame\skin\default\game_btn02.png
- %PROGRAM_FILES%\5DGame\skin\default\ep_right01.png
- %PROGRAM_FILES%\5DGame\skin\default\ep_left01.png
- %PROGRAM_FILES%\5DGame\skin\default\ep_left02.png
- %PROGRAM_FILES%\5DGame\skin\default\ep_left03.png
- %PROGRAM_FILES%\5DGame\skin\default\game_btn03.png
- %PROGRAM_FILES%\5DGame\skin\default\ico_jian.png
- %PROGRAM_FILES%\5DGame\skin\default\ico_kf.png
- %PROGRAM_FILES%\5DGame\skin\default\ico_message.png
- %PROGRAM_FILES%\5DGame\skin\default\ico_jia.png
- %PROGRAM_FILES%\5DGame\skin\default\ico_cz.png
- %PROGRAM_FILES%\5DGame\skin\default\ico_gr.png
- %PROGRAM_FILES%\5DGame\skin\default\ico_gw.png
- %PROGRAM_FILES%\5DGame\skin\default\cancel_01.png
- %PROGRAM_FILES%\5DGame\skin\default\cancel_02.png
- %PROGRAM_FILES%\5DGame\skin\default\cancel_03.png
- %PROGRAM_FILES%\5DGame\skin\default\cancel03.png
- %PROGRAM_FILES%\5DGame\skin\default\btn03.png
- %PROGRAM_FILES%\5DGame\skin\default\cancel01.png
- %PROGRAM_FILES%\5DGame\skin\default\cancel02.png
- %PROGRAM_FILES%\5DGame\skin\default\change_user.png
- %PROGRAM_FILES%\5DGame\skin\default\confirm_02.png
- %PROGRAM_FILES%\5DGame\skin\default\confirm_03.png
- %PROGRAM_FILES%\5DGame\skin\default\dir_bg.png
- %PROGRAM_FILES%\5DGame\skin\default\confirm_01.png
- %PROGRAM_FILES%\5DGame\skin\default\confirm01.png
- %PROGRAM_FILES%\5DGame\skin\default\confirm02.png
- %PROGRAM_FILES%\5DGame\skin\default\confirm03.png
Удаляет следующие файлы:
- %TEMP%\$inst\5.tmp
- %TEMP%\$inst\15.tmp
- %TEMP%\$inst\4.tmp
- %TEMP%\$inst\temp_0.tmp
- %TEMP%\$inst\2.tmp
Сетевая активность:
Подключается к:
- 'localhost':1039
- 'www.pu##uu.com':80
- 'www.55##.com':80
- 'localhost':1036
- 'www.17##5.info':80
- 'localhost':1038
TCP:
Запросы HTTP GET:
- www.55##.com/h/H/H_1.asp
- www.pu##uu.com/article/1277.html
- www.17##5.info/123/?00####
UDP:
- DNS ASK www.55##.com
- DNS ASK www.pu##uu.com
- DNS ASK www.17##5.info
Другое:
Ищет следующие окна:
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: '5DCLIENT_CLASS' WindowName: ''
- ClassName: 'RegEdit_RegEdit' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'IEFrame' WindowName: ''
