Техническая информация
Вредоносные функции:
Создает и запускает на исполнение:
- %APPDATA%\360se3\extensions\SafeCentral\urlproc.exe /p:2800
- %APPDATA%\360se3\360se.exe /tp:1 /w:65856 /t:63045632 /r:65760 /m:1 /f:1 /s:0 /mw:65746 /c:"" /tmp:""
Изменения в файловой системе:
Создает следующие файлы:
- %APPDATA%\360se3\Skin\3.0green\tabbutton2.png
- %APPDATA%\360se3\Skin\3.0green\tabbutton.png
- %APPDATA%\360se3\Skin\3.0green\theworld.ico
- %APPDATA%\360se3\Skin\3.0green\tabitem.png
- %APPDATA%\360se3\Skin\3.0green\tabbar.png
- %APPDATA%\360se3\Skin\3.0green\tab_drag.png
- %APPDATA%\360se3\Skin\3.0green\tab_color.png
- %APPDATA%\360se3\Skin\3.0green\tab_progress.png
- %APPDATA%\360se3\Skin\3.0green\tab_new.png
- %APPDATA%\360se3\Skin\3.0green\thumb.png
- %APPDATA%\360se3\Skin\3.0green\titlebarmax.png
- %APPDATA%\360se3\Skin\3.0green\titlebar.png
- %APPDATA%\360se3\Skin\3.0green\tool_playvideo.png
- %APPDATA%\360se3\Skin\3.0green\tool.png
- %APPDATA%\360se3\Skin\3.0green\title_min.png
- %APPDATA%\360se3\Skin\3.0green\title_cus.png
- %APPDATA%\360se3\Skin\3.0green\title_close.png
- %APPDATA%\360se3\Skin\3.0green\title_max2.png
- %APPDATA%\360se3\Skin\3.0green\title_max.png
- %APPDATA%\360se3\Skin\3.0green\sideclose.png
- %APPDATA%\360se3\Skin\3.0green\sidebartoolbg.png
- %APPDATA%\360se3\Skin\3.0green\sidemenu.png
- %APPDATA%\360se3\Skin\3.0green\sidemask.png
- %APPDATA%\360se3\Skin\3.0green\sidebarpanel.png
- %APPDATA%\360se3\Skin\3.0green\sidebarbg.png
- %APPDATA%\360se3\Skin\3.0green\sep.png
- %APPDATA%\360se3\Skin\3.0green\sidebarbtn.png
- %APPDATA%\360se3\Skin\3.0green\sidebarbg2.png
- %APPDATA%\360se3\Skin\3.0green\sidemini.png
- %APPDATA%\360se3\Skin\3.0green\stop.png
- %APPDATA%\360se3\Skin\3.0green\statusitem.png
- %APPDATA%\360se3\Skin\3.0green\tab_close.png
- %APPDATA%\360se3\Skin\3.0green\stop_combine.png
- %APPDATA%\360se3\Skin\3.0green\statusbar.png
- %APPDATA%\360se3\Skin\3.0green\sizestatus.png
- %APPDATA%\360se3\Skin\3.0green\sideols.png
- %APPDATA%\360se3\Skin\3.0green\srcollbar.png
- %APPDATA%\360se3\Skin\3.0green\skin.ini
- %APPDATA%\360se3\Skin\3.0green\tool_playvideo_bg.png
- %APPDATA%\360SE\extensions\ExtAddons\ganzhi.ini
- %TEMP%\tw621B.tmp
- %APPDATA%\360SE\extensions\Favorites\fav_ver.ini
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\fav_ver[1].ini
- %TEMP%\360SE3\extension\Update\update.ini
- %APPDATA%\360SE\extensions\Pluginbar\ver.ini
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\pluginbar_ver[1].ini
- %APPDATA%\360SE\extensions\ExtDownload\extdownload1.ini
- %APPDATA%\360SE\extensions\Pluginbar\stat.ini
- %APPDATA%\360WD\wdch.dat-journal
- %TEMP%\tw7D83.tmp
- %APPDATA%\360SE\data\history.dat
- %TEMP%\tw7DD1.tmp
- %APPDATA%\360SE\data\ico\se.360.cn.ico
- %TEMP%\se716D.tmp
- %APPDATA%\360se3\twcache.ini
- %APPDATA%\360WD\wdch.dat
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\welcome[1].htm
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\finish[1].html
- %APPDATA%\360SE\extensions\ExtYouxi\ver.ini
- %APPDATA%\360SE\data\360sefav.db
- %APPDATA%\360SE\extensions\Favorites\Favorites.ini
- %APPDATA%\360SE\extensions\Favorites\Log\360log_2011_06_03.log
- %APPDATA%\360SE\data\360sefav.db-journal
- %APPDATA%\360se3\Skin\3.0green\toolbar.png
- %APPDATA%\360se3\Skin\3.0green\tool_playvideo_mask.png
- %APPDATA%\360SE\360se_s.ini
- %APPDATA%\360SE\360se.ini
- %APPDATA%\360SE\extensions\Favorites\Favorites2.ini
- %APPDATA%\360SE\extensions\TranslatorPlugin\translate.ini
- %APPDATA%\360SE\extensions\SafeCentral\SafeCentral.ini
- %APPDATA%\360SE\extensions\ExtAddons\ExtStats.ini
- %APPDATA%\360SE\extensions\TranslatorPlugin\stat.ini
- %APPDATA%\360SE\extensions\SafeCentral\urllibauth.dat
- %TEMP%\tw3A9E.tmp
- %APPDATA%\360SE\stat.ini
- %APPDATA%\360safe\upnet.log
- %APPDATA%\360safe\upnet.ini
- %APPDATA%\360se3\extensions\pluginbar\pluginbar.dll
- %APPDATA%\360se3\extensions\onlinefav\onlinefav.dll
- %APPDATA%\360se3\Skin\3.0green\NoTraceBtn_Up.png
- %APPDATA%\360se3\Skin\3.0green\NoTraceBtn_Down.png
- %APPDATA%\360se3\extensions\UICenter\UICenter.dll
- %APPDATA%\360se3\extensions\SnapPlugin\SnapPlugin.dll
- %APPDATA%\360se3\extensions\SafeCentral\urlprocnet.dll
- %APPDATA%\360se3\extensions\TranslatorPlugin\TranslatorPlugin.dll
- %APPDATA%\360se3\extensions\SnapPlugin\screener.exe
- %APPDATA%\360se3\Skin\3.0green\PREVIEW.png
- %APPDATA%\360se3\Skin\3.0green\borderleft.png
- %APPDATA%\360se3\Skin\3.0green\borderbottom.png
- %APPDATA%\360se3\Skin\3.0green\chevron.png
- %APPDATA%\360se3\Skin\3.0green\borderright.png
- %APPDATA%\360se3\Skin\3.0green\bg_toolbar.png
- %APPDATA%\360se3\Skin\3.0green\addressitem.png
- %APPDATA%\360se3\Skin\3.0green\address.png
- %APPDATA%\360se3\Skin\3.0green\bg_pagebar.png
- %APPDATA%\360se3\Skin\3.0green\backward.png
- %APPDATA%\360se3\extensions\ExtAdfilter\ExtAdfilter.dll
- %APPDATA%\360se3\extensions\ExtAddons\ExtAddons.dll
- %APPDATA%\360se3\extensions\ExtIeMode\ExtIeMode.dll
- %APPDATA%\360se3\extensions\ExtDownload\ExtDownload.dll
- %APPDATA%\360se3\sqlite3.dll
- %APPDATA%\360se3\360se.exe
- %TEMP%\nsf2.tmp
- %APPDATA%\360se3\cloudurls.dat
- %APPDATA%\360se3\360SEUP.dll
- %APPDATA%\360se3\extensions\ExtLoginMagic\ExtLoginMagic.dll
- %APPDATA%\360se3\extensions\SafeCentral\urllibauth.dat
- %APPDATA%\360se3\extensions\SafeCentral\SafeCentral.dll
- %APPDATA%\360se3\extensions\SafeCentral\urlproc.exe
- %APPDATA%\360se3\extensions\SafeCentral\urlproc.dll
- %APPDATA%\360se3\extensions\LoginEnrol\LoginEnrol.dll
- %APPDATA%\360se3\extensions\ExtSuggest\ExtSuggest.dll
- %APPDATA%\360se3\extensions\ExtPages\ExtPages.dll
- %APPDATA%\360se3\extensions\Favorites\Favorites.dll
- %APPDATA%\360se3\extensions\ExtUrlQuery\ExtUrlQuery.dll
- %APPDATA%\360se3\Skin\3.0green\dropdown.png
- %APPDATA%\360se3\Skin\3.0green\privacy.png
- %APPDATA%\360se3\Skin\3.0green\new.png
- %APPDATA%\360se3\Skin\3.0green\rebar_grip.png
- %APPDATA%\360se3\Skin\3.0green\rebar.png
- %APPDATA%\360se3\Skin\3.0green\navihistory.png
- %APPDATA%\360se3\Skin\3.0green\menuhilight.png
- %APPDATA%\360se3\Skin\3.0green\mask.png
- %APPDATA%\360se3\Skin\3.0green\menumask.png
- %APPDATA%\360se3\Skin\3.0green\menuicon.png
- %APPDATA%\360se3\Skin\3.0green\refresh.png
- %APPDATA%\360se3\Skin\3.0green\searcharrow.png
- %APPDATA%\360se3\Skin\3.0green\search.png
- %APPDATA%\360se3\Skin\3.0green\select.png
- %APPDATA%\360se3\Skin\3.0green\searchbox.png
- %APPDATA%\360se3\Skin\3.0green\search.ico
- %APPDATA%\360se3\Skin\3.0green\restore.png
- %APPDATA%\360se3\Skin\3.0green\refresh_combine.png
- %APPDATA%\360se3\Skin\3.0green\scrollgauge.png
- %APPDATA%\360se3\Skin\3.0green\scrollbg.png
- %APPDATA%\360se3\Skin\3.0green\fav_root.ico
- %APPDATA%\360se3\Skin\3.0green\fav_net_nologin.ico
- %APPDATA%\360se3\Skin\3.0green\fav_url.ico
- %APPDATA%\360se3\Skin\3.0green\fav_sidebar.ico
- %APPDATA%\360se3\Skin\3.0green\fav_net_login.ico
- %APPDATA%\360se3\Skin\3.0green\fav_add.ico
- %APPDATA%\360se3\Skin\3.0green\edit.png
- %APPDATA%\360se3\Skin\3.0green\fav_directory.ico
- %APPDATA%\360se3\Skin\3.0green\fav_bar.ico
- %APPDATA%\360se3\Skin\3.0green\favorites.png
- %APPDATA%\360se3\Skin\3.0green\img_progress.png
- %APPDATA%\360se3\Skin\3.0green\img_lock.png
- %APPDATA%\360se3\Skin\3.0green\img_sideols.png
- %APPDATA%\360se3\Skin\3.0green\img_progress_good.png
- %APPDATA%\360se3\Skin\3.0green\img_crash.png
- %APPDATA%\360se3\Skin\3.0green\forward.png
- %APPDATA%\360se3\Skin\3.0green\findbaritem.png
- %APPDATA%\360se3\Skin\3.0green\home.png
- %APPDATA%\360se3\Skin\3.0green\go.png
Присваивает атрибут 'скрытый' для следующих файлов:
- %APPDATA%\360se3\twcache.ini
Удаляет следующие файлы:
- %APPDATA%\360WD\wdch.dat-journal
- %TEMP%\tw7D83.tmp
- %TEMP%\tw7DD1.tmp
- %APPDATA%\360SE\extensions\Favorites\fav_ver.ini
- %APPDATA%\360SE\data\360sefav.db-journal
- %TEMP%\tw3A9E.tmp
- %TEMP%\360SE3\extension\Update\update.ini
Сетевая активность:
Подключается к:
- 'qu##.f.360.cn':53
- 'localhost':1047
- 'se.#60.cn':80
- 'se#####e.360safe.com':80
- 'localhost':1037
- 'qu##.f.360.cn':80
- 'se###.#tat.360safe.com':80
TCP:
Запросы HTTP GET:
- se.#60.cn/v3/plugins/translate/finish.html
- se###.#tat.360safe.com/ver.html?na######################################################################
- se.#60.cn/v3/web/welcome.htm?fi######################################################################################################################################################
- se.#60.cn/favicon.ico
- se.#60.cn/update/se/hf.ini
- se#####e.360safe.com/fav_ver.ini
- se###.#tat.360safe.com/opend.htm?ma###################################################
- se###.#tat.360safe.com/ver.html?na##################################################################################################
- se#####e.360safe.com/pluginbar_ver.ini?15####
- se###.#tat.360safe.com/ver.html?na########################################################################
- se###.#tat.360safe.com/ver.html?na#######################################################################################
UDP:
- DNS ASK u.###l.f.360.cn
- DNS ASK se.#60.cn
- DNS ASK wa##.se.360.cn
- DNS ASK qu##.f.360.cn
- DNS ASK se###.#tat.360safe.com
- DNS ASK se#####e.360safe.com
Другое:
Ищет следующие окна:
- ClassName: 'SysListView32' WindowName: ''
- ClassName: 'Internet Explorer_Server' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'XHinter' WindowName: ''
- ClassName: 'Shell DocObject View' WindowName: ''
- ClassName: 'Shell Embedding' WindowName: ''
