Trojan.Click2.54786

Техническая информация

Для обеспечения автозапуска и распространения:

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\Kingsoft Antivirus WebShield Service] 'Start' = '00000002'

Вредоносные функции:

Создает и запускает на исполнение:

%ALLUSERSPROFILE%\Application Data\smes\smes.exe -install
%ALLUSERSPROFILE%\Application Data\smes\smes.exe -start
%ALLUSERSPROFILE%\Application Data\smes\smes.exe
%PROGRAM_FILES%\soft092801\setup_0901.exe
%PROGRAM_FILES%\soft092801\w_0901.exe
%PROGRAM_FILES%\soft092801\setup_0901.exe (загружен из сети Интернет)

Запускает на исполнение:

<SYSTEM32>\ntvdm.exe -f -i1
<SYSTEM32>\wscript.exe "%PROGRAM_FILES%\soft092801\b_0901.vbe"
%PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE http://www.ad##ma.cn/g/
%WINDIR%\sleep.exe 500

Изменения в файловой системе:

Создает следующие файлы:

%PROGRAM_FILES%\soft092801\C_0120110103010116280109010101.txt
%PROGRAM_FILES%\soft092801\0120110103010116280109010101.txt
%PROGRAM_FILES%\soft092801\B_0120110103010116280109010101.txt
%TEMP%\nsp2.tmp\NSISdl.dll
%TEMP%\nsx4.tmp\FindProcDLL.dll
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\g[1]
%PROGRAM_FILES%\soft092801\setup_0901.exe
%PROGRAM_FILES%\soft092801\w_0901.exe
%PROGRAM_FILES%\FlashC\tabs\tabs.ini
%PROGRAM_FILES%\FlashC\tabs\Thumbs.db
%PROGRAM_FILES%\FlashC\tabs\TabbaseT.bmp
%ALLUSERSPROFILE%\Desktop\ Internot Explarer .lnk
%PROGRAM_FILES%\soft092801\smes.exe
%PROGRAM_FILES%\soft092801\a
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\ Internot Explarer .lnk
%ALLUSERSPROFILE%\Application Data\smes\kswbc.dll
%TEMP%\temg_tmp.bat
%TEMP%\nsx4.tmp\AccessControl.dll
%ALLUSERSPROFILE%\Application Data\kingsoft\kws\spot.ini
%ALLUSERSPROFILE%\Application Data\smes\KWSSVC.log
%WINDIR%\Temp\scs6.tmp
%WINDIR%\Temp\scs5.tmp
%PROGRAM_FILES%\soft092801\s_0901.exe
%ALLUSERSPROFILE%\Application Data\kingsoft\kws\spitesp.dat
%ALLUSERSPROFILE%\Application Data\smes\kwsui.dll
%ALLUSERSPROFILE%\Application Data\smes\kwssp.dll
%ALLUSERSPROFILE%\Application Data\smes\kswebshield.dll
%ALLUSERSPROFILE%\Application Data\smes\smes.exe
%ALLUSERSPROFILE%\Application Data\kingsoft\kws\kws.ini
%ALLUSERSPROFILE%\Application Data\smes\a
%ALLUSERSPROFILE%\Application Data\smes\u.bat
%PROGRAM_FILES%\FlashC\tabs\TabbaseB.bmp
%PROGRAM_FILES%\FlashC\inc\msg.jpg
%PROGRAM_FILES%\FlashC\inc\cls.jpg
%PROGRAM_FILES%\FlashC\inc\Thumbs.db
%PROGRAM_FILES%\FlashC\inc\nocls.jpg
%PROGRAM_FILES%\FlashC\search\searchs.ini
%PROGRAM_FILES%\FlashC\search\mul.ini
%PROGRAM_FILES%\FlashC\inc\nomsg.jpg
%PROGRAM_FILES%\FlashC\inc\Progress.bmp
%PROGRAM_FILES%\FlashC\FlashC.exe
%PROGRAM_FILES%\FlashC\CrCom.dll
%PROGRAM_FILES%\FlashC\Config.dat
%PROGRAM_FILES%\FlashC\LCmnCtrl32.dll
%PROGRAM_FILES%\FlashC\inc\NoHide.gif
%PROGRAM_FILES%\FlashC\inc\Hide.gif
%PROGRAM_FILES%\FlashC\lexplorer.ini
%PROGRAM_FILES%\FlashC\Plugin\GetWebSnap\GetWebSnap.dll
%PROGRAM_FILES%\FlashC\tabs\TabActive_L.bmp
%PROGRAM_FILES%\FlashC\tabs\TabActive_C.bmp
%PROGRAM_FILES%\FlashC\tabs\tabsDown\tabs.ini
%PROGRAM_FILES%\FlashC\tabs\TabActive_R.bmp
%PROGRAM_FILES%\FlashC\tabs\TabNormal_R.bmp
%PROGRAM_FILES%\FlashC\tabs\TabNormal_L.bmp
%PROGRAM_FILES%\FlashC\tabs\TabNormal_C.bmp
%PROGRAM_FILES%\FlashC\tabs\tabsDown\Thumbs.db
%PROGRAM_FILES%\FlashC\tabs\tabsDown\TabActive_L.bmp
%PROGRAM_FILES%\FlashC\tabs\tabsDown\TabActive_C.bmp
%PROGRAM_FILES%\FlashC\Plugin\GetWebSnap\GetWebSnap.ini
%PROGRAM_FILES%\FlashC\tabs\tabsDown\TabActive_R.bmp
%PROGRAM_FILES%\FlashC\tabs\tabsDown\TabNormal_R.bmp
%PROGRAM_FILES%\FlashC\tabs\tabsDown\TabNormal_L.bmp
%PROGRAM_FILES%\FlashC\tabs\tabsDown\TabNormal_C.bmp

Удаляет следующие файлы:

%WINDIR%\Temp\scs5.tmp
%WINDIR%\Temp\scs6.tmp
%TEMP%\nsx4.tmp\AccessControl.dll
%TEMP%\nsx4.tmp\FindProcDLL.dll

Перемещает следующие файлы:

%PROGRAM_FILES%\soft092801\0120110103010116280109010101.txt в %PROGRAM_FILES%\soft092801\b_0901.vbe
%PROGRAM_FILES%\soft092801\C_0120110103010116280109010101.txt в %PROGRAM_FILES%\soft092801\C_0901.vbe
%PROGRAM_FILES%\soft092801\B_0120110103010116280109010101.txt в %PROGRAM_FILES%\soft092801\B.bat
%PROGRAM_FILES%\soft092801\a в %PROGRAM_FILES%\soft092801\092801.txt
%PROGRAM_FILES%\soft092801\smes.exe в %PROGRAM_FILES%\soft092801\w_0901.exe

Сетевая активность:

Подключается к: