Trojan.DownLoader26.7093

Technical Information

To ensure autorun and distribution:

Creates or modifies the following files:

%TEMP%\RarSFX0\config.ini
%ALLUSERSPROFILE%\Application Data\Kingsoft\KIS\kich7\416-e6c18963-5a47f372-31c.ich
%TEMP%\RarSFX0\cfg\hwdect1.dat
%ALLUSERSPROFILE%\Application Data\Kingsoft\KIS\kich7\508-d5118bf9-5a47f365-cb.ich

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\wdcservice] 'ImagePath' = '%TEMP%\RarSFX0\wdcservice.exe'
[<HKLM>\SYSTEM\ControlSet001\Services\wdcservice] 'Start' = '00000002'

Modifies file system:

Creates the following files:

%TEMP%\RarSFX0\support.dll
%TEMP%\RarSFX0\tinyxml.dll
%TEMP%\RarSFX0\uplive.svr
%TEMP%\RarSFX0\readme.txt
%TEMP%\RarSFX0\soundtool.exe
%TEMP%\RarSFX0\sqlite3.dll
%TEMP%\RarSFX0\wdcctrl.dll
%TEMP%\RarSFX0\wdchelper.dll
%TEMP%\RarSFX0\wdcpatchcore.dll
%TEMP%\RarSFX0\wdcbase.dll
%TEMP%\RarSFX0\wdccomponent.dll
%TEMP%\RarSFX0\wdccore.dll
%TEMP%\RarSFX0\pnpsup.dll
%TEMP%\RarSFX0\libcurl.dll
%TEMP%\RarSFX0\License.txt
%TEMP%\RarSFX0\microsoft.vc80.crt.manifest
%TEMP%\RarSFX0\drvinst64.exe
%TEMP%\RarSFX0\duilib.dll
%TEMP%\RarSFX0\kszzdl.dll
%TEMP%\RarSFX0\NetHelper.exe
%TEMP%\RarSFX0\nic.db
%TEMP%\RarSFX0\patchcore.dll
%TEMP%\RarSFX0\microsoft.vc80.mfc.manifest
%TEMP%\RarSFX0\msvcp80.dll
%TEMP%\RarSFX0\msvcr80.dll
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\QBN5IXNJ\desktop.ini
C:\Documents and Settings\NetworkService\Cookies\index.dat
C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\index.dat
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\UQ2UM829\desktop.ini
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\QLMNUZUH\desktop.ini
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\A1EBG5MJ\desktop.ini
%ALLUSERSPROFILE%\Application Data\Kingsoft\KIS\kich7\3-9231918-5a47f344-3c8.ich
%ALLUSERSPROFILE%\Application Data\Kingsoft\KIS\kich7\365-35cffff-5a47f357-34b.ich
%TEMP%\RarSFX0\cfg\hdinfo.ini
%ALLUSERSPROFILE%\Application Data\Kingsoft\KIS\kich7\3-34a3b995-5a47f344-2ee.ich
%TEMP%\RarSFX0\ksoft\KInfocCommon.dat
%ALLUSERSPROFILE%\Application Data\Kingsoft\KIS\kich7\493-c4d67108-5a47f344-3b9.ich
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\index.dat
%TEMP%\RarSFX0\wdcservice.exe
%TEMP%\RarSFX0\wdcupdate.exe
%TEMP%\RarSFX0\wdcver.dll
%TEMP%\RarSFX0\wdcpnp.exe
%TEMP%\RarSFX0\wdcpnpsup.dll
%TEMP%\RarSFX0\wdcres.dll
%ALLUSERSPROFILE%\Application Data\Kingsoft\KIS\kich7\416-a8f0e92a-5a47f32c-119.ich
%ALLUSERSPROFILE%\Application Data\Kingsoft\KIS\kich7\416-d89759b-5a47f32c-222.ich
%TEMP%\RarSFX0\cfg\dectcomp.dat
%TEMP%\RarSFX0\WiseDriverCare.exe
%TEMP%\RarSFX0\zlib.dll
%TEMP%\RarSFX0\cfg\u.ini
%TEMP%\RarSFX0\dgqsc.dll
%TEMP%\RarSFX0\ksoft\kinfoc.dll
%TEMP%\RarSFX0\ksoft\microsoft.vc80.crt.manifest
%TEMP%\RarSFX0\ksoft\microsoft.vc80.mfc.manifest
%TEMP%\RarSFX0\data\systemdrv.dat
%TEMP%\RarSFX0\ksoft\kctrl.dat
%TEMP%\RarSFX0\ksoft\kfmt.dat
%TEMP%\RarSFX0\res\string_BG_BG.xml
%TEMP%\RarSFX0\res\string_CA_ES.xml
%TEMP%\RarSFX0\res\string_CS_CZ.xml
%TEMP%\RarSFX0\ksoft\msvcp80.dll
%TEMP%\RarSFX0\ksoft\msvcr80.dll
%TEMP%\RarSFX0\res\string.xml
%TEMP%\RarSFX0\data\icons\icon9.ico
%TEMP%\RarSFX0\data\icons\icon10+.ico
%TEMP%\RarSFX0\data\icons\icon10.ico
%TEMP%\RarSFX0\data\icons\icon2.ico
%TEMP%\RarSFX0\archnet.url
%TEMP%\RarSFX0\data\EnglishUpdatePao.zip
%TEMP%\RarSFX0\data\icons\icon1.ico
%TEMP%\RarSFX0\data\icons\icon6.ico
%TEMP%\RarSFX0\data\icons\icon7.ico
%TEMP%\RarSFX0\data\icons\icon8.ico
%TEMP%\RarSFX0\data\icons\icon3.ico
%TEMP%\RarSFX0\data\icons\icon4.ico
%TEMP%\RarSFX0\data\icons\icon5.ico
%TEMP%\RarSFX0\res\string_SL_SI.xml
%TEMP%\RarSFX0\res\string_SV_SE.xml
%TEMP%\RarSFX0\res\string_TR_TR.xml
%TEMP%\RarSFX0\res\string_PT_BR.xml
%TEMP%\RarSFX0\res\string_PT_PT.xml
%TEMP%\RarSFX0\res\string_RU_RU.xml
%TEMP%\RarSFX0\7z.exe
%TEMP%\RarSFX0\cactus.dll
%TEMP%\RarSFX0\config.ini
%TEMP%\RarSFX0\res\string_UK_UA.xml
%TEMP%\RarSFX0\res\string_ZH_CN.xml
%TEMP%\RarSFX0\7z.dll
%TEMP%\RarSFX0\res\string_PL_PL.xml
%TEMP%\RarSFX0\res\string_EN_US.xml
%TEMP%\RarSFX0\res\string_ES_ES.xml
%TEMP%\RarSFX0\res\string_FI_FI.xml
%TEMP%\RarSFX0\res\string_DA_DK.xml
%TEMP%\RarSFX0\res\string_DE_DE.xml
%TEMP%\RarSFX0\res\string_EL_GR.xml
%TEMP%\RarSFX0\res\string_JA_JP.xml
%TEMP%\RarSFX0\res\string_KO_KR.xml
%TEMP%\RarSFX0\res\string_NL_NL.xml
%TEMP%\RarSFX0\res\string_FR_FR.xml
%TEMP%\RarSFX0\res\string_HU_HU.xml
%TEMP%\RarSFX0\res\string_IT_IT.xml

Sets the 'hidden' attribute to the following files:

C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\A1EBG5MJ\desktop.ini
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\QBN5IXNJ\desktop.ini
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\UQ2UM829\desktop.ini
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\QLMNUZUH\desktop.ini

Network activity:

Connects to:

'li#######e5.drivergenius.com':80
'wi###leaner.net':80
'li#######e21.drivergenius.com':80

TCP:

HTTP GET requests:

http://www.wi###leaner.net/wisecleaner_feedback/index.php?to################################################################# via wi###leaner.net
http://li#######e21.drivergenius.com/do_not_delete/index.htm

HTTP POST requests: