Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Classes\CLSID\{3FA4FB86-E43A-11D4-B3DD-00E006E25C0B}\Shell\open\Command] '' = '%PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE www.4444.la'
- [<HKLM>\SOFTWARE\Classes\CLSID\{3FA4FB86-E43A-11D4-B3DD-00E006E25C0C}\Shell\open\Command] '' = '%PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE http://www.236.la'
- [<HKLM>\SOFTWARE\Classes\CLSID\{3FA4FB86-E43A-11D4-B3DD-00E006E25C0D}\Shell\open\Command] '' = '%PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE http://dy.4444.la'
Вредоносные функции:
Создает и запускает на исполнение:
- C:\sepvod.exe
- C:\svchose.exe
Запускает на исполнение:
- %PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE http://www.67#9.hk/tongji/Count.asp
Изменяет следующие настройки проводника Windows (Windows Explorer):
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoInternetIcon' = '00000001'
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\Temporary Internet Files\Content.IE5\W56FK9QZ\desktop.ini
- %TEMP%\Temporary Internet Files\Content.IE5\U76PW9OD\desktop.ini
- %TEMP%\History\History.IE5\desktop.ini
- %TEMP%\Temporary Internet Files\Content.IE5\M9B5H2EG\Count[1].asp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\Count[1].asp
- %TEMP%\Temporary Internet Files\Content.IE5\D0JK3VXF\desktop.ini
- C:\sepvod.exe
- C:\svchose.exe
- %TEMP%\Temporary Internet Files\Content.IE5\M9B5H2EG\desktop.ini
- %TEMP%\Temporary Internet Files\Content.IE5\desktop.ini
Присваивает атрибут 'скрытый' для следующих файлов:
- %TEMP%\Temporary Internet Files\Content.IE5\U76PW9OD\desktop.ini
- %TEMP%\Temporary Internet Files\Content.IE5\W56FK9QZ\desktop.ini
- %TEMP%\History\History.IE5\desktop.ini
- %TEMP%\Temporary Internet Files\Content.IE5\desktop.ini
- %TEMP%\Temporary Internet Files\Content.IE5\M9B5H2EG\desktop.ini
- %TEMP%\Temporary Internet Files\Content.IE5\D0JK3VXF\desktop.ini
Удаляет следующие файлы:
- %TEMP%\~DFE6D5.tmp
- %TEMP%\Temporary Internet Files\Content.IE5\M9B5H2EG\Count[1].asp
- %TEMP%\~DFF094.tmp
Сетевая активность:
Подключается к:
- 'www.67#9.hk':80
- 'localhost':1037
- 'localhost':1036
TCP:
Запросы HTTP GET:
- www.67#9.hk/tongji/Count.asp
UDP:
- DNS ASK www.67#9.hk
Другое:
Ищет следующие окна:
- ClassName: '' WindowName: '????,???? - ???? 3.0'
- ClassName: '' WindowName: '??? - ???? 3.0'
- ClassName: '' WindowName: 'Google - 360????? 3.12 ???'
- ClassName: '' WindowName: '265???? - ???????????? - ???? 3.0'
- ClassName: '' WindowName: 'hao123--?????? - ???? 3.0'
- ClassName: '' WindowName: 'Google - ???? 3.0'
- ClassName: '' WindowName: '360????-?????????,?????360?? - 360????? 3.12 ???'
- ClassName: '' WindowName: '??? - 360????? 3.0 ???'
- ClassName: '' WindowName: '2345????-???????? - ??(Maxthon) 2.5.11'
- ClassName: '' WindowName: '????,???? - 360????? 3.12 ???'
- ClassName: '' WindowName: 'hao123--?????? - 360????? 3.12 ???'
- ClassName: '' WindowName: '360????-?????????,?????360?? - 360????? 3.1 ???'
- ClassName: '' WindowName: '???????'
- ClassName: '' WindowName: '360?????'
- ClassName: '' WindowName: '114?????[Www.114La.Com]_????????_????114?! - ?????'
- ClassName: '' WindowName: '????'
- ClassName: '' WindowName: '????????'
- ClassName: '' WindowName: '??'
- ClassName: '' WindowName: '????,???? - ?????'
- ClassName: '' WindowName: 'about:blank - ?????'
- ClassName: '' WindowName: '114?????[Www.114La.Com]_????????_????114?! - ???? 3.0'
- ClassName: '' WindowName: '265???? - ?????'
- ClassName: '' WindowName: 'hao123--?????'
- ClassName: '' WindowName: 'Google - ?????'
- ClassName: '' WindowName: '?????? - ??(Maxthon) 2.5.11'
- ClassName: '' WindowName: 'about:blank - Microsoft Internet Explorer'
- ClassName: 'Progman' WindowName: 'Program Manager'
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: '' WindowName: 'hao123--?????? - Microsoft Internet Explorer'
- ClassName: '' WindowName: 'Google - Microsoft Internet Explorer'
- ClassName: '' WindowName: '????,???? - Microsoft Internet Explorer'
- ClassName: 'SysListView32' WindowName: '??'
- ClassName: '#32770' WindowName: ''
- ClassName: '' WindowName: 'Windows ?????'
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: '' WindowName: '????,???? - ??(Maxthon) 2.5.11'
- ClassName: '' WindowName: 'hao123--?????? - ??(Maxthon) 2.5.11'
- ClassName: '' WindowName: '??1616???? ?????? ?????? - ??(Maxthon) 2.5.11'
- ClassName: '' WindowName: '265???? - ???????????? - ??(Maxthon) 2.5.11'
- ClassName: '' WindowName: 'Google - ??(Maxthon) 2.5.11'
- ClassName: '' WindowName: '114?????[Www.114La.Com]_????????_????114?! - ??(Maxthon) 2.5.11'
- ClassName: '' WindowName: '2345????-???????? - Microsoft Internet Explorer'
- ClassName: '' WindowName: '114?????[Www.114La.Com]_????????_????114?! - Microsoft Internet Explorer'
- ClassName: '' WindowName: '265???? - ???????????? - Microsoft Internet Explorer'
- ClassName: '' WindowName: 'Maxthon - ????? - ??(Maxthon) 2.5.11'
- ClassName: '' WindowName: '?????? - Microsoft Internet Explorer'
- ClassName: '' WindowName: '1616????_1616????_??????? - Microsoft Internet Explorer'
