Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\SystemTime.job
Вредоносные функции:
Создает и запускает на исполнение:
- '%PROGRAM_FILES%\DockBar\menu.exe'
- '%PROGRAM_FILES%\DockBar\dockbar.exe'
- '%PROGRAM_FILES%\DockBar\setup.exe'
Запускает на исполнение:
- '<SYSTEM32>\cmd.exe' /c "%PROGRAM_FILES%\DockBar\dock.bat"
- '<SYSTEM32>\schtasks.exe' /Create /ru system /rp /SC DAILY /TN SystemTime /TR %WINDIR%\task32.bat /ST 20:30:00
- '<SYSTEM32>\regsvr32.exe' /s %WINDIR%/system32/win32ie.dll
- '<SYSTEM32>\attrib.exe' %WINDIR%\task32.bat +r +s +h
- '<SYSTEM32>\regsvr32.exe' /s <SYSTEM32>\win32ie.dll
- '<SYSTEM32>\cmd.exe' /c setup.bat
- '<SYSTEM32>\net1.exe' start schedule
- '<SYSTEM32>\attrib.exe' <SYSTEM32>\win32ie.dll +r +s +h
Изменения в файловой системе:
Создает следующие файлы:
- %PROGRAM_FILES%\DockBar\images\skin1\icon_pictures.png
- %PROGRAM_FILES%\DockBar\images\skin1\icon_music.png
- %PROGRAM_FILES%\DockBar\images\skin1\icon_home.png
- %PROGRAM_FILES%\DockBar\images\skin1\icon_robert.png
- %PROGRAM_FILES%\DockBar\images\skin1\icon_setting.png
- %PROGRAM_FILES%\DockBar\images\skin1\icon_security.png
- %PROGRAM_FILES%\DockBar\images\skin1\icon_rubbish.png
- %PROGRAM_FILES%\DockBar\images\skin1\icon_design.png
- %PROGRAM_FILES%\DockBar\images\skin1\icon_connect.png
- %PROGRAM_FILES%\DockBar\images\skin1\icon_computer.png
- %PROGRAM_FILES%\DockBar\images\skin1\icon_disk.png
- %PROGRAM_FILES%\DockBar\images\skin1\icon_game.png
- %PROGRAM_FILES%\DockBar\images\skin1\icon_film.png
- %PROGRAM_FILES%\DockBar\images\skin1\icon_exit.png
- %PROGRAM_FILES%\DockBar\images\skin1\icon_taobao.png
- %PROGRAM_FILES%\DockBar\setup.bat
- %PROGRAM_FILES%\DockBar\images\skin1\panel_right.png
- %PROGRAM_FILES%\DockBar\images\skin1\panel_middle.png
- %PROGRAM_FILES%\DockBar\setup.exe
- %PROGRAM_FILES%\DockBar\dock.bat
- <SYSTEM32>\win32ie.dll
- %WINDIR%\task32.bat
- %PROGRAM_FILES%\DockBar\images\skin1\icon_wizard.png
- %PROGRAM_FILES%\DockBar\images\skin1\icon_web.png
- %PROGRAM_FILES%\DockBar\images\skin1\icon_theatre.png
- %PROGRAM_FILES%\DockBar\images\skin1\icon_word.png
- %PROGRAM_FILES%\DockBar\images\skin1\panel_left.png
- %PROGRAM_FILES%\DockBar\images\skin1\myie.png
- %PROGRAM_FILES%\DockBar\images\skin1\mycomputer.png
- %PROGRAM_FILES%\DockBar\win32ie.dll
- %PROGRAM_FILES%\DockBar\Tool.exe
- %PROGRAM_FILES%\DockBar\task32.bat
- %PROGRAM_FILES%\DockBar\images\balloon.png
- %PROGRAM_FILES%\DockBar\images\page.bmp
- %PROGRAM_FILES%\DockBar\images\closeup.bmp
- %PROGRAM_FILES%\DockBar\images\close.bmp
- %PROGRAM_FILES%\DockBar\dockbar.ini
- %PROGRAM_FILES%\DockBar\dockbar.exe
- %PROGRAM_FILES%\DockBar\addtask.bat
- %PROGRAM_FILES%\DockBar\flgame.exe
- %PROGRAM_FILES%\DockBar\setup.txt
- %PROGRAM_FILES%\DockBar\MiniDock.exe
- %PROGRAM_FILES%\DockBar\menu.exe
- %PROGRAM_FILES%\DockBar\images\pageup.bmp
- %PROGRAM_FILES%\DockBar\images\skin1\icon_7.png
- %PROGRAM_FILES%\DockBar\images\skin1\icon_6.png
- %PROGRAM_FILES%\DockBar\images\skin1\icon_5.png
- %PROGRAM_FILES%\DockBar\images\skin1\icon_8.png
- %PROGRAM_FILES%\DockBar\images\skin1\icon_baidu.png
- %PROGRAM_FILES%\DockBar\images\skin1\icon_apple.png
- %PROGRAM_FILES%\DockBar\images\skin1\icon_9.png
- %PROGRAM_FILES%\DockBar\images\skin1\icon_10.png
- %PROGRAM_FILES%\DockBar\images\skin1\icon_1.png
- %PROGRAM_FILES%\DockBar\images\skin1\552freeland.png
- %PROGRAM_FILES%\DockBar\images\skin1\icon_11.png
- %PROGRAM_FILES%\DockBar\images\skin1\icon_4.png
- %PROGRAM_FILES%\DockBar\images\skin1\icon_3.png
- %PROGRAM_FILES%\DockBar\images\skin1\icon_12.png
Присваивает атрибут 'скрытый' для следующих файлов:
- %WINDIR%\task32.bat
- <SYSTEM32>\win32ie.dll
Удаляет следующие файлы:
- %PROGRAM_FILES%\DockBar\setup.exe
Сетевая активность:
Подключается к:
- 'do####r.58bbx.com':80
TCP:
Запросы HTTP GET:
- do####r.58bbx.com/builderMenu.action?pa###############################################################################################
UDP:
- DNS ASK do####r.58bbx.com
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'EDIT' WindowName: '(null)'
