Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Classes\KmMediaPlayer\shell\open\command] '' = '"%PROGRAM_FILES%\pipi\PIPIPlayer.exe" "%L"'
- [<HKCU>\Control Panel\Desktop] 'SCRNSAVE.EXE' = '%PROGRAM_FILES%\Coopen\Coopen.scr'
Создает или изменяет следующие файлы:
- %HOMEPATH%\Start Menu\Programs\Startup\CoopenІҐ·ЕЖч.lnk
Вредоносные функции:
Создает и запускает на исполнение:
- '%TEMP%\is-2GQMG.tmp\pipi_setup_476.tmp' /SL5="$100E6,5624161,71168,%PROGRAM_FILES%\winrar32\pipi_setup_476.exe" /verysilent
- '%PROGRAM_FILES%\pipi\PIPIPlayer.exe'
- '%WINDIR%\system\SVCHOST.EXE' <SYSTEM32>\smss.exe:1998166001.jse
- '%PROGRAM_FILES%\winrar32\pipi_setup_476.exe' /verysilent
- '%PROGRAM_FILES%\winrar32\coopen_setup_100180.exe'
- '%PROGRAM_FILES%\winrar32\pipi_dae_476.exe'
- '%PROGRAM_FILES%\winrar32\bibibei19.exe'
Запускает на исполнение:
- '<SYSTEM32>\regsvr32.exe' /s "%PROGRAM_FILES%\pipi\JfCheck.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%PROGRAM_FILES%\pipi\MCCKMPlayerX.dll"
- '<SYSTEM32>\wscript.exe' "%PROGRAM_FILES%\winrar32\154401171.jse"
- '<SYSTEM32>\regsvr32.exe' /s "%PROGRAM_FILES%\±И±ИЯВ\bibibei.dll"
Изменения в файловой системе:
Создает следующие файлы:
- %PROGRAM_FILES%\pipi\codec\is-OU18E.tmp
- %PROGRAM_FILES%\pipi\codec\is-P8VNL.tmp
- %PROGRAM_FILES%\pipi\codec\rm\is-R5VDL.tmp
- %PROGRAM_FILES%\pipi\codec\rm\is-T0VUE.tmp
- %PROGRAM_FILES%\pipi\codec\rm\is-M0ETT.tmp
- %PROGRAM_FILES%\pipi\codec\is-6TBH5.tmp
- %PROGRAM_FILES%\pipi\is-Q6F6T.tmp
- %PROGRAM_FILES%\pipi\is-8PNN1.tmp
- %PROGRAM_FILES%\pipi\is-J93DE.tmp
- %PROGRAM_FILES%\pipi\is-UERGG.tmp
- %PROGRAM_FILES%\pipi\is-54A2D.tmp
- %PROGRAM_FILES%\pipi\codec\rm\is-B7EDC.tmp
- %PROGRAM_FILES%\pipi\codec\rm\is-8816S.tmp
- %PROGRAM_FILES%\pipi\codec\rm\is-TE3OO.tmp
- %PROGRAM_FILES%\pipi\codec\rm\is-12Q2Q.tmp
- %PROGRAM_FILES%\pipi\codec\rm\is-Q2RPO.tmp
- %PROGRAM_FILES%\pipi\codec\rm\is-Q3QOO.tmp
- %PROGRAM_FILES%\pipi\codec\rm\is-9D99V.tmp
- %PROGRAM_FILES%\pipi\codec\rm\is-QTKEU.tmp
- %PROGRAM_FILES%\pipi\codec\rm\is-JETL8.tmp
- %PROGRAM_FILES%\pipi\codec\rm\is-OG3AI.tmp
- %PROGRAM_FILES%\pipi\codec\rm\is-GNK22.tmp
- %PROGRAM_FILES%\pipi\codec\rm\is-HS5SU.tmp
- %PROGRAM_FILES%\pipi\is-F3RJH.tmp
- %PROGRAM_FILES%\pipi\is-44PGC.tmp
- %PROGRAM_FILES%\pipi\is-LHTCR.tmp
- %PROGRAM_FILES%\pipi\is-A8CB9.tmp
- %PROGRAM_FILES%\pipi\is-65RFD.tmp
- %PROGRAM_FILES%\pipi\is-U5I03.tmp
- %PROGRAM_FILES%\pipi\is-479K6.tmp
- %PROGRAM_FILES%\pipi\is-ADIK9.tmp
- %PROGRAM_FILES%\pipi\is-328A4.tmp
- %PROGRAM_FILES%\pipi\is-396MB.tmp
- %PROGRAM_FILES%\pipi\is-1VQR3.tmp
- %PROGRAM_FILES%\pipi\is-7PLCU.tmp
- %PROGRAM_FILES%\pipi\is-CUL06.tmp
- %PROGRAM_FILES%\pipi\is-GPHO1.tmp
- %PROGRAM_FILES%\pipi\is-K9QFP.tmp
- %PROGRAM_FILES%\pipi\is-NR7EI.tmp
- %PROGRAM_FILES%\pipi\is-6P0B2.tmp
- %PROGRAM_FILES%\pipi\is-OO31E.tmp
- %PROGRAM_FILES%\pipi\is-0P66V.tmp
- %PROGRAM_FILES%\pipi\is-0D01P.tmp
- %PROGRAM_FILES%\pipi\is-QRF9D.tmp
- %PROGRAM_FILES%\pipi\is-NTUEP.tmp
- %PROGRAM_FILES%\pipi\is-NVLO8.tmp
- %PROGRAM_FILES%\pipi\is-ACJG5.tmp
- %PROGRAM_FILES%\pipi\codec\rm\is-CQSUV.tmp
- %WINDIR%\explorer.exe:1998166001.jse
- %PROGRAM_FILES%\pipi\config\partner.ini
- <SYSTEM32>\smss.exe:1998166001.jse
- %PROGRAM_FILES%\pipi\config\skin.ini
- %TEMP%\jfcheck.conf.new
- %PROGRAM_FILES%\pipi\unins000.dat
- %ALLUSERSPROFILE%\Start Menu\Programs\PIPI\Uninstall PIPI.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\PIPI\88488 Web Directory.lnk
- %HOMEPATH%\Desktop\PIPI Player.lnk
- %PROGRAM_FILES%\pipi\jfCacheMgr.url
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\PIPI Player.lnk
- <SYSTEM32>\pncrt.dll
- %PROGRAM_FILES%\pipi\config\mcckmplayervod.ini
- %HOMEPATH%\Templates\==玩小游戏==2.bak
- %PROGRAM_FILES%\pipi\config\player.stat
- <SYSTEM32>\config\mcckmplayervod.ini
- %PROGRAM_FILES%\pipi\config\pfplayertemp.ini
- %PROGRAM_FILES%\pipi\config\config.ini
- %HOMEPATH%\Templates\==网址导航==2.bak
- %HOMEPATH%\Templates\==网址导航==.bak
- %HOMEPATH%\Templates\==淘宝购物==.bak
- %HOMEPATH%\Templates\==玩小游戏==.bak
- %HOMEPATH%\Templates\==淘宝购物==2.bak
- %ALLUSERSPROFILE%\Start Menu\Programs\PIPI\FAQ on the web.lnk
- %PROGRAM_FILES%\pipi\config\is-T0BSI.tmp
- %PROGRAM_FILES%\pipi\config\is-4U3R9.tmp
- %PROGRAM_FILES%\pipi\config\is-OF2SA.tmp
- %PROGRAM_FILES%\pipi\config\is-3R219.tmp
- %PROGRAM_FILES%\pipi\config\is-DB7P9.tmp
- %PROGRAM_FILES%\pipi\config\is-02TCL.tmp
- %PROGRAM_FILES%\pipi\codec\rm\is-R4493.tmp
- %PROGRAM_FILES%\pipi\codec\rm\is-9BMQ9.tmp
- %PROGRAM_FILES%\pipi\config\is-Q2CIB.tmp
- %PROGRAM_FILES%\pipi\config\is-N6MV6.tmp
- %PROGRAM_FILES%\pipi\config\is-BLMSU.tmp
- %PROGRAM_FILES%\pipi\config\is-7OLTJ.tmp
- %ALLUSERSPROFILE%\Start Menu\Programs\PIPI\Media File Association.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\PIPI\PIPI Player.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\PIPI\PIPI WebPlayer.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\PIPI\PIPI on the web.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\PIPI\Online Shopping.lnk
- %PROGRAM_FILES%\pipi\Plugins\is-9LTOH.tmp
- %PROGRAM_FILES%\pipi\config\is-1JT8K.tmp
- %PROGRAM_FILES%\pipi\config\is-5HKGC.tmp
- %PROGRAM_FILES%\pipi\config\is-VT054.tmp
- %PROGRAM_FILES%\pipi\Plugins\is-K4DE5.tmp
- %PROGRAM_FILES%\pipi\Plugins\is-VAA3O.tmp
- %PROGRAM_FILES%\pipi\is-5OG64.tmp
- %PROGRAM_FILES%\Coopen\Resource\SkinFormal\CheckU.png
- %PROGRAM_FILES%\Coopen\Resource\SkinFormal\CheckC.png
- %PROGRAM_FILES%\Coopen\Resource\SkinFormal\Indicator1.png
- %PROGRAM_FILES%\Coopen\Resource\SkinFormal\MainIcon.png
- %PROGRAM_FILES%\Coopen\Resource\SkinFormal\Indicator2.png
- %PROGRAM_FILES%\Coopen\Resource\SkinFormal\Button_Widget.png
- %PROGRAM_FILES%\Coopen\Resource\SkinFormal\Button_Next.png
- %PROGRAM_FILES%\Coopen\Resource\SkinFormal\Button_Commit.png
- %PROGRAM_FILES%\Coopen\Resource\SkinFormal\Button_Pause.png
- %PROGRAM_FILES%\Coopen\Resource\SkinFormal\Button_Prev.png
- %PROGRAM_FILES%\Coopen\Resource\SkinFormal\Button_Play.png
- %PROGRAM_FILES%\Coopen\Resource\SkinFormal\Message.png
- %PROGRAM_FILES%\Coopen\Resource\SkinFormal\RadioU.png
- %PROGRAM_FILES%\Coopen\Resource\SkinFormal\RadioC.png
- %PROGRAM_FILES%\Coopen\Resource\SkinFormal\Synopsis1.png
- %PROGRAM_FILES%\winrar32\pipi_dae_476.exe
- %PROGRAM_FILES%\Coopen\Resource\SkinFormal\SkinClient.ini
- %PROGRAM_FILES%\Coopen\Resource\SkinFormal\Push_Folder.png
- %PROGRAM_FILES%\Coopen\Resource\SkinFormal\Progress.png
- %PROGRAM_FILES%\Coopen\Resource\SkinFormal\Notify.png
- %PROGRAM_FILES%\Coopen\Resource\SkinFormal\Push_Cancel.png
- %PROGRAM_FILES%\Coopen\Resource\SkinFormal\Push_Confirm.png
- %PROGRAM_FILES%\Coopen\Resource\SkinFormal\Push_Config.png
- %PROGRAM_FILES%\Coopen\Resource\SkinFormal\Button_Close.png
- C:\CCPMachineInfo.dll
- %TEMP%\nsr3.tmp\System.dll
- %TEMP%\nsr3.tmp\KillProcDLL.dll
- %PROGRAM_FILES%\Coopen\conf\ChannelListReal.txt
- %PROGRAM_FILES%\Coopen\Coopen.exe
- %TEMP%\nsm2.tmp
- %PROGRAM_FILES%\winrar32\coopen_setup_100180.exe
- C:\7ACCBF2E.log
- <SYSTEM32>\fswf.ico
- %PROGRAM_FILES%\winrar32\154401171.jse
- <SYSTEM32>\tbao.ico
- %PROGRAM_FILES%\Coopen\conf\PluginConfig.ini
- %PROGRAM_FILES%\Coopen\Templete\ModeB_logo.jpg
- %PROGRAM_FILES%\Coopen\Templete\ModeB.tpl
- %PROGRAM_FILES%\Coopen\Templete\CoopenPhoto.jpg
- %PROGRAM_FILES%\Coopen\Resource\SkinFormal\Button_Channel.png
- %PROGRAM_FILES%\Coopen\Resource\SkinFormal\Background.png
- %PROGRAM_FILES%\Coopen\Templete\ModeC.tpl
- %PROGRAM_FILES%\Coopen\CoopenAir.exe
- %TEMP%\nsr3.tmp\install.bmp
- %PROGRAM_FILES%\Coopen\CoopenMainManager.dll
- %PROGRAM_FILES%\Coopen\licence.txt
- %PROGRAM_FILES%\Coopen\CoopenActiveControl109.dll
- %PROGRAM_FILES%\Coopen\Resource\SkinFormal\SkinClose.ini
- %TEMP%\is-TAA5H.tmp\gtapi_signed.dll
- %TEMP%\is-TAA5H.tmp\PIPIRecommend.dll
- %TEMP%\is-TAA5H.tmp\setupwelcome.jpg
- %TEMP%\is-TAA5H.tmp\baidu_logo.jpg
- %TEMP%\is-TAA5H.tmp\google_logo.jpg
- %TEMP%\is-TAA5H.tmp\jpg2bmp.dll
- %HOMEPATH%\Start Menu\Programs\±И±ИЯВ\Р¶ФШ.lnk
- %HOMEPATH%\Start Menu\Programs\±И±ИЯВ\±И±ИЯВ№Щ·ЅНшХѕ.lnk
- %PROGRAM_FILES%\±И±ИЯВ\Р¶ФШ.exe
- %TEMP%\is-TAA5H.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-TAA5H.tmp\_isetup\_RegDLL.tmp
- %TEMP%\is-TAA5H.tmp\wizard_recommand.jpg
- %PROGRAM_FILES%\pipi\is-SH6G7.tmp
- %PROGRAM_FILES%\pipi\is-6J6EJ.tmp
- %PROGRAM_FILES%\pipi\is-QRBTJ.tmp
- %PROGRAM_FILES%\pipi\is-9LAF6.tmp
- %PROGRAM_FILES%\pipi\is-408QL.tmp
- %TEMP%\is-TAA5H.tmp\topWizardSmallImageFile.bmp
- %TEMP%\is-TAA5H.tmp\setupwelcome.bmp
- %TEMP%\is-TAA5H.tmp\topWizardSmallImageFile.jpg
- %TEMP%\is-TAA5H.tmp\google_logo.bmp
- %TEMP%\is-TAA5H.tmp\wizard_recommand.bmp
- %TEMP%\is-TAA5H.tmp\baidu_logo.bmp
- %TEMP%\is-2GQMG.tmp\pipi_setup_476.tmp
- %PROGRAM_FILES%\Coopen\image\Photo\local Photo\B_0.jpg
- %PROGRAM_FILES%\Coopen\image\Wallpaper\coopen wallpaper\PicList.ini
- %PROGRAM_FILES%\Coopen\image\Photo\local Photo\B_1.jpg
- %WINDIR%\winnode32.dll
- %PROGRAM_FILES%\Coopen\image\Photo\local Photo\ModeBList.ini
- %PROGRAM_FILES%\Coopen\image\Wallpaper\coopen wallpaper\DefaultCoopenWallpaper.jpg
- %PROGRAM_FILES%\Coopen\Templete\DefaultCoopenWallpaper.jpg
- %PROGRAM_FILES%\Coopen\Resource\SkinFormal\Synopsis1.ini
- %PROGRAM_FILES%\Coopen\Coopen.scr
- %PROGRAM_FILES%\Coopen\image\Wallpaper\local wallpaper\ModeAList.ini
- %PROGRAM_FILES%\Coopen\image\Wallpaper\local wallpaper\DefaultCoopenWallpaper.jpg
- %WINDIR%\smssrun.jse
- %TEMP%\nso5.tmp\System.dll
- %PROGRAM_FILES%\±И±ИЯВ\bibibei.dll
- %HOMEPATH%\Desktop\Coopen.lnk
- %PROGRAM_FILES%\±И±ИЯВ\bibibei.ico
- %PROGRAM_FILES%\±И±ИЯВ\±И±ИЯВ№Щ·ЅНшХѕ.url
- %PROGRAM_FILES%\Coopen\conf\%USERNAME%.ini
- %PROGRAM_FILES%\winrar32\pipi_setup_476.exe
- %PROGRAM_FILES%\winrar32\bibibei19.exe
- %HOMEPATH%\Start Menu\Programs\Coopen\CoopenІҐ·ЕЖч.lnk
- %PROGRAM_FILES%\Coopen\conf\All Users.ini
- %PROGRAM_FILES%\Coopen\uninst.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- %WINDIR%\system\SVCHOST.EXE
- %PROGRAM_FILES%\winrar32\154401171.jse
Удаляет следующие файлы:
- %PROGRAM_FILES%\pipi\jfCacheMgr.exe
- %PROGRAM_FILES%\±И±ИЯВ\Р¶ФШ.exe
- %PROGRAM_FILES%\pipi\unins000.exe
- %TEMP%\nso5.tmp\System.dll
- %TEMP%\nsr3.tmp\install.bmp
- %TEMP%\nsr3.tmp\KillProcDLL.dll
- %TEMP%\nsr3.tmp\System.dll
Перемещает следующие файлы:
- %PROGRAM_FILES%\pipi\codec\rm\is-TE3OO.tmp в %PROGRAM_FILES%\pipi\codec\rm\pncrt.dll
- %PROGRAM_FILES%\pipi\codec\rm\is-8816S.tmp в %PROGRAM_FILES%\pipi\codec\rm\raac.dll
- %PROGRAM_FILES%\pipi\codec\rm\is-GNK22.tmp в %PROGRAM_FILES%\pipi\codec\rm\drvc.dll
- %PROGRAM_FILES%\pipi\codec\rm\is-9D99V.tmp в %PROGRAM_FILES%\pipi\codec\rm\hxltcolor.dll
- %PROGRAM_FILES%\pipi\codec\rm\is-12Q2Q.tmp в %PROGRAM_FILES%\pipi\codec\rm\ralf.dll
- %PROGRAM_FILES%\pipi\codec\rm\is-CQSUV.tmp в %PROGRAM_FILES%\pipi\codec\rm\rv30.dll
- %PROGRAM_FILES%\pipi\codec\rm\is-9BMQ9.tmp в %PROGRAM_FILES%\pipi\codec\rm\rv40.dll
- %PROGRAM_FILES%\pipi\codec\rm\is-Q3QOO.tmp в %PROGRAM_FILES%\pipi\codec\rm\rv10.dll
- %PROGRAM_FILES%\pipi\codec\rm\is-Q2RPO.tmp в %PROGRAM_FILES%\pipi\codec\rm\rv20.dll
- %PROGRAM_FILES%\pipi\codec\rm\is-M0ETT.tmp в %PROGRAM_FILES%\pipi\codec\rm\28_83260.dll
- %PROGRAM_FILES%\pipi\codec\rm\is-T0VUE.tmp в %PROGRAM_FILES%\pipi\codec\rm\atrc.dll
- %PROGRAM_FILES%\pipi\codec\is-OU18E.tmp в %PROGRAM_FILES%\pipi\codec\MPCVideoDec.ax
- %PROGRAM_FILES%\pipi\codec\rm\is-R5VDL.tmp в %PROGRAM_FILES%\pipi\codec\rm\14_43260.dll
- %PROGRAM_FILES%\pipi\codec\rm\is-B7EDC.tmp в %PROGRAM_FILES%\pipi\codec\rm\cook.dll
- %PROGRAM_FILES%\pipi\codec\rm\is-OG3AI.tmp в %PROGRAM_FILES%\pipi\codec\rm\drv1.dll
- %PROGRAM_FILES%\pipi\codec\rm\is-HS5SU.tmp в %PROGRAM_FILES%\pipi\codec\rm\drv2.dll
- %PROGRAM_FILES%\pipi\codec\rm\is-JETL8.tmp в %PROGRAM_FILES%\pipi\codec\rm\ddnt3260.dll
- %PROGRAM_FILES%\pipi\codec\rm\is-QTKEU.tmp в %PROGRAM_FILES%\pipi\codec\rm\dnet3260.dll
- %PROGRAM_FILES%\pipi\config\is-5HKGC.tmp в %PROGRAM_FILES%\pipi\config\tab2_down.bmp
- %PROGRAM_FILES%\pipi\config\is-1JT8K.tmp в %PROGRAM_FILES%\pipi\config\tab2_norm.bmp
- %PROGRAM_FILES%\pipi\config\is-3R219.tmp в %PROGRAM_FILES%\pipi\config\enumwindow.ini
- %PROGRAM_FILES%\pipi\config\is-7OLTJ.tmp в %PROGRAM_FILES%\pipi\config\partner.ini
- %PROGRAM_FILES%\pipi\config\is-VT054.tmp в %PROGRAM_FILES%\pipi\config\tab2_over.bmp
- %PROGRAM_FILES%\pipi\Plugins\is-9LTOH.tmp в %PROGRAM_FILES%\pipi\Plugins\KmUdx.dll
- %TEMP%\jfcheck.conf.new в %APPDATA%\PIPI\jfcheck.conf
- %PROGRAM_FILES%\pipi\Plugins\is-VAA3O.tmp в %PROGRAM_FILES%\pipi\Plugins\KmHashFile.dll
- %PROGRAM_FILES%\pipi\Plugins\is-K4DE5.tmp в %PROGRAM_FILES%\pipi\Plugins\KmTransmit.dll
- %PROGRAM_FILES%\pipi\config\is-BLMSU.tmp в %PROGRAM_FILES%\pipi\config\acl.cnc.conf
- %PROGRAM_FILES%\pipi\config\is-N6MV6.tmp в %PROGRAM_FILES%\pipi\config\acl.crtc.conf
- %PROGRAM_FILES%\pipi\codec\rm\is-R4493.tmp в %PROGRAM_FILES%\pipi\codec\rm\sipr.dll
- %PROGRAM_FILES%\pipi\config\is-Q2CIB.tmp в %PROGRAM_FILES%\pipi\config\acl.cmcc.conf
- %PROGRAM_FILES%\pipi\config\is-02TCL.tmp в %PROGRAM_FILES%\pipi\config\acl.edu.conf
- %PROGRAM_FILES%\pipi\config\is-OF2SA.tmp в %PROGRAM_FILES%\pipi\config\clienttype.ini
- %PROGRAM_FILES%\pipi\config\is-DB7P9.tmp в %PROGRAM_FILES%\pipi\config\config.ini
- %PROGRAM_FILES%\pipi\config\is-4U3R9.tmp в %PROGRAM_FILES%\pipi\config\acl.greatwall.conf
- %PROGRAM_FILES%\pipi\config\is-T0BSI.tmp в %PROGRAM_FILES%\pipi\config\acl.telecom.conf
- %PROGRAM_FILES%\pipi\codec\is-P8VNL.tmp в %PROGRAM_FILES%\pipi\codec\CoreAVC.ax
- %PROGRAM_FILES%\pipi\is-479K6.tmp в %PROGRAM_FILES%\pipi\jpg2bmp.dll
- %PROGRAM_FILES%\pipi\is-LHTCR.tmp в %PROGRAM_FILES%\pipi\KmBugslayerUtil.dll
- %PROGRAM_FILES%\pipi\is-7PLCU.tmp в %PROGRAM_FILES%\pipi\JfCheck.dll
- %PROGRAM_FILES%\pipi\is-1VQR3.tmp в %PROGRAM_FILES%\pipi\jfres_plug.dll
- %PROGRAM_FILES%\pipi\is-44PGC.tmp в %PROGRAM_FILES%\pipi\KmFileTypeSetting.exe
- %PROGRAM_FILES%\pipi\is-65RFD.tmp в %PROGRAM_FILES%\pipi\MCCKMPlayerX.dll
- %PROGRAM_FILES%\pipi\is-CUL06.tmp в %PROGRAM_FILES%\pipi\MFC71.dll
- %PROGRAM_FILES%\pipi\is-A8CB9.tmp в %PROGRAM_FILES%\pipi\KmLiveUpdate.exe
- %PROGRAM_FILES%\pipi\is-U5I03.tmp в %PROGRAM_FILES%\pipi\libdb43.dll
- %PROGRAM_FILES%\pipi\is-QRBTJ.tmp в %PROGRAM_FILES%\pipi\baidu_logo.JPG
- %PROGRAM_FILES%\pipi\is-408QL.tmp в %PROGRAM_FILES%\pipi\dbghelp.dll
- %PROGRAM_FILES%\pipi\is-6J6EJ.tmp в %PROGRAM_FILES%\pipi\unins000.exe
- %PROGRAM_FILES%\pipi\is-SH6G7.tmp в %PROGRAM_FILES%\pipi\jfCacheMgr.exe
- %PROGRAM_FILES%\pipi\is-9LAF6.tmp в %PROGRAM_FILES%\pipi\google_logo.JPG
- %PROGRAM_FILES%\pipi\is-ADIK9.tmp в %PROGRAM_FILES%\pipi\jfCacheMgr.exe
- %PROGRAM_FILES%\pipi\is-396MB.tmp в %PROGRAM_FILES%\pipi\jfcheck.conf
- %PROGRAM_FILES%\pipi\is-5OG64.tmp в %PROGRAM_FILES%\pipi\gtapi_signed.dll
- %PROGRAM_FILES%\pipi\is-328A4.tmp в %PROGRAM_FILES%\pipi\HttpDownLoad.exe
- %PROGRAM_FILES%\pipi\is-F3RJH.tmp в %PROGRAM_FILES%\pipi\setupwelcome.JPG
- %PROGRAM_FILES%\pipi\is-8PNN1.tmp в %PROGRAM_FILES%\pipi\sqlite3.dll
- %PROGRAM_FILES%\pipi\is-OO31E.tmp в %PROGRAM_FILES%\pipi\pphelp.url
- %PROGRAM_FILES%\pipi\is-6P0B2.tmp в %PROGRAM_FILES%\pipi\ppwebnav.url
- %PROGRAM_FILES%\pipi\is-Q6F6T.tmp в %PROGRAM_FILES%\pipi\topWizardSmallImageFile.jpg
- %PROGRAM_FILES%\pipi\is-UERGG.tmp в %PROGRAM_FILES%\pipi\wizard_recommand.JPG
- %PROGRAM_FILES%\pipi\codec\is-6TBH5.tmp в %PROGRAM_FILES%\pipi\codec\CoreAAC.ax
- %PROGRAM_FILES%\pipi\is-J93DE.tmp в %PROGRAM_FILES%\pipi\uninstall.ico
- %PROGRAM_FILES%\pipi\is-54A2D.tmp в %PROGRAM_FILES%\pipi\webplayer.url
- %PROGRAM_FILES%\pipi\is-NTUEP.tmp в %PROGRAM_FILES%\pipi\PIPIPlayer.exe
- %PROGRAM_FILES%\pipi\is-ACJG5.tmp в %PROGRAM_FILES%\pipi\PIPIRecommend.dll
- %PROGRAM_FILES%\pipi\is-QRF9D.tmp в %PROGRAM_FILES%\pipi\msvcp71.dll
- %PROGRAM_FILES%\pipi\is-0D01P.tmp в %PROGRAM_FILES%\pipi\msvcr71.dll
- %PROGRAM_FILES%\pipi\is-NVLO8.tmp в %PROGRAM_FILES%\pipi\pipisp.ico
- %PROGRAM_FILES%\pipi\is-GPHO1.tmp в %PROGRAM_FILES%\pipi\PIPIWebPlayer.ocx
- %PROGRAM_FILES%\pipi\is-NR7EI.tmp в %PROGRAM_FILES%\pipi\player.swf
- %PROGRAM_FILES%\pipi\is-0P66V.tmp в %PROGRAM_FILES%\pipi\pipisp.url
- %PROGRAM_FILES%\pipi\is-K9QFP.tmp в %PROGRAM_FILES%\pipi\PIPIStartSvr.exe
Сетевая активность:
Подключается к:
- 'ha#.#b173.com':80
- 'localhost':1042
- 'mi##.pipi.cn':80
- 't.###ibei.com':80
- 'www.pi#i.cn':80
- 'localhost':1040
TCP:
Запросы HTTP GET:
- http://www.pi#i.cn/player/pfadurl.dll?ty#################################################
- http://mi##.pipi.cn/mini3.html
- http://www.pi#i.cn/pfup/pfplayer2.ini
- http://www.pi#i.cn/pfup/jfcheck/jfcheck.conf
- http://ha#.#b173.com/?
Запросы HTTP POST:
- http://t.###ibei.com/thinker/install.do
UDP:
- DNS ASK ha#.#b173.com
- DNS ASK mi##.pipi.cn
- DNS ASK t.###ibei.com
- DNS ASK www.pi#i.cn
Другое:
Ищет следующие окна:
- ClassName: 'IEFrame' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: '' WindowName: 'ppfilm_class_cachemgr_title'
- ClassName: 'MPWClass' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: '' WindowName: 'Coopen@wwwcoopencn'
- ClassName: '' WindowName: 'cool66byCool66comcn123'
- ClassName: 'progman' WindowName: 'Program Manager'
- ClassName: 'ppfilm_class' WindowName: ''
- ClassName: 'CoopenPlayer' WindowName: '*їЄЖБґ«ГЅ*'
- ClassName: 'CoopenPlayer' WindowName: '*????????*'
