Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Classes\GSWBDictFile\shell\open\command] '' = '"%PROGRAM_FILES%\GSInput\3.0.1.0512\DictReg.exe" -install %1'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'GSMutualRunOne' = '%PROGRAM_FILES%\GSInput\3.0.1.0512\Mutual.exe RestartRunOneProgram'
- [<HKLM>\SOFTWARE\Classes\GSApkFile\shell\open\command] '' = '"%PROGRAM_FILES%\GSInput\3.0.1.0512\ApkReg.exe" install %1'
- [<HKLM>\SOFTWARE\Classes\GSWBSkinFile\shell\open\command] '' = '"%PROGRAM_FILES%\GSInput\3.0.1.0512\SkinReg.exe" -install %1'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\675a891a764626235724bf61839f574c] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- '%PROGRAM_FILES%\GSInput\3.0.1.0512\ApkReg.exe' RegApkRelated
- '%PROGRAM_FILES%\GSInput\3.0.1.0512\Power.exe' /RegApkRelated
- '%PROGRAM_FILES%\GSInput\3.0.1.0512\MBManager.exe' DownloadCellDictMb 2476,6904,6448,6452,6446,6447,6913,2491,4174
- '%PROGRAM_FILES%\GSInput\3.0.1.0512\Mutual.exe' DownloadInstallDrivers
- '%PROGRAM_FILES%\GSInput\3.0.1.0512\MBManager.exe' CheckSysMb
- '%PROGRAM_FILES%\GSInput\3.0.1.0512\Mutual.exe' InstallSpreadOperate qubudao140421
- '%PROGRAM_FILES%\GSInput\3.0.1.0512\ImeReg32.exe' /InstallIME gswb
- '%PROGRAM_FILES%\GSInput\3.0.1.0512\Wizard.exe' RunAutoLoadDict
Изменения в файловой системе:
Создает следующие файлы:
- %APPDATA%\GuangSu\Back\MBManager.exe
- %APPDATA%\GuangSu\Back\ImeUtil.exe
- %APPDATA%\GuangSu\Back\Power.exe
- %APPDATA%\GuangSu\Back\Mutual.exe
- %APPDATA%\GuangSu\Back\gswb64.ime
- %APPDATA%\GuangSu\Back\gswb32.ime
- %APPDATA%\GuangSu\Back\ImeReg64.exe
- %APPDATA%\GuangSu\Back\ImeReg32.exe
- %APPDATA%\GuangSu\Back\Skin\ЕјТІєЬі±µД.gss
- %APPDATA%\GuangSu\Back\Skin\А¶.gss
- %APPDATA%\GuangSu\Back\Skin\ЗпТ¶.gss
- %APPDATA%\GuangSu\Back\Skin\зН·ЧЛ®№ы±щј¤Би.gss
- %APPDATA%\GuangSu\Back\Service.dll
- %APPDATA%\GuangSu\Back\Push.dll
- %APPDATA%\GuangSu\Back\Skin\°®Дг.gss
- %APPDATA%\GuangSu\Back\Skin\°®іФєъВЬІ·.gss
- %APPDATA%\GuangSu\AllSkin\ЕјТІєЬі±µД.gss
- %APPDATA%\GuangSu\AllSkin\А¶.gss
- %APPDATA%\GuangSu\AllSkin\ЗпТ¶.gss
- %APPDATA%\GuangSu\AllSkin\зН·ЧЛ®№ы±щј¤Би.gss
- %ALLUSERSPROFILE%\Start Menu\Programs\光速输入法\卸载光速输入法.lnk
- %PROGRAM_FILES%\GSInput\3.0.1.0512\Config.ini
- %APPDATA%\GuangSu\AllSkin\°®Дг.gss
- %APPDATA%\GuangSu\AllSkin\°®іФєъВЬІ·.gss
- %APPDATA%\GuangSu\Back\DictReg.exe
- %APPDATA%\GuangSu\Back\Config.ini
- %APPDATA%\GuangSu\Back\Expand.dll
- %APPDATA%\GuangSu\Back\DuiLib32.dll
- %APPDATA%\GuangSu\Back\aapt.exe
- %APPDATA%\GuangSu\AllSkin\ПВОзІиК±№в.gss
- %APPDATA%\GuangSu\Back\Config.exe
- %APPDATA%\GuangSu\Back\ApkReg.exe
- %PROGRAM_FILES%\GSInput\3.0.1.0512\BackMB\yy.idx
- %PROGRAM_FILES%\GSInput\3.0.1.0512\BackMB\yy.dat
- %APPDATA%\GuangSu.users\Dict\2476.gcel
- %APPDATA%\GuangSu\Config\UseVestige.ini
- %PROGRAM_FILES%\GSInput\3.0.1.0512\BackMB\py.u.v1.idx
- %PROGRAM_FILES%\GSInput\3.0.1.0512\BackMB\py.s.idx
- %PROGRAM_FILES%\GSInput\3.0.1.0512\BackMB\wb.idx
- %PROGRAM_FILES%\GSInput\3.0.1.0512\BackMB\wb.dat
- %APPDATA%\GuangSu.users\Dict\6913.gcel
- %APPDATA%\GuangSu.users\Dict\6447.gcel
- %APPDATA%\GuangSu.users\Dict\4174.gcel
- %APPDATA%\GuangSu.users\Dict\2491.gcel
- %APPDATA%\GuangSu.users\Dict\6448.gcel
- %APPDATA%\GuangSu.users\Dict\6904.gcel
- %APPDATA%\GuangSu.users\Dict\6446.gcel
- %APPDATA%\GuangSu.users\Dict\6452.gcel
- %APPDATA%\GuangSu\Back\UserPage.exe
- %APPDATA%\GuangSu\Back\uninst.exe
- %APPDATA%\GuangSu\Back\WDJDriverPreinstaller.exe
- %APPDATA%\GuangSu\Back\WbUpd.exe
- %APPDATA%\GuangSu\Back\SkinReg.exe
- %APPDATA%\GuangSu\Back\Skin\ПВОзІиК±№в.gss
- %APPDATA%\GuangSu\Back\Statistics.dll
- %APPDATA%\GuangSu\Back\SoftApp.ini
- %PROGRAM_FILES%\GSInput\3.0.1.0512\BackMB\gbk.dat
- %PROGRAM_FILES%\GSInput\3.0.1.0512\BackMB\dz.dat
- %PROGRAM_FILES%\GSInput\3.0.1.0512\BackMB\lx.dat
- %PROGRAM_FILES%\GSInput\3.0.1.0512\BackMB\gbk.idx
- %APPDATA%\GuangSu\Back\WdjRelated.dll
- %APPDATA%\GuangSu\Back\WdjEngine.dll
- %APPDATA%\GuangSu\Back\Wizard.exe
- %APPDATA%\GuangSu\Back\wdj_connection_wrapper.dll
- %PROGRAM_FILES%\GSInput\3.0.1.0512\Statistics.dll
- %PROGRAM_FILES%\GSInput\3.0.1.0512\SkinReg.exe
- %PROGRAM_FILES%\GSInput\3.0.1.0512\WbUpd.exe
- %PROGRAM_FILES%\GSInput\3.0.1.0512\UserPage.exe
- %PROGRAM_FILES%\GSInput\3.0.1.0512\Power.exe
- %PROGRAM_FILES%\GSInput\3.0.1.0512\Mutual.exe
- %PROGRAM_FILES%\GSInput\3.0.1.0512\Service.dll
- %PROGRAM_FILES%\GSInput\3.0.1.0512\Push.dll
- %PROGRAM_FILES%\GSInput\3.0.1.0512\uninst.exe
- %PROGRAM_FILES%\GSInput\3.0.1.0512\Wizard.exe
- %PROGRAM_FILES%\GSInput\3.0.1.0512\Skin\°®іФєъВЬІ·.gss
- %PROGRAM_FILES%\GSInput\3.0.1.0512\SoftApp.ini
- %PROGRAM_FILES%\GSInput\3.0.1.0512\WDJDriverPreinstaller.exe
- %PROGRAM_FILES%\GSInput\3.0.1.0512\wdj_connection_wrapper.dll
- %PROGRAM_FILES%\GSInput\3.0.1.0512\WdjRelated.dll
- %PROGRAM_FILES%\GSInput\3.0.1.0512\WdjEngine.dll
- %PROGRAM_FILES%\GSInput\3.0.1.0512\ApkReg.exe
- %PROGRAM_FILES%\GSInput\3.0.1.0512\aapt.exe
- %PROGRAM_FILES%\GSInput\3.0.1.0512\DictReg.exe
- %PROGRAM_FILES%\GSInput\3.0.1.0512\Config.exe
- %TEMP%\nsr3.tmp\System.dll
- %TEMP%\nsw2.tmp
- %TEMP%\nsr3.tmp\gsime3.dll
- %PROGRAM_FILES%\GSInput\ЛµГч.txt
- %PROGRAM_FILES%\GSInput\3.0.1.0512\ImeReg64.exe
- %PROGRAM_FILES%\GSInput\3.0.1.0512\ImeReg32.exe
- %PROGRAM_FILES%\GSInput\3.0.1.0512\MBManager.exe
- %PROGRAM_FILES%\GSInput\3.0.1.0512\ImeUtil.exe
- %PROGRAM_FILES%\GSInput\3.0.1.0512\Expand.dll
- %PROGRAM_FILES%\GSInput\3.0.1.0512\DuiLib32.dll
- %PROGRAM_FILES%\GSInput\3.0.1.0512\gswb64.ime
- %PROGRAM_FILES%\GSInput\3.0.1.0512\gswb32.ime
- %APPDATA%\GuangSu\Config\Config.ini
- %CommonProgramFiles%\GSInput\gswb.ini
- %ALLUSERSPROFILE%\Start Menu\Programs\光速输入法\官方网站.url
- <SYSTEM32>\gswb.ime
- %PROGRAM_FILES%\GSInput\Dict\yy.idx
- %PROGRAM_FILES%\GSInput\Dict\yy.dat
- %PROGRAM_FILES%\GSInput\Dict\WBPhrases.dat
- %PROGRAM_FILES%\GSInput\Dict\PYPhrases.dat
- %ALLUSERSPROFILE%\Start Menu\Programs\光速输入法\属性设置.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\光速输入法\设置向导.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\光速输入法\在线升级.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\光速输入法\输入法管理器.lnk
- %APPDATA%\GuangSu\Config\Related.ini
- %PROGRAM_FILES%\GSInput\官方网站.url
- %APPDATA%\GuangSu.users\MB\UserData.db
- %APPDATA%\GuangSu.users\MB\UserData.db-journal
- %PROGRAM_FILES%\GSInput\3.0.1.0512\Skin\ПВОзІиК±№в.gss
- %PROGRAM_FILES%\GSInput\3.0.1.0512\Skin\ЗпТ¶.gss
- %PROGRAM_FILES%\GSInput\Dict\gbk.dat
- %PROGRAM_FILES%\GSInput\Dict\dz.dat
- %PROGRAM_FILES%\GSInput\3.0.1.0512\Skin\зН·ЧЛ®№ы±щј¤Би.gss
- %PROGRAM_FILES%\GSInput\3.0.1.0512\Skin\°®Дг.gss
- %PROGRAM_FILES%\GSInput\3.0.1.0512\Skin\ЕјТІєЬі±µД.gss
- %PROGRAM_FILES%\GSInput\3.0.1.0512\Skin\А¶.gss
- %PROGRAM_FILES%\GSInput\Dict\url.dat
- %PROGRAM_FILES%\GSInput\Dict\py.u.v1.idx
- %PROGRAM_FILES%\GSInput\Dict\wb.idx
- %PROGRAM_FILES%\GSInput\Dict\wb.dat
- %PROGRAM_FILES%\GSInput\Dict\Header.dat
- %PROGRAM_FILES%\GSInput\Dict\gbk.idx
- %PROGRAM_FILES%\GSInput\Dict\py.s.idx
- %PROGRAM_FILES%\GSInput\Dict\lx.dat
Удаляет следующие файлы:
- %APPDATA%\GuangSu.users\MB\UserData.db-journal
- %TEMP%\nsr3.tmp\System.dll
- %TEMP%\nsr3.tmp\gsime3.dll
Сетевая активность:
Подключается к:
- 'www.gu##gsu.cn':80
- 'do####ll.gswubi.com':80
TCP:
Запросы HTTP GET:
- www.gu##gsu.cn/cell.php?s=#######
- do####ll.gswubi.com/gcelinfo/recommend.xml
UDP:
- DNS ASK tj.##wubi.com
- DNS ASK do##.guangsu.cn
- DNS ASK do####ll.gswubi.com
- DNS ASK www.gu##gsu.cn
Другое:
Ищет следующие окна:
- ClassName: 'CicLoaderWndClass' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
