Trojan.Click1.42217

Техническая информация

Вредоносные функции:

Запускает на исполнение:

<SYSTEM32>\ping.exe 127.0.0.1 -n 3
%PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE http://www.21#7.cn/?ne####

Изменения в файловой системе:

Создает следующие файлы:

%HOMEPATH%\Favorites\【淘宝风云榜】.url
%HOMEPATH%\Favorites\【疯狂购物】.url
%HOMEPATH%\Favorites\【当当商城】.url
%HOMEPATH%\Favorites\【淘宝特卖】.url
%HOMEPATH%\Favorites\【网址导航】.url
%HOMEPATH%\Favorites\实用查询.url
%HOMEPATH%\Favorites\家居玩具.url
%HOMEPATH%\Favorites\【美容秘籍】.url
%HOMEPATH%\Favorites\在线网游.url
%TEMP%\aut14.tmp
%PROGRAM_FILES%\TheWorld3\2\百度.url
%TEMP%\aut13.tmp
%PROGRAM_FILES%\TheWorld3\2\电视直播.url
%TEMP%\aut15.tmp
%HOMEPATH%\Favorites\【卓越特价商城】.url
%HOMEPATH%\Favorites\【台湾美食】.url
%PROGRAM_FILES%\TheWorld3\2\系统下载.url
%HOMEPATH%\Favorites\【凡客诚品】.url
%TEMP%\aut16.tmp
%TEMP%\aut17.tmp
%ALLUSERSPROFILE%\Start Menu\Programs\世界之窗浏览器.txt
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\世界之窗浏览器.txt
%TEMP%\aut18.tmp
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\2127[1]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\Count[1].asp
%TEMP%\aut19.tmp
%TEMP%\aut1A.tmp
%HOMEPATH%\Favorites\游戏下载.url
%HOMEPATH%\Favorites\电视直播.url
%HOMEPATH%\Favorites\家电商城.url
%HOMEPATH%\Favorites\淘宝网.url
%HOMEPATH%\Favorites\百度.url
%ALLUSERSPROFILE%\Desktop\世界之窗浏览器.txt
%ALLUSERSPROFILE%\Start Menu\世界之窗浏览器.txt
%HOMEPATH%\Favorites\系统下载.url
C:\世界之窗浏览器.lnk
%PROGRAM_FILES%\TheWorld3\2\【台湾美食】.url
%TEMP%\aut7.tmp
%PROGRAM_FILES%\TheWorld3\2\【卓越特价商城】.url
%TEMP%\aut6.tmp
%PROGRAM_FILES%\TheWorld3\2\【当当商城】.url
%TEMP%\aut9.tmp
%PROGRAM_FILES%\TheWorld3\2\【淘宝风云榜】.url
%TEMP%\aut8.tmp
%PROGRAM_FILES%\TheWorld3\2\【淘宝特卖】.url
%TEMP%\aut2.tmp
%PROGRAM_FILES%\TheWorld3\世界之窗.ini
%TEMP%\aut1.tmp
%PROGRAM_FILES%\TheWorld3\世界之窗.exe
%TEMP%\aut3.tmp
%PROGRAM_FILES%\TheWorld3\2\【凡客诚品】.url
%TEMP%\aut5.tmp
%PROGRAM_FILES%\TheWorld3\2\favorder3.dat
%TEMP%\aut4.tmp
%PROGRAM_FILES%\TheWorld3\2\家居玩具.url
%TEMP%\aut10.tmp
%PROGRAM_FILES%\TheWorld3\2\实用查询.url
%TEMP%\autF.tmp
%PROGRAM_FILES%\TheWorld3\2\家电商城.url
%TEMP%\aut12.tmp
%PROGRAM_FILES%\TheWorld3\2\游戏下载.url
%TEMP%\aut11.tmp
%PROGRAM_FILES%\TheWorld3\2\淘宝网.url
%TEMP%\autB.tmp
%PROGRAM_FILES%\TheWorld3\2\【网址导航】.url
%TEMP%\autA.tmp
%PROGRAM_FILES%\TheWorld3\2\【疯狂购物】.url
%TEMP%\autC.tmp
%PROGRAM_FILES%\TheWorld3\2\在线网游.url
%TEMP%\autE.tmp
%PROGRAM_FILES%\TheWorld3\2\【美容秘籍】.url
%TEMP%\autD.tmp