Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000013] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000012] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005] 'PackedCatalogItem' = ''
- [<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004] 'PackedCatalogItem' = ''
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\WS2IFSL] 'Start' = '00000001'
Вредоносные функции:
Создает и запускает на исполнение:
- C:\MiFengIe_3_44093.exe
Изменения в файловой системе:
Создает следующие файлы:
- %PROGRAM_FILES%\MifExplorer\Skin\ToolBarBack.png
- %PROGRAM_FILES%\MifExplorer\Skin\ToolBarDrop.png
- %PROGRAM_FILES%\MifExplorer\Skin\ToolBarGrriper.png
- %PROGRAM_FILES%\MifExplorer\Skin\TabSetBtn.png
- %PROGRAM_FILES%\MifExplorer\Skin\TabWebWait.png
- %PROGRAM_FILES%\MifExplorer\Skin\ToolAddresBtn.png
- %PROGRAM_FILES%\MifExplorer\Skin\ToolFavoriteHeadBar.png
- %PROGRAM_FILES%\MifExplorer\Skin\Tooltip.gif
- %PROGRAM_FILES%\MifExplorer\Skin\TreeIcon.png
- %PROGRAM_FILES%\MifExplorer\Skin\ToolFavoriteFile.png
- %PROGRAM_FILES%\MifExplorer\Skin\ToolFavoriteFolder.png
- %PROGRAM_FILES%\MifExplorer\Skin\ToolFavoriteFolderIE.png
- %PROGRAM_FILES%\MifExplorer\Skin\TabAddBtn.png
- %PROGRAM_FILES%\MifExplorer\Skin\TabBtn.png
- %PROGRAM_FILES%\MifExplorer\Skin\TabCloseBtn.png
- %PROGRAM_FILES%\MifExplorer\Skin\Spliter.png
- %PROGRAM_FILES%\MifExplorer\Skin\StateBarBack.png
- %PROGRAM_FILES%\MifExplorer\Skin\StateHeader.png
- %PROGRAM_FILES%\MifExplorer\Skin\TabModeBtn.png
- %PROGRAM_FILES%\MifExplorer\Skin\TabOpenLeftBtn.png
- %PROGRAM_FILES%\MifExplorer\Skin\TabRightScrollBtn.png
- %PROGRAM_FILES%\MifExplorer\Skin\TabDropDownMenu.png
- %PROGRAM_FILES%\MifExplorer\Skin\TabExitG.png
- %PROGRAM_FILES%\MifExplorer\Skin\TabLeftScrollBtn.png
- %PROGRAM_FILES%\MifExplorer\Skin\WebZoomModeBtn.png
- %ALLUSERSPROFILE%\Start Menu\Programs\ГЫ·ддЇААЖч\Р¶ФШГЫ·ддЇААЖч.lnk
- %TEMP%\nst3.tmp\System.dll
- <SYSTEM32>\boot_sec.log
- %ALLUSERSPROFILE%\Start Menu\Programs\ГЫ·ддЇААЖч\ГЫ·ддЇААЖч (ОЮєЫдЇАА).lnk
- %ALLUSERSPROFILE%\Desktop\ГЫ·ддЇААЖч.lnk
- %PROGRAM_FILES%\MifExplorer\uninst.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\bangzhu[1].html
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\69et[1]
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\guanggao[1].html
- <SYSTEM32>\IEFirewall.dll
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\guanggao[1].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\cnxez[1]
- %PROGRAM_FILES%\MifExplorer\Skin\tool_home.png
- %PROGRAM_FILES%\MifExplorer\Skin\tool_refresh.png
- %PROGRAM_FILES%\MifExplorer\Skin\tool_restore.png
- %PROGRAM_FILES%\MifExplorer\Skin\tab_dragging.png
- %PROGRAM_FILES%\MifExplorer\Skin\tool_backward.png
- %PROGRAM_FILES%\MifExplorer\Skin\tool_forward.png
- %PROGRAM_FILES%\MifExplorer\Config\Start\blank.htm
- %PROGRAM_FILES%\MifExplorer\Config\Start\index.htm
- %ALLUSERSPROFILE%\Start Menu\Programs\ГЫ·ддЇААЖч\ГЫ·ддЇААЖч.lnk
- %PROGRAM_FILES%\MifExplorer\Skin\tool_sidebar.png
- %PROGRAM_FILES%\MifExplorer\Skin\tool_stop.png
- %PROGRAM_FILES%\MifExplorer\Config\Settings.db
- %PROGRAM_FILES%\MifExplorer\Skin\BeeIE_LeftFram.png
- %PROGRAM_FILES%\MifExplorer\Skin\BeeIE_Logo.png
- %PROGRAM_FILES%\MifExplorer\Skin\BeeIE_RightFram.png
- %PROGRAM_FILES%\MifExplorer\Skin\BeeIE_BottomFram.png
- %PROGRAM_FILES%\MifExplorer\Skin\BeeIE_Caption.png
- %PROGRAM_FILES%\MifExplorer\Skin\BeeIE_Exit.png
- %PROGRAM_FILES%\MifExplorer\Skin\BeeStartBtn.png
- %PROGRAM_FILES%\MifExplorer\Skin\BeeUrlTab.ico
- %PROGRAM_FILES%\MifExplorer\Skin\DragTabBtn.png
- %PROGRAM_FILES%\MifExplorer\Skin\BeeIE_SysBtn.png
- %PROGRAM_FILES%\MifExplorer\Skin\BeeIE_TopFram.png
- %PROGRAM_FILES%\MifExplorer\Skin\BeeModeBtn.png
- %PROGRAM_FILES%\MifExplorer\MifExplorer.exe
- %PROGRAM_FILES%\MifExplorer\Skin\AccelKeySetBtn.png
- %PROGRAM_FILES%\MifExplorer\Skin\Addr_Edit.png
- C:\MiFengIe_3_44093.exe
- %TEMP%\nst2.tmp
- %TEMP%\nst3.tmp\options.ini
- %PROGRAM_FILES%\MifExplorer\Skin\AddressSetBtn.png
- %PROGRAM_FILES%\MifExplorer\Skin\AxTabBack.png
- %PROGRAM_FILES%\MifExplorer\Skin\BeeExplorer.ico
- %PROGRAM_FILES%\MifExplorer\Skin\AddresDropDown.png
- %PROGRAM_FILES%\MifExplorer\Skin\AddressListBoxHorz.png
- %PROGRAM_FILES%\MifExplorer\Skin\AddressListBoxVert.png
- %PROGRAM_FILES%\MifExplorer\Skin\FavTreeAddBtn.png
- %PROGRAM_FILES%\MifExplorer\Skin\Propress.png
- %PROGRAM_FILES%\MifExplorer\Skin\Separator.png
- %PROGRAM_FILES%\MifExplorer\Skin\SerachBtn.png
- %PROGRAM_FILES%\MifExplorer\Skin\MsgBoxLineRight.png
- %PROGRAM_FILES%\MifExplorer\Skin\MsgInfo.png
- %PROGRAM_FILES%\MifExplorer\Skin\PrivProtectBtn.png
- %PROGRAM_FILES%\MifExplorer\Skin\SiderBarTop.png
- %PROGRAM_FILES%\MifExplorer\Skin\SiderToolBtn.png
- %PROGRAM_FILES%\MifExplorer\Skin\SodunModeBtn.png
- %PROGRAM_FILES%\MifExplorer\Skin\Serach_Engine.png
- %PROGRAM_FILES%\MifExplorer\Skin\SiderBarClose.png
- %PROGRAM_FILES%\MifExplorer\Skin\SiderBarLeft.png
- %PROGRAM_FILES%\MifExplorer\Skin\FilterBtn.png
- %PROGRAM_FILES%\MifExplorer\Skin\FilterModeBtn.png
- %PROGRAM_FILES%\MifExplorer\Skin\ForwardBackDropDown.png
- %PROGRAM_FILES%\MifExplorer\Skin\FavTreeDelBtn.png
- %PROGRAM_FILES%\MifExplorer\Skin\FavTreeEditBtn.png
- %PROGRAM_FILES%\MifExplorer\Skin\FavoriteBarTop.png
- %PROGRAM_FILES%\MifExplorer\Skin\MouseHandCur.png
- %PROGRAM_FILES%\MifExplorer\Skin\MouseSetBtn.png
- %PROGRAM_FILES%\MifExplorer\Skin\MsgBoxLineLeft.png
- %PROGRAM_FILES%\MifExplorer\Skin\MediaForbidModeBtn.png
- %PROGRAM_FILES%\MifExplorer\Skin\Menu.png
- %PROGRAM_FILES%\MifExplorer\Skin\MouseHand.png
Удаляет следующие файлы:
- %TEMP%\nst3.tmp\System.dll
- %TEMP%\nst3.tmp\options.ini
Сетевая активность:
Подключается к:
- 'www.yo##isk.com':80
- 'www.69##.com':80
- 'www.cn##z.com':80
- 'localhost':1037
TCP:
Запросы HTTP GET:
- www.cn##z.com/bangzhu.html
- www.69##.com/
- www.cn##z.com/guanggao.html
- www.cn##z.com/gonggao.txt
- www.yo##isk.com/guanggao.php
- www.cn##z.com/
UDP:
- DNS ASK www.69##.com
- DNS ASK www.yo##isk.com
- DNS ASK www.cn##z.com
Другое:
Ищет следующие окна:
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
