Trojan.Click2.55370

Техническая информация

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\reg.exe' ADD "HKEY_CLASSES_ROOT\CLSID\{00000307-0000-0011-8500-00AA006DABCD}\shell\┤Є┐к╓ў╥│(&H)\Command" /ve /t REG_SZ /d "%PROGRAM_FILES%\Internet Explorer\iexplore.exe http:\\www.da###6.com\?in# /f
'<SYSTEM32>\reg.exe' ADD "HKEY_CLASSES_ROOT\CLSID\{00000307-0000-0011-8500-00AA006DABCD}\shell\╩Ї╨╘(&R)"
'<SYSTEM32>\reg.exe' ADD "HKEY_CLASSES_ROOT\CLSID\{00000307-0000-0011-8500-00AA006DABCD}\shell\╩Ї╨╘(&R)\Command"
'<SYSTEM32>\reg.exe' ADD "HKEY_CLASSES_ROOT\CLSID\{00000307-0000-0011-8500-00AA006DABCD}\shell\┤Є┐к╓ў╥│(&H)"
'<SYSTEM32>\reg.exe' ADD "HKEY_CLASSES_ROOT\CLSID\{00000307-0000-0011-8500-00AA006DABCD}\shell\┤Є┐к╓ў╥│(&H)" /v "MUIVerb" /t REG_SZ /d "@shdoclc.dll,-10241" /f
'<SYSTEM32>\reg.exe' ADD "HKEY_CLASSES_ROOT\CLSID\{00000307-0000-0011-8500-00AA006DABCD}\shell\┤Є┐к╓ў╥│(&H)\Command"
'<SYSTEM32>\reg.exe' ADD "HKEY_CLASSES_ROOT\CLSID\{00000307-0000-0011-8500-00AA006DABCD}\shell\╩Ї╨╘(&R)\Command" /ve /t REG_SZ /d "%PROGRAM_FILES%\Internet Explorer\iexplore.exe http:\\www.da###6.com\?in# /f
'<SYSTEM32>\reg.exe' ADD "HKEY_CLASSES_ROOT\CLSID\{00000307-0000-0011-8500-00AA006DABCD}\ShellFolder" /v "HideOnDesktopPerUser" /t REG_SZ /d "" /f
'<SYSTEM32>\reg.exe' ADD "HKEY_CLASSES_ROOT\CLSID\{00000307-0000-0011-8500-00AA006DABCD}\ShellFolder" /v "WantsParsDisplayName" /t REG_SZ /d "" /f
'<SYSTEM32>\sc.exe' create Schedule binpath= "%WINDIR%\svchost.exe -k netsvcs" depend= rpcss start= auto displayname= "Task Scheduler"
'<SYSTEM32>\reg.exe' ADD "HKEY_CLASSES_ROOT\CLSID\{00000307-0000-0011-8500-00AA006DABCD}\ShellFolder"
'<SYSTEM32>\reg.exe' ADD "HKEY_CLASSES_ROOT\CLSID\{00000307-0000-0011-8500-00AA006DABCD}\ShellFolder" /v "Attributes" /t REG_DWORD /d 0 /f
'<SYSTEM32>\reg.exe' ADD "HKEY_CLASSES_ROOT\CLSID\{00000307-0000-0011-8500-00AA006DABCD}\ShellFolder" /v "HideFolderVerbs" /t REG_SZ /d "" /f
'<SYSTEM32>\reg.exe' ADD "HKEY_CLASSES_ROOT\CLSID\{00000307-0000-0011-8500-00AA006DABCD}"
'<SYSTEM32>\reg.exe' ADD "HKEY_CLASSES_ROOT\CLSID\{00000307-0000-0011-8500-00AA006DABCD}" /v "InfoTip" /t REG_SZ /d "@shdoclc.dll,-880" /f
'<SYSTEM32>\reg.exe' ADD "HKEY_CLASSES_ROOT\CLSID\{00000307-0000-0011-8500-00AA006DABCD}" /v "LocalizedString" /t REG_SZ /d "@shdoclc.dll,-880" /f
'<SYSTEM32>\wscript.exe' "%TEMP%\RarSFX0\setup_free_ddvip.vbs"
'%PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE' http://www.da##66.com/index2.html?dd###
'<SYSTEM32>\reg.exe' ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoInternetIcon" /t REG_DWORD /d 1 /f
'<SYSTEM32>\reg.exe' ADD "HKEY_CLASSES_ROOT\CLSID\{00000307-0000-0011-8500-00AA006DABCD}\DefaultIcon"
'<SYSTEM32>\reg.exe' ADD "HKEY_CLASSES_ROOT\CLSID\{00000307-0000-0011-8500-00AA006DABCD}\InProcServer32" /v "ThreadingModel" /t REG_SZ /d "Apartment" /f
'<SYSTEM32>\reg.exe' ADD "HKEY_CLASSES_ROOT\CLSID\{00000307-0000-0011-8500-00AA006DABCD}\shell"
'<SYSTEM32>\reg.exe' ADD "HKEY_CLASSES_ROOT\CLSID\{00000307-0000-0011-8500-00AA006DABCD}\shell" /ve /t REG_SZ /d "┤Є┐к╓ў╥│(&H)" /f
'<SYSTEM32>\reg.exe' ADD "HKEY_CLASSES_ROOT\CLSID\{00000307-0000-0011-8500-00AA006DABCD}\DefaultIcon" /ve /t REG_EXPAND_SZ /d "shdoclc.dll,0" /f
'<SYSTEM32>\reg.exe' ADD "HKEY_CLASSES_ROOT\CLSID\{00000307-0000-0011-8500-00AA006DABCD}\InProcServer32"
'<SYSTEM32>\reg.exe' ADD "HKEY_CLASSES_ROOT\CLSID\{00000307-0000-0011-8500-00AA006DABCD}\InProcServer32" /ve /t REG_SZ /d "%systemRoot%\system32\shdocvw.dll" /f

Изменяет следующие настройки проводника Windows (Windows Explorer):

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoInternetIcon' = '00000001'

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\RarSFX0\tool.cmd
%TEMP%\RarSFX0\ware.vbs
%TEMP%\RarSFX0\tao.ico
%TEMP%\RarSFX0\msn.exe
%TEMP%\RarSFX0\runonce.cmd
%TEMP%\RarSFX0\win.vbs
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\index2[1].html
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\Internet Exploror.lnk
%TEMP%\RarSFX0\软件下载.url
%TEMP%\RarSFX0\淘宝购物.url
%TEMP%\RarSFX0\网址导航.url
%TEMP%\RarSFX0\361.cmd
%TEMP%\RarSFX0\36OSE.vbs
%TEMP%\RarSFX0\360SE.vbs
%TEMP%\RarSFX0\setup_free_ddvip.vbs
%TEMP%\RarSFX0\360.cmd
%TEMP%\RarSFX0\36O安全浏览器 3.lnk
%TEMP%\RarSFX0\fav.cmd
%TEMP%\RarSFX0\Internet Exploror.lnk
%TEMP%\RarSFX0\cpa.cmd
%TEMP%\RarSFX0\36O安全浏览器3.lnk
%TEMP%\RarSFX0\copy.cmd