Trojan.Click2.55435

Техническая информация

Для обеспечения автозапуска и распространения:

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\Kingsoft Antivirus WebShield Service] 'Start' = '00000002'

Вредоносные функции:

Создает и запускает на исполнение:

'%ALLUSERSPROFILE%\Application Data\smes\smes.exe' -install
'%ALLUSERSPROFILE%\Application Data\smes\smes.exe' -start
'%ALLUSERSPROFILE%\Application Data\smes\smes.exe'
'%PROGRAM_FILES%\soft122807\setup_1207.exe'
'%PROGRAM_FILES%\soft122807\w_1207.exe'
'%PROGRAM_FILES%\soft122807\setup_1207.exe' (загружен из сети Интернет)

Запускает на исполнение:

'%WINDIR%\sleep.exe' 500
'%PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE' http://www.ad##ma.cn/g/

Изменения в файловой системе:

Создает следующие файлы:

%PROGRAM_FILES%\soft122807\0720110703070716280712070707.txt
%PROGRAM_FILES%\soft122807\B_0720110703070716280712070707.txt
%PROGRAM_FILES%\soft122807\w_1207.exe
%PROGRAM_FILES%\soft122807\C_0720110703070716280712070707.txt
%PROGRAM_FILES%\soft122807\setup_1207.exe
%TEMP%\nsk2.tmp\NSISdl.dll
%TEMP%\nsk2.tmp\System.dll
%PROGRAM_FILES%\soft122807\smes.exe
%PROGRAM_FILES%\FlashD\tabs\Thumbs.db
%PROGRAM_FILES%\FlashD\tabs\TabbaseT.bmp
%PROGRAM_FILES%\FlashD\tabs\TabbaseB.bmp
%PROGRAM_FILES%\FlashD\tabs\tabs.ini
%PROGRAM_FILES%\soft122807\a
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\ Intornet Explarer .lnk
%ALLUSERSPROFILE%\Desktop\ Intornet Explarer .lnk
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\g[1]
%ALLUSERSPROFILE%\Application Data\kingsoft\kws\spot.ini
%ALLUSERSPROFILE%\Application Data\kingsoft\kws\spitesp.dat
%ALLUSERSPROFILE%\Application Data\kingsoft\kws\kws.ini
%TEMP%\nsk4.tmp\AccessControl.dll
%PROGRAM_FILES%\soft122807\JJmatch_11494.exe
%ALLUSERSPROFILE%\Application Data\smes\KWSSVC.log
%TEMP%\temg_tmp.bat
%ALLUSERSPROFILE%\Application Data\smes\a
%ALLUSERSPROFILE%\Application Data\smes\kswebshield.dll
%ALLUSERSPROFILE%\Application Data\smes\kswbc.dll
%TEMP%\nsk4.tmp\FindProcDLL.dll
%ALLUSERSPROFILE%\Application Data\smes\kwssp.dll
%ALLUSERSPROFILE%\Application Data\smes\u.bat
%ALLUSERSPROFILE%\Application Data\smes\smes.exe
%ALLUSERSPROFILE%\Application Data\smes\kwsui.dll
%PROGRAM_FILES%\FlashD\inc\msg.jpg
%PROGRAM_FILES%\FlashD\inc\cls.jpg
%PROGRAM_FILES%\FlashD\inc\Thumbs.db
%PROGRAM_FILES%\FlashD\inc\nocls.jpg
%PROGRAM_FILES%\FlashD\search\searchs.ini
%PROGRAM_FILES%\FlashD\search\mul.ini
%PROGRAM_FILES%\FlashD\inc\nomsg.jpg
%PROGRAM_FILES%\FlashD\inc\Progress.bmp
%PROGRAM_FILES%\FlashD\FlashD.exe
%PROGRAM_FILES%\FlashD\CrCom.dll
%PROGRAM_FILES%\FlashD\Config.dat
%PROGRAM_FILES%\FlashD\LCmnCtrl32.dll
%PROGRAM_FILES%\FlashD\inc\NoHide.gif
%PROGRAM_FILES%\FlashD\inc\Hide.gif
%PROGRAM_FILES%\FlashD\lexplorer.ini
%PROGRAM_FILES%\FlashD\Plugin\GetWebSnap\GetWebSnap.dll
%PROGRAM_FILES%\FlashD\tabs\TabActive_L.bmp
%PROGRAM_FILES%\FlashD\tabs\TabActive_C.bmp
%PROGRAM_FILES%\FlashD\tabs\tabsDown\tabs.ini
%PROGRAM_FILES%\FlashD\tabs\TabActive_R.bmp
%PROGRAM_FILES%\FlashD\tabs\TabNormal_R.bmp
%PROGRAM_FILES%\FlashD\tabs\TabNormal_L.bmp
%PROGRAM_FILES%\FlashD\tabs\TabNormal_C.bmp
%PROGRAM_FILES%\FlashD\tabs\tabsDown\Thumbs.db
%PROGRAM_FILES%\FlashD\tabs\tabsDown\TabActive_L.bmp
%PROGRAM_FILES%\FlashD\tabs\tabsDown\TabActive_C.bmp
%PROGRAM_FILES%\FlashD\Plugin\GetWebSnap\GetWebSnap.ini
%PROGRAM_FILES%\FlashD\tabs\tabsDown\TabActive_R.bmp
%PROGRAM_FILES%\FlashD\tabs\tabsDown\TabNormal_R.bmp
%PROGRAM_FILES%\FlashD\tabs\tabsDown\TabNormal_L.bmp
%PROGRAM_FILES%\FlashD\tabs\tabsDown\TabNormal_C.bmp

Удаляет следующие файлы:

%TEMP%\nsk4.tmp\FindProcDLL.dll
%TEMP%\nsk4.tmp\AccessControl.dll

Перемещает следующие файлы:

%PROGRAM_FILES%\soft122807\0720110703070716280712070707.txt в %PROGRAM_FILES%\soft122807\b_1207.vbe
%PROGRAM_FILES%\soft122807\C_0720110703070716280712070707.txt в %PROGRAM_FILES%\soft122807\C_1207.vbe
%PROGRAM_FILES%\soft122807\B_0720110703070716280712070707.txt в %PROGRAM_FILES%\soft122807\B.bat
%PROGRAM_FILES%\soft122807\a в %PROGRAM_FILES%\soft122807\122807.txt
%PROGRAM_FILES%\soft122807\smes.exe в %PROGRAM_FILES%\soft122807\w_1207.exe

Сетевая активность:

Подключается к: