Adware.Chindo.3

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'LeiTing' = '"%ProgramFiles(x86)%\9377À×öªÖ®Å\9377À×öªÖ®ÅÂÌÉ«°æ.lnk"'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'RSDTRAY' = '"%ProgramFiles(x86)%\Rising\RSD\popwndexe.exe"'

Sets the following service settings

[HKLM\System\CurrentControlSet\Services\RsMgrSvc] 'Start' = '00000002'
[HKLM\System\CurrentControlSet\Services\RsMgrSvc] 'ImagePath' = '"%ProgramFiles(x86)%\Rising\RSD\RsMgrSvc.exe"'

Creates the following services

'RsMgrSvc' "%ProgramFiles(x86)%\Rising\RSD\RsMgrSvc.exe"
'RsMgrSvc' %ProgramFiles(x86)%\Rising\RSD\RsMgrSvc.exe

Modifies file system

Creates the following files

%TEMP%\nsa3a23.tmp
%ProgramFiles(x86)%\rising\rsd\backup\rav\hookbase\hookbase.dll
%ProgramFiles(x86)%\rising\rsd\backup\rav\hookbase\rsndisp.sys
%ProgramFiles(x86)%\rising\rsd\backup\rav\hookbase\64\rsndisp.sys
%ProgramFiles(x86)%\rising\rsd\backup\rav\hookbase\rsutils_if.dll
%ProgramFiles(x86)%\rising\rsd\backup\rav\hookbase\rsutils.sys
%ProgramFiles(x86)%\rising\rsd\backup\rav\hookbase\64\rsutils.sys
%ProgramFiles(x86)%\rising\rsd\backup\rav\hookbase\sysmon.sys
%ProgramFiles(x86)%\rising\rsd\backup\rav\hookbase\sysmon_if.dll
%ProgramFiles(x86)%\rising\rsd\backup\rav\hookbase\kguard.sys
%ProgramFiles(x86)%\rising\rsd\backup\rav\hookbase\kguard_if.dll
%ProgramFiles(x86)%\rising\rsd\backup\rav\cloudqry\cloudqry.xml
%ProgramFiles(x86)%\rising\rsd\backup\rav\cloudqry\rsnscfg.dat
%ProgramFiles(x86)%\rising\rsd\backup\rav\cloudqry\rscurl.dll
%ProgramFiles(x86)%\rising\rsd\backup\rav\cloudqry\cloudnet.dll
%ProgramFiles(x86)%\rising\rsd\backup\rav\cloudqry\cloudsta.dll
%ProgramFiles(x86)%\rising\rsd\backup\rav\cloudqry\cloudqry.dll
%ProgramFiles(x86)%\rising\rsd\backup\rav\rscfg\rscfg.xml
%ProgramFiles(x86)%\rising\rsd\backup\rav\rscfg\rscfg.dll
%ProgramFiles(x86)%\rising\rsd\backup\rav\hookbase\64\sysmon.sys
%ProgramFiles(x86)%\rising\rsd\data\rav\rav.ini
%ProgramFiles(x86)%\rising\rsd\backup\rav\hookbase\rsdll.dll.dat
%ProgramFiles(x86)%\rising\rsd\backup\rav\ravmon\ravmon.xml
%ProgramFiles(x86)%\rising\rsd\backup\rav\ravmon\mondcoms.xml
%ProgramFiles(x86)%\rising\rsd\backup\rav\ravmon\mond.xml
%ProgramFiles(x86)%\rising\rsd\backup\rav\rsdk\rsdk.xml
%ProgramFiles(x86)%\rising\rsd\backup\rav\rsdk\rsxml3a.dll
%ProgramFiles(x86)%\rising\rsd\backup\rav\rsdk\rsxml3w.dll
%ProgramFiles(x86)%\rising\rsd\backup\rav\rsdk\comx3.dll
%ProgramFiles(x86)%\rising\rsd\backup\rav\rsdk\dfw.dll
%ProgramFiles(x86)%\rising\rsd\backup\rav\rsdk\traywnd.dll
%ProgramFiles(x86)%\rising\rsd\backup\rav\rsdk\procenv.dll
%ProgramFiles(x86)%\rising\rsd\backup\rav\rsdk\rscom.dll
%ProgramFiles(x86)%\rising\rsd\backup\rav\mscrt9\mscrt9.xml
%ProgramFiles(x86)%\rising\rsd\backup\rav\mscrt9\msvcr90.dll
%ProgramFiles(x86)%\rising\rsd\backup\rav\mscrt9\msvcp90.dll
%ProgramFiles(x86)%\rising\rsd\backup\rav\mscrt9\microsoft.vc90.crt.manifest
%ProgramFiles(x86)%\rising\rsd\backup\rav\mscrt9\microsoft.vc90.atl.manifest
%ProgramFiles(x86)%\rising\rsd\backup\rav\mscrt9\atl90.dll
%ProgramFiles(x86)%\rising\rsd\backup\rav\license\license.xml
%ProgramFiles(x86)%\rising\rsd\backup\rav\license\12345678.000
%ProgramFiles(x86)%\rising\rsd\backup\rav\_rav\_rav.xml
%ProgramFiles(x86)%\rising\rsd\backup\rav\hookbase\mondrv.dll
%ProgramFiles(x86)%\rising\rsd\backup\rav\_rav\setup.xml
%ProgramFiles(x86)%\rising\rsd\rsmgrsvc.exe.log
%ProgramFiles(x86)%\rising\rsd\backup\rav\monbasedui\moncomm.dll
%ProgramFiles(x86)%\rising\rsd\backup\rav\monbasedui\rscombas.dll
%ProgramFiles(x86)%\rising\rsd\rsappmgr.dll
%ProgramFiles(x86)%\rising\rsd\rslang.dll
%ProgramFiles(x86)%\rising\rsd\os.xml
%ProgramFiles(x86)%\rising\rsd\backup\rsd\rssetup\rssetup.xml
%ProgramFiles(x86)%\rising\rsd\backup\rsd\rssetup\rstoredll.dll
%ProgramFiles(x86)%\rising\rsd\backup\rsd\rssetup\ui\snin.htm
%ProgramFiles(x86)%\rising\rsd\backup\rsd\rssetup\rsdk.dll
%ProgramFiles(x86)%\rising\rsd\backup\rsd\rssetup\rsmginfo.dll
%ProgramFiles(x86)%\rising\rsd\backup\rsd\rssetup\localopt.dll
%ProgramFiles(x86)%\rising\rsd\backup\rsd\rssetup\popwndexe.exe
%ProgramFiles(x86)%\rising\rsd\backup\rsd\rssetup\rsd932\jpn.lag
%ProgramFiles(x86)%\rising\rsd\backup\rsd\rssetup\rsd1252\eng.lag
%ProgramFiles(x86)%\rising\rsd\backup\rsd\rssetup\rsd950\cht.lag
%ProgramFiles(x86)%\rising\rsd\backup\rsd\rssetup\rsd936\chs.lag
%ProgramFiles(x86)%\rising\rsd\backup\rsd\rssetup\rsdinfo.dll
%ProgramFiles(x86)%\rising\rsd\backup\rsd\rssetup\update.xml
%ProgramFiles(x86)%\rising\rsd\backup\rsd\rssetup\protreg.sys
%ProgramFiles(x86)%\rising\rsd\backup\rsd\rssetup\syslay.dll
%ProgramFiles(x86)%\rising\rsd\cfgdll.dll
%ProgramFiles(x86)%\rising\rsd\backup\rav\hookbase\hookbase.xml
%ProgramFiles(x86)%\rising\rsd\updater.exe
%ProgramFiles(x86)%\rising\rsd\rsstub.exe
%ProgramFiles(x86)%\rising\rsd\rsmgrsvc.exe
%ProgramFiles(x86)%\rising\rsd\rsmgrsvc.ini
%ProgramFiles(x86)%\rising\rsd\xmls\rssetup.xml
%ProgramFiles(x86)%\rising\rsd\rstoredll.dll
%ProgramFiles(x86)%\rising\rsd\ui\snin.htm
%ProgramFiles(x86)%\rising\rsd\rsdk.dll
%ProgramFiles(x86)%\rising\rsd\rsmginfo.dll
%ProgramFiles(x86)%\rising\rsd\localopt.dll
%ProgramFiles(x86)%\rising\rsd\popwndexe.exe
%ProgramFiles(x86)%\rising\rsd\rsd932\jpn.lag
%ProgramFiles(x86)%\rising\rsd\rsd1252\eng.lag
%ProgramFiles(x86)%\rising\rsd\rsd950\cht.lag
%ProgramFiles(x86)%\rising\rsd\rsd936\chs.lag
%ProgramFiles(x86)%\rising\rsd\rsdinfo.dll
%ProgramFiles(x86)%\rising\rsd\update.xml
%ProgramFiles(x86)%\rising\rsd\syslay.dll
%ProgramFiles(x86)%\rising\rsd\comx3.dll
%ProgramFiles(x86)%\rising\rsd\setup.dat
%ProgramFiles(x86)%\rising\rsd\rsbackup.exe
%ProgramFiles(x86)%\rising\rsd\rsmgrsvc.dat
%TEMP%\rsdsfxtmp\rscomm\cnt09.dll
%ProgramFiles(x86)%\rising\rsd\backup\rav\monbasedui\rssrv.dll
%ProgramFiles(x86)%\rising\rsd\backup\rav\rsmondef\bawhite.dll
%ProgramFiles(x86)%\rising\rsd\backup\rav\rsmondef\monrule.dll
%ProgramFiles(x86)%\rising\rsd\backup\rav\rsmondef\x64\adefmon.mond
%ProgramFiles(x86)%\rising\rsd\backup\rav\rsmondef\adefmon.mond
%ProgramFiles(x86)%\rising\rsd\backup\rav\rsmondef\defmon.dll
%ProgramFiles(x86)%\rising\rsd\backup\rav\rsmondef\bacore.dll
%ProgramFiles(x86)%\rising\rsd\backup\rav\rsmondef\selfmon.dll
%ProgramFiles(x86)%\rising\rsd\backup\rav\ravdefdb\ravdefdb.xml
%ProgramFiles(x86)%\rising\rsd\backup\rav\ravdefdb\uprsuser.dat
%ProgramFiles(x86)%\rising\rsd\backup\rav\ravdefdb\uprsmon.dat
%ProgramFiles(x86)%\rising\rsd\backup\rav\ravdefdb\mondef.dll
%ProgramFiles(x86)%\rising\rsd\backup\rav\ravdefdb\rsuser.db1
%ProgramFiles(x86)%\rising\rsd\backup\rav\ravdefdb\rsmon.db1
%ProgramFiles(x86)%\rising\rsd\backup\rav\cloudv3\cloudv3.xml
%ProgramFiles(x86)%\rising\rsd\backup\rav\cloudv3\datastorage.db
%ProgramFiles(x86)%\rising\rsd\backup\rav\cloudv3\userdata.rstray
%ProgramFiles(x86)%\rising\rsd\backup\rav\cloudv3\userdata.mond
%ProgramFiles(x86)%\rising\rsd\backup\rav\cloudv3\cloudnotifier.dll
%ProgramFiles(x86)%\rising\rsd\backup\rav\cloudv3\dataups.dat
%ProgramFiles(x86)%\rising\rsd\backup\rav\rsmondef\bawhite.dat
%ProgramFiles(x86)%\rising\rsd\backup\rav\cloudv3\cloudwork.dll
%ProgramFiles(x86)%\rising\rsd\backup\rsd\rssetup\comx3.dll
%ProgramFiles(x86)%\rising\rsd\backup\rav\cloudv3\cloudstore.dll
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\procinfo.dat
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\autoflux.dat
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\urlmon.cfg
%ALLUSERSPROFILE%\kingsoft\kis\kws\dfcache.dat
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\webui\icon\btbg.gif
%ALLUSERSPROFILE%\kingsoft\kis\kws\urlcache.dat
%ALLUSERSPROFILE%\kingsoft\ksbw\kns2.che
%TEMP%\rspcver12.xml.rs
%TEMP%\etilqs_ktdm04sbtjurgrf
%TEMP%\etilqs_9wyircalf7xydb5
%TEMP%\etilqs_pdlvsxqnefwxoqx
%TEMP%\etilqs_tqg06mtbscslfp1
%TEMP%\etilqs_ayltkbj0fgw8l7v
%TEMP%\etilqs_avsxkluvew0yzid
%TEMP%\etilqs_dnrqiqvdjprbxu4
%TEMP%\etilqs_zgjsbisnrhuqhnz
%TEMP%\nsq3a34.tmp\sohuva_4.2.0.16-c204900003-ng-nti-tp-s-x.exe
%ALLUSERSPROFILE%\rising\rav\language.ini
%ALLUSERSPROFILE%\rising\rav\rav.ini
%ProgramFiles(x86)%\rising\rsd\backup\rav\rsmondef\rsmondef.xml
%ProgramFiles(x86)%\rising\rsd\backup\rav\rsmondef\antipromotionmon.dll
%ProgramFiles(x86)%\rising\rsd\setup.exe
%ProgramFiles(x86)%\rising\rsd\backup\rav\cloudv3\cloudv3.dll
%ProgramFiles(x86)%\rising\rsd\backup\rav\ravconfig\ravcfg.xml
%ProgramFiles(x86)%\rising\rsd\backup\rav\ravbase\rssmall.bmp
%ProgramFiles(x86)%\rising\rsd\backup\rav\ravbase\pngdll.dll
%ProgramFiles(x86)%\rising\rsd\backup\rav\ravbase\rspalvd.dll
%ProgramFiles(x86)%\rising\rsd\backup\rav\ravbase\repair.url
%ProgramFiles(x86)%\rising\rsd\backup\rav\ravbase\url.ini
%ProgramFiles(x86)%\rising\rsd\backup\rav\ravbase\setup.dat
%ProgramFiles(x86)%\rising\rsd\backup\rav\ravbase\rstask.xml
%ProgramFiles(x86)%\rising\rsd\backup\rav\ravbase\logdc.bmp
%ProgramFiles(x86)%\rising\rsd\backup\rav\ravbase\logac.bmp
%ProgramFiles(x86)%\rising\rsd\backup\rav\ravbase\rav.ico
%ProgramFiles(x86)%\rising\rsd\backup\rav\ravbase\rsmain.ico
%ProgramFiles(x86)%\rising\rsd\backup\rav\ravbase\rising.ico
%ProgramFiles(x86)%\rising\rsd\backup\rav\ravbase\rstray.ico
%ProgramFiles(x86)%\rising\rsd\backup\rav\ravbase\ravsetup.dll
%ProgramFiles(x86)%\rising\rsd\backup\rav\rav936\rav936.xml
%ProgramFiles(x86)%\rising\rsd\backup\rav\rav936\chs.lag
%ProgramFiles(x86)%\rising\rsd\backup\rav\rav936\lics936.txt
%ProgramFiles(x86)%\rising\rsd\backup\rav\monbasedui\monbasedui.xml
%ProgramFiles(x86)%\rising\rsd\backup\rav\ravbase\repairmanager.mondcoms
%ProgramFiles(x86)%\rising\rsd\backup\rav\cloudv3\localopt.dll
%ProgramFiles(x86)%\rising\rsd\backup\rav\monbasedui\ravmond.exe
%ProgramFiles(x86)%\rising\rsd\backup\rav\ravbase\repairmanager.mond
%ProgramFiles(x86)%\rising\rsd\backup\rav\ravxp\ravxp.xml
%ProgramFiles(x86)%\rising\rsd\backup\rav\ravxp\ravxp.exe
%ProgramFiles(x86)%\rising\rsd\backup\rav\rscomm\rscomm.xml
%ProgramFiles(x86)%\rising\rsd\backup\rav\rscomm\rsbasenetwrapper.dll
%ProgramFiles(x86)%\rising\rsd\backup\rav\rscomm\rssqlite.dll
%ProgramFiles(x86)%\rising\rsd\backup\rav\rscomm\rscommx2.dll
%ProgramFiles(x86)%\rising\rsd\backup\rav\rscomm\moncom08.dll
%ProgramFiles(x86)%\rising\rsd\backup\rav\rscomm\syslay.dll
%ProgramFiles(x86)%\rising\rsd\backup\rav\rscomm\proccomm.dll
%ProgramFiles(x86)%\rising\rsd\backup\rav\rscomm\proccom.dll
%ProgramFiles(x86)%\rising\rsd\backup\rav\rscomm\cnt08.dll
%ProgramFiles(x86)%\rising\rsd\backup\rav\rscomm\cnt09.dll
%ProgramFiles(x86)%\rising\rsd\backup\rav\ravmaindui\ravmaindui.xml
%ProgramFiles(x86)%\rising\rsd\backup\rav\ravmaindui\rsmain.dll
%ProgramFiles(x86)%\rising\rsd\backup\rav\ravmaindui\rsmain.exe
%ProgramFiles(x86)%\rising\rsd\backup\rav\ravlog\ravlog.xml
%ProgramFiles(x86)%\rising\rsd\backup\rav\ravlog\rslog.dll
%ProgramFiles(x86)%\rising\rsd\backup\rav\ravconfig\ravconfig.xml
%ProgramFiles(x86)%\rising\rsd\backup\rav\ravconfig\mergexml.dll
%ProgramFiles(x86)%\rising\rsd\backup\rav\ravbase\ravbase.xml
%ProgramFiles(x86)%\rising\rsd\backup\rav\ravbase\repairmanager.dll
%ProgramFiles(x86)%\rising\rsd\backup\rsd\rssetup\setup.dat
%ProgramFiles(x86)%\rising\rsd\backup\rsd\rssetup\rsbackup.exe
%ProgramFiles(x86)%\rising\rsd\backup\rsd\rssetup\rsmgrsvc.exe
%TEMP%\rsdsfxtmp\ravconfig\ravcfg.xml
%TEMP%\rsdsfxtmp\auto.ini
%TEMP%\rsdsfxtmp\rav936\lics936.txt
%TEMP%\rsdsfxtmp\ui\snin.htm
%TEMP%\rsdsfxtmp\_rav\_rav.xml
%TEMP%\rsdsfxtmp\update.xml
%TEMP%\rsdsfxtmp\_rav\setup.xml
%TEMP%\rsdsfxtmp\ravbase\rstask.xml
%TEMP%\rsdsfxtmp\rssetup.xml
%TEMP%\rsdsfxtmp\rsmondef\rsmondef.xml
%TEMP%\rsdsfxtmp\rsdk\rsdk.xml
%TEMP%\rsdsfxtmp\rscomm\rscomm.xml
%TEMP%\rsdsfxtmp\rscfg\rscfg.xml
%TEMP%\rsdsfxtmp\ravxp\ravxp.xml
%TEMP%\rsdsfxtmp\ravmon\ravmon.xml
%TEMP%\rsdsfxtmp\ravmaindui\ravmaindui.xml
%TEMP%\rsdsfxtmp\ravlog\ravlog.xml
%TEMP%\rsdsfxtmp\ravdefdb\ravdefdb.xml
%TEMP%\rsdsfxtmp\ravconfig\ravconfig.xml
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\9377Г Г—Г¶ВЄГ¶В®ГҐВ\uninstall.lnk
%TEMP%\rsdsfxtmp\cloudv3\datastorage.db
%TEMP%\rsdsfxtmp\license\12345678.000
%TEMP%\rsdsfxtmp\rsmondef\bawhite.dat
%TEMP%\rsdsfxtmp\cloudv3\dataups.dat
%TEMP%\rsdsfxtmp\ravbase\repairmanager.mond
%TEMP%\rsdsfxtmp\rsmondef\x64\adefmon.mond
%TEMP%\rsdsfxtmp\rsmondef\adefmon.mond
%TEMP%\rsdsfxtmp\rsd932\jpn.lag
%TEMP%\rsdsfxtmp\rsd1252\eng.lag
%TEMP%\rsdsfxtmp\rsd950\cht.lag
%TEMP%\rsdsfxtmp\rav936\chs.lag
%TEMP%\rsdsfxtmp\rsd936\chs.lag
%TEMP%\rsdsfxtmp\compsver.inf
%TEMP%\rsdsfxtmp\ravdefdb\rsuser.db1
%TEMP%\rsdsfxtmp\ravdefdb\rsmon.db1
%TEMP%\rsdsfxtmp\ravdefdb\uprsuser.dat
%TEMP%\rsdsfxtmp\ravdefdb\uprsmon.dat
%TEMP%\rsdsfxtmp\setup.dat
%TEMP%\rsdsfxtmp\ravbase\setup.dat
%TEMP%\rsdsfxtmp\cloudqry\rsnscfg.dat
%TEMP%\rsdsfxtmp\hookbase\rsdll.dll.dat
%TEMP%\rsdsfxtmp\label.dat
%TEMP%\rsdsfxtmp\cloudv3\userdata.mond
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\fluxcache.dat
%TEMP%\rsdsfxtmp\ravbase\repairmanager.mondcoms
%TEMP%\rsdsfxtmp\os.xml
%TEMP%\nsa6a96.tmp\system.dll
C:\users\public\desktop\9377Г Г—Г¶ВЄГ¶В®ГҐВ.lnk
%ProgramFiles(x86)%\9377Г Г—Г¶ВЄГ¶В®ГҐВ\replay.htm
%TEMP%\nsa6a96.tmp\inetc.dll
%ProgramFiles(x86)%\9377Г Г—Г¶ВЄГ¶В®ГҐВ\ltlogger.ini
%ProgramFiles(x86)%\9377Г Г—Г¶ВЄГ¶В®ГҐВ\uninstall.exe
%ProgramFiles(x86)%\9377Г Г—Г¶ВЄГ¶В®ГҐВ\leiting.dll
%ProgramFiles(x86)%\9377Г Г—Г¶ВЄГ¶В®ГҐВ\ltlogger.exe
%TEMP%\nsa6a96.tmp\ip.dll
%TEMP%\nsl6a86.tmp
%APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\9377Г Г—Г¶ВЄГ¶В®ГҐВ.lnk
%TEMP%\nsq3a34.tmp\zzaz_01.exe
%TEMP%\nsq3a34.tmp\execcmd.dll
%TEMP%\nsq3a34.tmp\kele2014beta3.6.2promote0326_20090195130.exe
%TEMP%\nsq3a34.tmp\nsisdl.dll
%TEMP%\nsq3a34.tmp\base64.dll
%TEMP%\nsq3a34.tmp\1.zip
%TEMP%\nsq3a34.tmp\inetc.dll
%TEMP%\nsq3a34.tmp\system.dll
%TEMP%\rsdsfxtmp\rav936\rav936.xml
%TEMP%\rsdsfxtmp\ravbase\ravbase.xml
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\9377Г Г—Г¶ВЄГ¶В®ГҐВ\9377Г Г—Г¶ВЄГ¶В®ГҐВ.lnk
%TEMP%\rsdsfxtmp\rav.7z
%ProgramFiles(x86)%\9377Г Г—Г¶ВЄГ¶В®ГҐВ\9377Г Г—Г¶ВЄГ¶В®ГҐВГўГ¬Г©В«В°Г¦.lnk
%TEMP%\rsdsfxtmp\mscrt9\mscrt9.xml
%TEMP%\rsdsfxtmp\ravmon\mondcoms.xml
%TEMP%\rsdsfxtmp\ravmon\mond.xml
%TEMP%\rsdsfxtmp\monbasedui\monbasedui.xml
%TEMP%\rsdsfxtmp\license\license.xml
%TEMP%\rsdsfxtmp\hookbase\hookbase.xml
%TEMP%\rsdsfxtmp\custom.xml
%TEMP%\rsdsfxtmp\cloudv3\cloudv3.xml
%TEMP%\rsdsfxtmp\cloudqry\cloudqry.xml
%TEMP%\rsdsfxtmp\mscrt9\microsoft.vc90.crt.manifest
%TEMP%\rsdsfxtmp\mscrt9\microsoft.vc90.atl.manifest
%TEMP%\rsdsfxtmp\ravbase\rstray.ico
%TEMP%\rsdsfxtmp\ravbase\rsmain.ico
%TEMP%\rsdsfxtmp\ravbase\rising.ico
%TEMP%\rsdsfxtmp\ravbase\rav.ico
%TEMP%\rsdsfxtmp\ravbase\rssmall.bmp
%TEMP%\rsdsfxtmp\ravbase\logdc.bmp
%TEMP%\rsdsfxtmp\ravbase\logac.bmp
%TEMP%\nsq3a34.tmp\install1078565.exe
%ProgramFiles(x86)%\rising\rav\netconfig.ini
%TEMP%\rsdsfxtmp\cloudv3\userdata.rstray
%TEMP%\rsdsfxtmp\monbasedui\ravmond.exe
%TEMP%\rsdsfxtmp\syslay.dll
%TEMP%\rsdsfxtmp\rsmondef\selfmon.dll
%TEMP%\rsdsfxtmp\rsdk\rsxml3w.dll
%TEMP%\rsdsfxtmp\rsdk\rsxml3a.dll
%TEMP%\rsdsfxtmp\hookbase\rsutils_if.dll
%TEMP%\rsdsfxtmp\rstoredll.dll
%TEMP%\rsdsfxtmp\monbasedui\rssrv.dll
%TEMP%\rsdsfxtmp\rscomm\rssqlite.dll
%TEMP%\rsdsfxtmp\ravbase\rspalvd.dll
%TEMP%\rsdsfxtmp\rsmginfo.dll
%TEMP%\rsdsfxtmp\ravmaindui\rsmain.dll
%TEMP%\rsdsfxtmp\ravlog\rslog.dll
%TEMP%\rsdsfxtmp\rslang.dll
%TEMP%\rsdsfxtmp\rsdk.dll
%TEMP%\rsdsfxtmp\rsdinfo.dll
%TEMP%\rsdsfxtmp\cloudqry\rscurl.dll
%TEMP%\rsdsfxtmp\rscomm\rscommx2.dll
%TEMP%\rsdsfxtmp\monbasedui\rscombas.dll
%TEMP%\rsdsfxtmp\rsdk\rscom.dll
%TEMP%\rsdsfxtmp\ravbase\repair.url
%TEMP%\rsdsfxtmp\rscfg\rscfg.dll
%TEMP%\rsdsfxtmp\rscomm\rsbasenetwrapper.dll
%TEMP%\rsdsfxtmp\hookbase\kguard.sys
%TEMP%\rsdsfxtmp\rscomm\syslay.dll
%ProgramFiles(x86)%\rising\rsd\backup\rsd\rssetup\rsstub.exe
%ProgramFiles(x86)%\rising\rsd\backup\rsd\rssetup\updater.exe
%ProgramFiles(x86)%\rising\rsd\backup\rsd\rssetup\setup.exe
%ProgramFiles(x86)%\rising\rsd\backup\rsd\rssetup\cfgdll.dll
%ProgramFiles(x86)%\rising\rsd\backup\rsd\rssetup\rsappmgr.dll
%ProgramFiles(x86)%\rising\rsd\backup\rsd\rssetup\rslang.dll
%ProgramFiles(x86)%\rising\rsd\backup\rsd\rssetup\os.xml
%TEMP%\rav.cfg.tmp
%TEMP%\rav.cfg
%TEMP%\rsdsfxtmp\install1078565.exe.log
%ProgramFiles(x86)%\rstest.ini
%TEMP%\rsdsfxtmp\hookbase\sysmon.sys
%TEMP%\rsdsfxtmp\hookbase\64\sysmon.sys
%TEMP%\rsdsfxtmp\hookbase\rsutils.sys
%TEMP%\rsdsfxtmp\hookbase\64\rsutils.sys
%TEMP%\rsdsfxtmp\hookbase\rsndisp.sys
%TEMP%\rsdsfxtmp\hookbase\64\rsndisp.sys
%TEMP%\rsdsfxtmp\protreg.sys
%TEMP%\rsdsfxtmp\rsdk\traywnd.dll
%TEMP%\rsdsfxtmp\popwndexe.exe
%TEMP%\rsdsfxtmp\hookbase\sysmon_if.dll
%TEMP%\rsdsfxtmp\ravbase\url.ini
%TEMP%\rsdsfxtmp\cloudv3\cloudwork.dll
%TEMP%\rsdsfxtmp\cloudv3\cloudv3.dll
%TEMP%\rsdsfxtmp\cloudv3\cloudstore.dll
%TEMP%\rsdsfxtmp\cloudqry\cloudsta.dll
%TEMP%\rsdsfxtmp\cloudqry\cloudqry.dll
%TEMP%\rsdsfxtmp\cloudv3\cloudnotifier.dll
%TEMP%\rsdsfxtmp\cloudqry\cloudnet.dll
%TEMP%\rsdsfxtmp\cfgdll.dll
%TEMP%\rsdsfxtmp\rsmondef\bawhite.dll
%TEMP%\rsdsfxtmp\rsmondef\bacore.dll
%TEMP%\rsdsfxtmp\mscrt9\atl90.dll
%TEMP%\rsdsfxtmp\rsmondef\antipromotionmon.dll
%TEMP%\rsdsfxtmp\updater.exe
%TEMP%\rsdsfxtmp\setup.exe
%TEMP%\rsdsfxtmp\rsstub.exe
%TEMP%\rsdsfxtmp\rsmgrsvc.exe
%TEMP%\rsdsfxtmp\ravmaindui\rsmain.exe
%TEMP%\rsdsfxtmp\rsbackup.exe
%TEMP%\rsdsfxtmp\ravxp\ravxp.exe
%TEMP%\rsdsfxtmp\ravbase\ravsetup.dll
%TEMP%\rsdsfxtmp\rsappmgr.dll
%TEMP%\rsdsfxtmp\ravbase\repairmanager.dll
%TEMP%\rsdsfxtmp\rsdk\comx3.dll
%TEMP%\rsdsfxtmp\rscomm\cnt08.dll
%TEMP%\rsdsfxtmp\rsdk\procenv.dll
%TEMP%\rsdsfxtmp\rscomm\proccomm.dll
%TEMP%\rsdsfxtmp\rscomm\proccom.dll
%TEMP%\rsdsfxtmp\ravbase\pngdll.dll
%TEMP%\rsdsfxtmp\mscrt9\msvcr90.dll
%TEMP%\rsdsfxtmp\mscrt9\msvcp90.dll
%TEMP%\rsdsfxtmp\rsmondef\monrule.dll
%TEMP%\rsdsfxtmp\hookbase\mondrv.dll
%TEMP%\rsdsfxtmp\ravdefdb\mondef.dll
%TEMP%\rsdsfxtmp\monbasedui\moncomm.dll
%TEMP%\rsdsfxtmp\rscomm\moncom08.dll
%TEMP%\rsdsfxtmp\ravconfig\mergexml.dll
%TEMP%\rsdsfxtmp\cloudv3\localopt.dll
%TEMP%\rsdsfxtmp\localopt.dll
%TEMP%\rsdsfxtmp\hookbase\kguard_if.dll
%TEMP%\rsdsfxtmp\hookbase\hookbase.dll
%TEMP%\rsdsfxtmp\rsdk\dfw.dll
%TEMP%\rsdsfxtmp\rsmondef\defmon.dll
%TEMP%\rsdsfxtmp\comx3.dll
%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\fluxstastic.dat

Deletes the following files

%TEMP%\nsq3a34.tmp\kele2014beta3.6.2promote0326_20090195130.exe
%TEMP%\nsa6a96.tmp\inetc.dll
%TEMP%\nsa6a96.tmp\ip.dll
%TEMP%\nsa6a96.tmp\system.dll
%TEMP%\rsdsfxtmp\rav.7z
%ProgramFiles(x86)%\rstest.ini
%TEMP%\rav.cfg
%TEMP%\rspcver12.xml
%TEMP%\nsq3a34.tmp\base64.dll
%TEMP%\nsq3a34.tmp\execcmd.dll
%TEMP%\nsq3a34.tmp\inetc.dll
%TEMP%\nsq3a34.tmp\install1078565.exe
%TEMP%\nsq3a34.tmp\nsisdl.dll
%TEMP%\nsq3a34.tmp\sohuva_4.2.0.16-c204900003-ng-nti-tp-s-x.exe
%TEMP%\nsq3a34.tmp\system.dll
%TEMP%\nsq3a34.tmp\zzaz_01.exe

Moves the following files

from %TEMP%\rsdsfxtmp\license\12345678.000 to %TEMP%\rsdsfxtmp\license\12345678.000.bak
from %TEMP%\rav.cfg to %TEMP%\rav.cfg.bak
from %TEMP%\rspcver12.xml.rs to %TEMP%\rspcver12.xml

Substitutes the following files

%TEMP%\rsdsfxtmp\license\12345678.000
%TEMP%\rav.cfg
%TEMP%\rav.cfg.tmp

Network activity

Connects to

'pv.#ohu.com':80
'am##on.com':443
'se####.yahoo.com':443
'bing.com':80
'am##on.com':80
'au######te.geo.opera.com':443
'du###uckgo.com':443
'se####.yahoo.com':80
'google.com':80
'au######te.geo.opera.com':80
'en.###ipedia.org':80
'10#####-1.vod.tv.itc.cn':80
'p2#.#d.sohu.com':80
'do####ad.2345.cn':80
'rs####.rising.com.cn':80
'ce####.rising.com.cn':80
'93##.com':80
'do#####d.suxiazai.com':80
'xi###i.9377.com':80
'ke##55.com':80
'd.###005.com':80
'da##.vod.itc.cn':80
'en.###ipedia.org':443

TCP

HTTP GET requests

http://pv.#ohu.com/cityjson
http://www.am##on.com/favicon.ico
http://se####.yahoo.com/favicon.ico
http://www.google.com/favicon.ico
http://au######te.geo.opera.com/geolocation/
http://rs####.rising.com.cn/rs2012/RsPcVer12.xml
http://10#####-1.vod.tv.itc.cn/sohu/ifox/LzEwMS8amBelPKkhq6mcq6SnKyUqMKqonDEaHLGjFzK8GUmZD0xMC/SoHuVA_7.1.9.0-c204900003-ng-nti-tp-s-x.exe
http://da##.vod.itc.cn/foxd/gz?fi#####################################################################################
http://p2#.#d.sohu.com/dcs.do?f=#################################
http://do####ad.2345.cn/silence/2345Explorer_329242_silence.exe
http://rs####.rising.com.cn/Register/OnlineHelper/ForLog/ForLogDeve.aspx?In######################################################################################################################...
http://ce####.rising.com.cn/LogCenter.asp?in#####################################################################################################################################################...
http://do#####d.suxiazai.com/for_down/2013/install1078565.exe
http://xi###i.9377.com/20150526/zzaz_01.exe
http://www.ke##55.com/
http://d.###005.com/TG/KeLe2014Beta3.6.2Promote0326_20090195130.exe
http://www.bing.com/s/a/bing_p.ico
http://en.###ipedia.org/favicon.ico

HTTP POST requests

http://www.93##.com/api/client_data_receive.php?Na###############################################################################################################################################...

Other

'du###uckgo.com':443
'au######te.geo.opera.com':443
'se####.yahoo.com':443
'am##on.com':443
'en.###ipedia.org':443

UDP

DNS ASK pv.#ohu.com
DNS ASK bing.com
DNS ASK am##on.com
DNS ASK du###uckgo.com
DNS ASK se####.yahoo.com
DNS ASK au######te.geo.opera.com
DNS ASK google.com
DNS ASK da###.iruixing.com
DNS ASK 10#####-1.vod.tv.itc.cn
DNS ASK da##.vod.itc.cn
DNS ASK bi##.#ikimedia.org
DNS ASK p2#.#d.sohu.com
DNS ASK do#####d.juezhao123.com
DNS ASK rs####.rising.com.cn
DNS ASK ce####.rising.com.cn
DNS ASK w.#.#aidu.com
DNS ASK 93##.com
DNS ASK do#####d.suxiazai.com
DNS ASK xi###i.9377.com
DNS ASK ke##55.com
DNS ASK d.###005.com
DNS ASK do####ad.2345.cn
DNS ASK en.###ipedia.org

Miscellaneous

Searches for the following windows

ClassName: 'Opera_MessageWindow' WindowName: '%APPDATA%\Opera Software\Opera Stable'

Creates and executes the following

'%TEMP%\nsq3a34.tmp\zzaz_01.exe'
'%TEMP%\nsq3a34.tmp\install1078565.exe'
'%ProgramFiles(x86)%\rising\rsd\rsmgrsvc.exe'
'%ProgramFiles(x86)%\rising\rsd\popwndexe.exe'
'%TEMP%\nsq3a34.tmp\sohuva_4.2.0.16-c204900003-ng-nti-tp-s-x.exe'
'%WINDIR%\syswow64\cmd.exe' /C copy /b "KeLe2014Beta3.6.2Promote0326_20090195130.exe" + "%WINDIR%\Fonts\SIMSUN.TTC" "KeLe2014Beta3.6.2Promote0326_20090195130.exe"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C copy /b "2345Explorer_329242_silence.exe" + "%WINDIR%\Fonts\SIMSUN.TTC" "2345Explorer_329242_silence.exe"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /C copy /b "SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-x.exe" + "%WINDIR%\Fonts\SIMSUN.TTC" "SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-x.exe"' (with hidden window)
'%WINDIR%\syswow64\regsvr32.exe' /s "%APPDATA%\搜狐影音\7.1.9.0\SHBHO.dll"' (with hidden window)
'%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kavlog2.exe' -install' (with hidden window)
'%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kxetray.exe' /autorun /hidefloatwin /silentinstrcmd' (with hidden window)
'%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kxescore.exe' /start kxescore' (with hidden window)
'%ProgramFiles(x86)%\kingsoft\kingsoft antivirus\kislive.exe' /autorun /std /skipcs3' (with hidden window)
'%APPDATA%\搜狐影音\7.1.9.0\fileassociationstool.exe' /EnableAutoRun' (with hidden window)

Executes the following

'%WINDIR%\syswow64\cmd.exe' /C copy /b "KeLe2014Beta3.6.2Promote0326_20090195130.exe" + "%WINDIR%\Fonts\SIMSUN.TTC" "KeLe2014Beta3.6.2Promote0326_20090195130.exe"
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="3464.16.737905176\1584838475" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="3464.15.1283637638\520814680" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%WINDIR%\syswow64\cmd.exe' /C copy /b "SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-x.exe" + "%WINDIR%\Fonts\SIMSUN.TTC" "SoHuVA_4.2.0.16-c204900003-ng-nti-tp-s-x.exe"
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="3464.12.186549890\233208731" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="3464.11.701590822\994592689" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="3464.10.55353596\566032200" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="3464.9.492631111\1308391767" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="3464.8.936635528\903520372" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="3464.7.178883656\816008596" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%WINDIR%\syswow64\regsvr32.exe' /s "%APPDATA%\搜狐影音\7.1.9.0\SHBHO.dll"
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="3464.6.951353744\1946054747" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="3464.5.1974786016\1316874666" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="3464.4.1469104198\326926464" --lang=en-US --no-sandbox --enable-proprietary-media-types-playback /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=renderer --alt-high-dpi-setting=96 --disable-direct-npapi-requests --enable-deferred-image-decoding --lang=en-US --enable-proprietary-media-types-playback --extension-process --enable-we...
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=renderer --alt-high-dpi-setting=96 --disable-direct-npapi-requests --enable-deferred-image-decoding --lang=en-US --enable-proprietary-media-types-playback --disable-client-side-phishing-...
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=gpu-process --channel="3464.0.306847991\1671949169" --enable-proprietary-media-types-playback --supports-dual-gpus=false --gpu-driver-bug-workarounds=1,19,42 --gpu-vendor-id=0x0000 --gpu...
'%WINDIR%\syswow64\cmd.exe' /C copy /b "2345Explorer_329242_silence.exe" + "%WINDIR%\Fonts\SIMSUN.TTC" "2345Explorer_329242_silence.exe"
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe' -noautoupdate --ran-launcher -- http://llgholding.com/eHJscHJybncuZXhl/40.html /crash-reporter-parent-id=3464
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' -noautoupdate --ran-launcher -- http://llgholding.com/eHJscHJybncuZXhl/40.html
'%ProgramFiles(x86)%\opera\launcher.exe' -noautoupdate -- "http://llgholding.com/eHJscHJybncuZXhl/40.html"
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe' --type=utility --channel="3464.4.1469104198\326926464" --lang=en-US --no-sandbox --enable-proprietary-media-types-playback /prefetch:-645351001 /crash-reporter-parent-id=2136
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="3464.17.142153526\1474807443" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001

Технології

Терміни

Навчання

Міфи

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней