Trojan.Click2.14760

To ensure autorun and distribution

Creates or modifies the following files

Modifies file system

Creates the following files

Deletes the following files

Moves the following files

from %APPDATA%\winsxsey\is-h2tvo.tmp to %APPDATA%\winsxsey\copyie.ico
from %HOMEPATH%\favorites\Г¬ГґВ±В¦ГГё to %HOMEPATH%\favorites\Г¬ГґВ±В¦ГГё.lnk
from %APPDATA%\microsoft\internet explorer\quick launch\internet exploren to %APPDATA%\microsoft\internet explorer\quick launch\internet exploren.lnk
from %HOMEPATH%\desktop\Г¬ГґВ±В¦ГГё to %HOMEPATH%\desktop\Г¬ГґВ±В¦ГГё.lnk
from %HOMEPATH%\desktop\internet exploren to %HOMEPATH%\desktop\internet exploren.lnk
from %APPDATA%\winsxsey\is-3uvjh.tmp to %APPDATA%\winsxsey\kgsetup.exe
from %APPDATA%\winsxsey\is-a74lv.tmp to %APPDATA%\winsxsey\vva.reg
from %APPDATA%\winsxsey\is-phjat.tmp to %APPDATA%\winsxsey\b.bat
from %APPDATA%\winsxsey\is-h9i8u.tmp to %APPDATA%\winsxsey\alllink.dll
from %APPDATA%\winsxsey\is-vjm26.tmp to %APPDATA%\winsxsey\winsys.dll
from %APPDATA%\winsxsey\is-l51hg.tmp to %APPDATA%\winsxsey\winqq.exe
from %APPDATA%\winsxsey\is-4em9q.tmp to %APPDATA%\winsxsey\winname.exe
from %APPDATA%\winsxsey\is-q2jiu.tmp to %APPDATA%\winsxsey\taoshop.exe
from %APPDATA%\winsxsey\is-qmg2d.tmp to %APPDATA%\winsxsey\qqsyse.dll
from %APPDATA%\winsxsey\is-puajo.tmp to %APPDATA%\winsxsey\interexp.exe
from %APPDATA%\winsxsey\is-flh6s.tmp to %APPDATA%\winsxsey\shop.ico
from %HOMEPATH%\favorites\Г°ВЎГіГ®ГЇВ· to %HOMEPATH%\favorites\Г°ВЎГіГ®ГЇВ·.lnk
from %HOMEPATH%\favorites\ВїГ¬В№В·ГіГ®ГЇВ·ВєГ° to %HOMEPATH%\favorites\ВїГ¬В№В·ГіГ®ГЇВ·ВєГ°.lnk

Miscellaneous

Searches for the following windows

Creates and executes the following

'%TEMP%\is-hc0qp.tmp\<File name>.tmp' /SL5="$B009A,1168604,61440,<Full path to file>"
'%APPDATA%\winsxsey\winname.exe'
'%APPDATA%\winsxsey\kgsetup.exe'
'%TEMP%\is-1l792.tmp\kgsetup.tmp' /SL5="$300E8,777648,61440,%APPDATA%\WinSxSey\kgsetup.exe"

Executes the following

'%WINDIR%\syswow64\rundll32.exe' "%ProgramFiles(x86)%\Tencent\QQ\Bin\QQsyse.dll" Linkmm
'%WINDIR%\syswow64\cmd.exe' /c "%APPDATA%\WinSxSey\bv.bat"
'%WINDIR%\syswow64\regedit.exe' -s "%APPDATA%\WinSxSey\vva.reg"
'%WINDIR%\syswow64\cmd.exe' /c del %APPDATA%\WinSxSey\WINname.exe > nul
'%WINDIR%\syswow64\rundll32.exe' "%ProgramFiles(x86)%\Tencent\QQ\Bin\QQsyse.dll" Linkmm' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c del %APPDATA%\WinSxSey\WINname.exe > nul' (with hidden window)

Выдаётся при установке

Завантажте
Dr.Web для Android