Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Classes\UUTRAN\shell\open\command] '' = '"%PROGRAM_FILES%\uusee\UUSeeClient.exe" "%1"'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'UUSeeMediaCenter' = '"%CommonProgramFiles%\uusee\UUSeeMediaCenter.exe"'
- [<HKLM>\SOFTWARE\Classes\uuupgrade\shell\open\command] '' = '"%CommonProgramFiles%\uusee\UUUpgrade.exe"'
- [<HKLM>\SOFTWARE\Classes\UUSEE\shell\open\command] '' = '"%PROGRAM_FILES%\uusee\UUSeeClient.exe" -url "%1"'
- [<HKLM>\SOFTWARE\Classes\UUTRAN\shell\open\command] '' = '"%PROGRAM_FILES%\uusee\UUSeeClient.exe" -url "%1"'
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\uuseeupdatetask.job
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\UUSee Live Update Service] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- '%CommonProgramFiles%\uusee\UUSeeLUS.exe' -u
- '%CommonProgramFiles%\uusee\UUUpgrade.exe' -i UUPlayer_2011
- '%TEMP%\nsl3.tmp\ns6.tmp' "%CommonProgramFiles%\uusee\UUSeeLUS.exe " -u
- '%TEMP%\nsl3.tmp\ns7.tmp' "%CommonProgramFiles%\uusee\UUSeeLUS.exe " -i
- '%TEMP%\sckj.exe' %CommonProgramFiles%\uusee\UUSeeMediaCenter.exe
- '%CommonProgramFiles%\uusee\UUSeeMediaCenter.exe' -handle 458976
- '%CommonProgramFiles%\uusee\UUSeeLUS.exe' -i
- '%CommonProgramFiles%\uusee\UUSeeLUS.exe' -k
- '%PROGRAM_FILES%\suyou\sougou.exe'
- '%PROGRAM_FILES%\suyou\UUSEE_kb1003_Setup_170865.exe'
- '%PROGRAM_FILES%\suyou\suyou4.1.4.exe'
- '%TEMP%\_ir_sf_temp_0\irsetup.exe' __IRAOFF:674338 "__IRAFN:%PROGRAM_FILES%\suyou\suyou4.1.4.exe" "__IRCT:1" "__IRTSS:0" "__IRSID:S-1-5-21-2052111302-484763869-725345543-1003"
- '%TEMP%\nsl3.tmp\ns5.tmp' "%CommonProgramFiles%\uusee\UUSeeLUS.exe " -k
- '%PROGRAM_FILES%\uusee\UUSeeClient.exe' -minimize
- '%TEMP%\nsl3.tmp\ns4.tmp' schtasks /create /tn uuseeupdatetask /tr "\"%CommonProgramFiles%\uusee\UUUpgrade.exe\" -i UUPlayer_2011" /sc onlogon /RU SYSTEM
Запускает на исполнение:
- '<SYSTEM32>\schtasks.exe' /create /tn uuseeupdatetask /tr "\"%CommonProgramFiles%\uusee\UUUpgrade.exe\" -i UUPlayer_2011" /sc onlogon /RU SYSTEM
Изменения в файловой системе:
Создает следующие файлы:
- %PROGRAM_FILES%\usprit\skin\images\jc_top2.gif
- %PROGRAM_FILES%\usprit\skin\images\jc_top1.png
- %PROGRAM_FILES%\usprit\skin\images\jc_top1.gif
- %PROGRAM_FILES%\usprit\skin\images\mini.jpg
- %PROGRAM_FILES%\usprit\skin\images\jc_top3.png
- %PROGRAM_FILES%\usprit\skin\images\jc_top2.png
- %PROGRAM_FILES%\usprit\skin\images\jc_top.png
- %PROGRAM_FILES%\usprit\skin\images\jc_layer_4.gif
- %PROGRAM_FILES%\usprit\skin\images\jc_layer_3.gif
- %PROGRAM_FILES%\usprit\skin\images\jc_layer_2.gif
- %PROGRAM_FILES%\usprit\skin\images\jc_top.jpg
- %PROGRAM_FILES%\usprit\skin\images\jc_top.gif
- %PROGRAM_FILES%\usprit\skin\images\jc_layer_close.gif
- %PROGRAM_FILES%\usprit\skin\images\mini.png
- %PROGRAM_FILES%\usprit\skin\images\rmss_2.gif
- %PROGRAM_FILES%\usprit\skin\images\rmss_15.png
- %PROGRAM_FILES%\usprit\skin\images\rmss_14.png
- %PROGRAM_FILES%\usprit\skin\images\rmss_3.gif
- %PROGRAM_FILES%\usprit\skin\images\rmss_2.png
- %PROGRAM_FILES%\usprit\skin\images\rmss_2.jpg
- %PROGRAM_FILES%\usprit\skin\images\rmss_13.png
- %PROGRAM_FILES%\usprit\skin\images\rmss_1.png
- %PROGRAM_FILES%\usprit\skin\images\rmss_1.jpg
- %PROGRAM_FILES%\usprit\skin\images\rmss_1.gif
- %PROGRAM_FILES%\usprit\skin\images\rmss_12.png
- %PROGRAM_FILES%\usprit\skin\images\rmss_11.png
- %PROGRAM_FILES%\usprit\skin\images\rmss_10.png
- %PROGRAM_FILES%\usprit\skin\images\jc_3.gif
- %PROGRAM_FILES%\usprit\skin\images\jc_2.png
- %PROGRAM_FILES%\usprit\skin\images\jc_2.jpg
- %PROGRAM_FILES%\usprit\skin\images\jc_4.jpg
- %PROGRAM_FILES%\usprit\skin\images\jc_4.gif
- %PROGRAM_FILES%\usprit\skin\images\jc_3.jpg
- %PROGRAM_FILES%\usprit\skin\images\jc_2.gif
- %PROGRAM_FILES%\usprit\skin\images\jc_1.png
- %PROGRAM_FILES%\usprit\skin\images\jc_1.jpg
- %PROGRAM_FILES%\usprit\skin\images\jc_1.gif
- %PROGRAM_FILES%\usprit\skin\images\jc_12.gif
- %PROGRAM_FILES%\usprit\skin\images\jc_11.gif
- %PROGRAM_FILES%\usprit\skin\images\jc_10.gif
- %PROGRAM_FILES%\usprit\skin\images\jc_5.gif
- %PROGRAM_FILES%\usprit\skin\images\jc_layer1.png
- %PROGRAM_FILES%\usprit\skin\images\jc_dl1.png
- %PROGRAM_FILES%\usprit\skin\images\jc_dl.png
- %PROGRAM_FILES%\usprit\skin\images\jc_layer_1.gif
- %PROGRAM_FILES%\usprit\skin\images\jc_layer3.png
- %PROGRAM_FILES%\usprit\skin\images\jc_layer2.png
- %PROGRAM_FILES%\usprit\skin\images\jc_close.jpg
- %PROGRAM_FILES%\usprit\skin\images\jc_7.gif
- %PROGRAM_FILES%\usprit\skin\images\jc_6.gif
- %PROGRAM_FILES%\usprit\skin\images\jc_5.jpg
- %PROGRAM_FILES%\usprit\skin\images\jc_bottom.jpg
- %PROGRAM_FILES%\usprit\skin\images\jc_bottom.gif
- %PROGRAM_FILES%\usprit\skin\images\jc_bj.jpg
- %PROGRAM_FILES%\usprit\skin\images\rmss_3.jpg
- %PROGRAM_FILES%\usprit\skin\lib\arale\base\1.1.1\base.js
- %PROGRAM_FILES%\usprit\skin\images\tjqd_layer.png
- %PROGRAM_FILES%\usprit\skin\images\tjqd_3.gif
- %PROGRAM_FILES%\usprit\skin\lib\arale\events\1.1.0\events.js
- %PROGRAM_FILES%\usprit\skin\lib\arale\easing\1.0.0\easing.js
- %PROGRAM_FILES%\usprit\skin\lib\arale\class\1.1.0\class.js
- %PROGRAM_FILES%\usprit\skin\images\tjqd_2.png
- %PROGRAM_FILES%\usprit\skin\images\ssjl_6.gif
- %PROGRAM_FILES%\usprit\skin\images\ssjl_5.gif
- %PROGRAM_FILES%\usprit\skin\images\ssjl_4.gif
- %PROGRAM_FILES%\usprit\skin\images\tjqd_2.gif
- %PROGRAM_FILES%\usprit\skin\images\tjqd_1.png
- %PROGRAM_FILES%\usprit\skin\images\tjqd_1.gif
- %PROGRAM_FILES%\usprit\skin\lib\jquery\jquery\1.10.1\jquery.js
- %TEMP%\sckj.exe
- %ALLUSERSPROFILE%\Start Menu\Programs\УЖКУЦ±ІҐ\Жф¶ЇИьКВѕ«Бй.lnk
- %ALLUSERSPROFILE%\Desktop\ИьКВѕ«Бй.lnk
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\skin.zip[1].html
- %PROGRAM_FILES%\uusee\cache\83DB\83DBF187DDA35C21DDBFA18E95C6A14E
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\localpage[1].ini
- %PROGRAM_FILES%\usprit\skin\lib\sportsprite\mini\1.0.0\main.js
- %PROGRAM_FILES%\usprit\skin\lib\seajs\seajs\2.2.1\sea.js
- %PROGRAM_FILES%\usprit\skin\lib\jquery\jquery\1.10.1\.svn\text-base\jquery.js.svn-base
- %PROGRAM_FILES%\usprit\skin\lib\jquery\jquery\1.10.1\.svn\entries
- %PROGRAM_FILES%\usprit\skin\lib\sportsprite\jscroll\jscroll.js
- %PROGRAM_FILES%\usprit\skin\lib\sportsprite\index\1.0.0\main.js
- %PROGRAM_FILES%\usprit\skin\lib\sportsprite\addsport\1.0.0\main.js
- %PROGRAM_FILES%\usprit\skin\images\rmss_7.png
- %PROGRAM_FILES%\usprit\skin\images\rmss_6.png
- %PROGRAM_FILES%\usprit\skin\images\rmss_6.gif
- %PROGRAM_FILES%\usprit\skin\images\rmss_bj.jpg
- %PROGRAM_FILES%\usprit\skin\images\rmss_9.png
- %PROGRAM_FILES%\usprit\skin\images\rmss_8.png
- %PROGRAM_FILES%\usprit\skin\images\rmss_5.png
- %PROGRAM_FILES%\usprit\skin\images\rmss_4.jpg
- %PROGRAM_FILES%\usprit\skin\images\rmss_4.gif
- %PROGRAM_FILES%\usprit\skin\images\rmss_3.png
- %PROGRAM_FILES%\usprit\skin\images\rmss_5.jpg
- %PROGRAM_FILES%\usprit\skin\images\rmss_5.gif
- %PROGRAM_FILES%\usprit\skin\images\rmss_4.png
- %PROGRAM_FILES%\usprit\skin\images\sc_1.gif
- %PROGRAM_FILES%\usprit\skin\images\ssjl_1.png
- %PROGRAM_FILES%\usprit\skin\images\ssjl_1.gif
- %PROGRAM_FILES%\usprit\skin\images\sc_qc1.gif
- %PROGRAM_FILES%\usprit\skin\images\ssjl_3.gif
- %PROGRAM_FILES%\usprit\skin\images\ssjl_2.gif
- %PROGRAM_FILES%\usprit\skin\images\ssjl_1_1.png
- %PROGRAM_FILES%\usprit\skin\images\sc_qc.jpg
- %PROGRAM_FILES%\usprit\skin\images\sc_3.gif
- %PROGRAM_FILES%\usprit\skin\images\sc_2.gif
- %PROGRAM_FILES%\usprit\skin\images\sc_1.png
- %PROGRAM_FILES%\usprit\skin\images\sc_bj.jpg
- %PROGRAM_FILES%\usprit\skin\images\sc_5.gif
- %PROGRAM_FILES%\usprit\skin\images\sc_4.gif
- %PROGRAM_FILES%\usprit\skin\images\index_9.png
- %PROGRAM_FILES%\uusee\UUSeeClient.exe
- %PROGRAM_FILES%\uusee\UUDesktopPP.exe
- %PROGRAM_FILES%\uusee\UUDesktopMN.exe
- %PROGRAM_FILES%\uusee\UUDesktop\skin\state.html
- %PROGRAM_FILES%\uusee\uninstuusee.exe
- %PROGRAM_FILES%\uusee\skin.zip
- %CommonProgramFiles%\uusee\UUPlayer_2011_path.ini
- %CommonProgramFiles%\uusee\uninst.exe
- %PROGRAM_FILES%\uuseeweb.ico
- %PROGRAM_FILES%\zhibo.ico
- %CommonProgramFiles%\uusee\UUSeeLUS.exe
- %PROGRAM_FILES%\uusee\UUPlayer_2014_update.ini
- %CommonProgramFiles%\uusee\LocalInfo.ini
- %PROGRAM_FILES%\uusee\UUDesktop\skin\wk_state.jpg
- %ALLUSERSPROFILE%\Desktop\УЖКУЦ±ІҐ.lnk
- %ALLUSERSPROFILE%\Desktop\УЖКУНш.lnk
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\УЖКУЦ±ІҐ.lnk
- %TEMP%\nsl3.tmp\Math.dll
- %PROGRAM_FILES%\Mozilla Firefox\plugins\npstartservicep.dll
- %PROGRAM_FILES%\Mozilla Firefox\plugins\npuuseep.dll
- %ALLUSERSPROFILE%\Start Menu\УЖКУЦ±ІҐ.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\УЖКУЦ±ІҐ\Жф¶ЇУЖКУЦ±ІҐ.lnk
- %PROGRAM_FILES%\uusee\UUDesktop\skin\wk_state_logo.png
- %PROGRAM_FILES%\uusee\UUDesktop\skin\wk_state.png
- %ALLUSERSPROFILE%\Start Menu\Programs\УЖКУЦ±ІҐ\Р¶ФШУЖКУЦ±ІҐ.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\УЖКУЦ±ІҐ\·ГОКUUSee НшХѕ.lnk
- %PROGRAM_FILES%\uusee\UUSee.url
- %TEMP%\_ir_sf_temp_0\irsetup.ico
- %TEMP%\_ir_sf_temp_0\irsetup.dat
- %TEMP%\nsl3.tmp\System.dll
- %TEMP%\nsl3.tmp\FindProcDLL.dll
- %TEMP%\_ir_sf_temp_0\IRIMG2.JPG
- %TEMP%\_ir_sf_temp_0\IRIMG1.JPG
- %TEMP%\nsa2.tmp
- %PROGRAM_FILES%\suyou\krnln.fnr
- %PROGRAM_FILES%\suyou\UUSEE_kb1003_Setup_170865.exe
- %PROGRAM_FILES%\suyou\suyou4.1.4.exe
- %TEMP%\_ir_sf_temp_0\irsetup.exe
- %PROGRAM_FILES%\suyou\sougou.exe
- %PROGRAM_FILES%\suyou\eAPI.fne
- <SYSTEM32>\nsis_loader.dll
- %CommonProgramFiles%\uusee\UUSeeMediaCenter.exe
- %CommonProgramFiles%\uusee\trafficlight.dll
- %CommonProgramFiles%\uusee\UUUpgrade.exe
- %CommonProgramFiles%\uusee\Localserver.dll
- %CommonProgramFiles%\uusee\UUUpgrade.ini
- %CommonProgramFiles%\uusee\MediaCenter.ini
- %CommonProgramFiles%\uusee\UUNet.dll
- %TEMP%\nsl3.tmp\AccessControl.dll
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\123.sogou[1]
- %TEMP%\nsl3.tmp\UUSeeLog.dll
- %CommonProgramFiles%\uusee\in_net.dll
- %CommonProgramFiles%\uusee\npstartservicep.dll
- %CommonProgramFiles%\uusee\StartService.ocx
- %TEMP%\nsl3.tmp\nsExec.dll
- %PROGRAM_FILES%\usprit\skin\images\index_1.gif
- %PROGRAM_FILES%\usprit\skin\images\i6.png
- %PROGRAM_FILES%\usprit\skin\images\i5.png
- %PROGRAM_FILES%\usprit\skin\images\index_10.png
- %PROGRAM_FILES%\usprit\skin\images\index_1.png
- %PROGRAM_FILES%\usprit\skin\images\index_1.jpg
- %PROGRAM_FILES%\usprit\skin\images\i4.png
- %PROGRAM_FILES%\usprit\skin\images\close1.png
- %PROGRAM_FILES%\usprit\skin\images\close.png
- %PROGRAM_FILES%\usprit\skin\team_detail.html
- %PROGRAM_FILES%\usprit\skin\images\i3.png
- %PROGRAM_FILES%\usprit\skin\images\i2.png
- %PROGRAM_FILES%\usprit\skin\images\i1.png
- %PROGRAM_FILES%\usprit\skin\images\index_2.gif
- %PROGRAM_FILES%\usprit\skin\images\index_5.png
- %PROGRAM_FILES%\usprit\skin\images\index_5.gif
- %PROGRAM_FILES%\usprit\skin\images\index_4.png
- %PROGRAM_FILES%\usprit\skin\images\index_8.png
- %PROGRAM_FILES%\usprit\skin\images\index_7.png
- %PROGRAM_FILES%\usprit\skin\images\index_6.png
- %PROGRAM_FILES%\usprit\skin\images\index_4.jpg
- %PROGRAM_FILES%\usprit\skin\images\index_3.gif
- %PROGRAM_FILES%\usprit\skin\images\index_2.png
- %PROGRAM_FILES%\usprit\skin\images\index_2.jpg
- %PROGRAM_FILES%\usprit\skin\images\index_4.gif
- %PROGRAM_FILES%\usprit\skin\images\index_3.png
- %PROGRAM_FILES%\usprit\skin\images\index_3.jpg
- %TEMP%\nsl3.tmp\ns7.tmp
- %PROGRAM_FILES%\uusee\skin\loading\loading.html
- %PROGRAM_FILES%\uusee\skin\loading\loading.gif
- %PROGRAM_FILES%\uusee\skin\nav_img\k_ioc.png
- %PROGRAM_FILES%\uusee\skin\nav.html
- %PROGRAM_FILES%\uusee\skin\localpage.ini
- %PROGRAM_FILES%\uusee\skin\loading\ds_bj.jpg
- %TEMP%\nsl3.tmp\ns6.tmp
- %TEMP%\nsl3.tmp\ns5.tmp
- %TEMP%\nsl3.tmp\ns4.tmp
- %PROGRAM_FILES%\uusee\skin\history_img\ds_bj.jpg
- %PROGRAM_FILES%\uusee\skin\history.html
- %PROGRAM_FILES%\uusee\skin\func.html
- %PROGRAM_FILES%\uusee\skin\player.js
- %PROGRAM_FILES%\usprit\skin\jc.html
- %PROGRAM_FILES%\usprit\skin\index.html
- %PROGRAM_FILES%\usprit\skin\addsport.html
- %PROGRAM_FILES%\usprit\skin\sport_detail.html
- %PROGRAM_FILES%\usprit\skin\mini.html
- %PROGRAM_FILES%\usprit\skin\jc_sc.html
- %PROGRAM_FILES%\usprit\weather.txt
- %CommonProgramFiles%\desktop\desktopiconX86.dll
- %PROGRAM_FILES%\uusee\skin\setting.html
- %PROGRAM_FILES%\uusee\skin\player1.js
- %PROGRAM_FILES%\usprit\uuspirit.exe
- %PROGRAM_FILES%\usprit\localpage.ini
- %PROGRAM_FILES%\uusee\skin\state.html
Удаляет следующие файлы:
- %TEMP%\nsl3.tmp\FindProcDLL.dll
- %TEMP%\nsl3.tmp\AccessControl.dll
- %TEMP%\sckj.exe
- %TEMP%\nsl3.tmp\Math.dll
- %TEMP%\nsl3.tmp\UUSeeLog.dll
- %TEMP%\nsl3.tmp\System.dll
- %TEMP%\nsl3.tmp\nsExec.dll
- %TEMP%\nsl3.tmp\ns7.tmp
- <SYSTEM32>\nsis_loader.dll
- %TEMP%\_ir_sf_temp_0\irsetup.dat
- %TEMP%\_ir_sf_temp_0\irsetup.exe
- %PROGRAM_FILES%\uusee\UUPlayer_2014_update.ini
- %TEMP%\nsl3.tmp\ns6.tmp
- %TEMP%\nsl3.tmp\ns5.tmp
- %TEMP%\nsl3.tmp\ns4.tmp
Сетевая активность:
Подключается к:
- 'localhost':1045
- 'pl####.uusee.com':80
- 'localhost':1042
- 'localhost':1036
- '12#.#ogou.com':80
TCP:
Запросы HTTP GET:
- pl####.uusee.com/transformer/client_2014/client/skin/skin.zip.html?
- pl####.uusee.com/transformer/client_2014/client/skin/localpage.ini
- 12#.#ogou.com/?11########
UDP:
- DNS ASK ne####.uusee.com
- DNS ASK pl####.uusee.com
- DNS ASK uu###.adsame.com
- DNS ASK up####.uusee.com
- DNS ASK uh##.uusee.com
- DNS ASK lo#.#usee.com
- DNS ASK lo####ver.uusee.com
- DNS ASK 12#.#ogou.com
- '34.#.23.1':10110
- 'any':10110
- 'lo####ver.uusee.com':10080
- '24.#31.55.0':10110
- 'lo#.#usee.com':17200
- 'lo####ver.uusee.com':17200
- 'ne####.uusee.com':18100
- 'lo#.#usee.com':10080
Другое:
Ищет следующие окна:
- ClassName: 'IEFrame' WindowName: '(null)'
- ClassName: 'MS_AutodialMonitor' WindowName: '(null)'
- ClassName: 'MS_WebcheckMonitor' WindowName: '(null)'
- ClassName: '' WindowName: '(null)'
- ClassName: 'EDIT' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: '(null)' WindowName: 'Microsoft Internet Explorer'
