Trojan.Click3.4725

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'Bluetooth Software' = '"%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\BtvStack.exe"'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'CTFMon' = '"%CommonProgramFiles%\Microsoft Shared\MSInfo\ctfmon.exe"'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Apple Push' = '"%PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\places\APSDaemon.exe"'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'RDP Clip Monitor' = '"%APPDATA%\Microsoft\Windows\rdpclip.exe"'

Создает или изменяет следующие файлы:

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\schtasks.exe' /CREATE /F /RL HIGHEST /SC MINUTE /MO 19 /TN "RDP Clip Monitor" /TR "\"%APPDATA%\Microsoft\Windows\rdpclip.exe\""
'<SYSTEM32>\schtasks.exe' /CREATE /F /RL HIGHEST /SC MINUTE /MO 30 /TN "Apple Push" /TR "\"%PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\places\APSDaemon.exe\""
'<SYSTEM32>\schtasks.exe' /CREATE /F /RL HIGHEST /SC MINUTE /MO 16 /TN "Bluetooth Software" /TR "\"%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\BtvStack.exe\""
'%PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE' -u node.bot5 -p x -o http://yp###.net:8081 -t 2 -m8
'<SYSTEM32>\schtasks.exe' /CREATE /F /RL HIGHEST /SC MINUTE /MO 8 /TN "CTFMon" /TR "\"%CommonProgramFiles%\Microsoft Shared\MSInfo\ctfmon.exe\""
'<SYSTEM32>\schtasks.exe' /CREATE /F /RL HIGHEST /SC MINUTE /MO 33 /TN "RDP Clip Monitor" /TR "\"%APPDATA%\Microsoft\Windows\rdpclip.exe\""
'<SYSTEM32>\schtasks.exe' /CREATE /F /RL HIGHEST /SC MINUTE /MO 25 /TN "Apple Push" /TR "\"%PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\places\APSDaemon.exe\""
'<SYSTEM32>\schtasks.exe' /CREATE /F /RL HIGHEST /SC MINUTE /MO 25 /TN "Bluetooth Software" /TR "\"%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\BtvStack.exe\""
'<SYSTEM32>\schtasks.exe' /CREATE /F /SC ONLOGON /TN "Windows Desktop Gadgets" /TR "\"%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\sidebar.exe\""
'<SYSTEM32>\schtasks.exe' /CREATE /F /RL HIGHEST /SC MINUTE /MO 25 /TN "CTFMon" /TR "\"%CommonProgramFiles%\Microsoft Shared\MSInfo\ctfmon.exe\""

Изменения в файловой системе:

Создает следующие файлы:

%APPDATA%\Microsoft\Windows\~fcdshva.tmp
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\~injpxur.tmp
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\places\~zdjvbph.tmp
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\media\~eosqbfw.tmp
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\media\commh32.exe
%CommonProgramFiles%\Microsoft Shared\MSInfo\~nhilsui.tmp
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\drivetable.txt
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\_filelst.cfg
%APPDATA%\Mozilla\Firefox\msvcr110.dll
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\~dhhgirf.tmp
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\media\~akanghd.tmp
%APPDATA%\Microsoft\Windows\~yczaath.tmp
%APPDATA%\Microsoft\Windows\rdpclip.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\places\APSDaemon.exe
%APPDATA%\Mozilla\Firefox\plugin-container.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\places\~xnynwfr.tmp
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\~vwcrrkw.tmp
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\~yijghlo.tmp
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\sidebar.exe
%CommonProgramFiles%\Microsoft Shared\MSInfo\ctfmon.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\BtvStack.exe
%CommonProgramFiles%\Microsoft Shared\MSInfo\~yzclyvd.tmp

Удаляет следующие файлы:

%PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\places\~zdjvbph.tmp
%APPDATA%\Microsoft\Windows\~fcdshva.tmp
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\media\commh32.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\sidebar.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\media\~eosqbfw.tmp
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\media\~akanghd.tmp
<SYSTEM32>\Restore\MachineGuid.txt
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\~dhhgirf.tmp
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\~injpxur.tmp
%CommonProgramFiles%\Microsoft Shared\MSInfo\~nhilsui.tmp
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\~yijghlo.tmp
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\places\APSDaemon.exe
%APPDATA%\Microsoft\Windows\~yczaath.tmp
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\places\~xnynwfr.tmp
%APPDATA%\Mozilla\Firefox\plugin-container.exe
%ALLUSERSPROFILE%\Start Menu\Programs\Startup\plugin-container.exe
%CommonProgramFiles%\Microsoft Shared\MSInfo\~yzclyvd.tmp
%CommonProgramFiles%\Microsoft Shared\MSInfo\ctfmon.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\BtvStack.exe
%APPDATA%\Microsoft\Windows\rdpclip.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\~vwcrrkw.tmp