Trojan.Click2.44581

Техническая информация

Вредоносные функции:

Создает и запускает на исполнение:

%TEMP%\nsw3.tmp\ns5.tmp %TEMP%\test.exe
%TEMP%\nsw3.tmp\ns4.tmp %TEMP%\setup.exe

Запускает на исполнение:

%PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE http://%6#########D%6D%78%78%62%2E%69%6E%66%6F/?i=###########
%PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE http://%6#########D%6D%78%78%62%2E%69%6E%66%6F/?i=############
%PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE http://%6#########D%6D%78%78%62%2E%69%6E%66%6F/?i=##################################
%PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE http://%6#########D%6D%78%78%62%2E%69%6E%66%6F/?i=#######

Изменения в файловой системе:

Создает следующие файлы:

%HOMEPATH%\Favorites\БґЅУ\НшЦ·ґуИ«.url
%HOMEPATH%\Favorites\БґЅУ\МФ±¦№єОп.url
%HOMEPATH%\Favorites\БґЅУ\КЦ»ъЧЈёЈ.url
%HOMEPATH%\Favorites\ѕЙµДКХІШ\MSN.com.url
%HOMEPATH%\Favorites\ѕЙµДКХІШ\Desktop.ini
%HOMEPATH%\Favorites\БґЅУ\Фµ·ЦЕд¶Ф.url
%HOMEPATH%\Favorites\БґЅУ\ЙМТµµјєЅ.url
%HOMEPATH%\Favorites\БґЅУ\ІШН·К«ґК.url
%HOMEPATH%\Favorites\БґЅУ\°ЛШФЙ«Нј.url
%HOMEPATH%\Favorites\Фµ·ЦЕд¶Ф.url
%HOMEPATH%\Favorites\БґЅУ\ГАЕ®КУЖµ.url
%HOMEPATH%\Favorites\БґЅУ\»ўДкФЛіМ.url
%HOMEPATH%\Favorites\БґЅУ\ёцРФЗ©Гы.url
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\go.mmxxb[1]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\go.mmxxb[1]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\go.mmxxb[1]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\go.mmxxb[1]
%TEMP%\uninst.exe
%TEMP%\temp.ini
%TEMP%\nsw3.tmp\ns5.tmp
%HOMEPATH%\Favorites\ѕЙµДКХІШ\Links\Free Hotmail.url
%HOMEPATH%\Favorites\ѕЙµДКХІШ\Links\Customize Links.url
%HOMEPATH%\Favorites\ѕЙµДКХІШ\Radio Station Guide.url
%HOMEPATH%\Favorites\ѕЙµДКХІШ\Links\Windows.url
%HOMEPATH%\Favorites\ѕЙµДКХІШ\Links\Windows Media.url
%HOMEPATH%\Favorites\ѕЙµДКХІШ\Links\Windows Marketplace.url
%WINDIR%\myfav\Desktop.ini
%TEMP%\error
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\31recall[1].htm
%WINDIR%\myfav\Links\Customize Links.url
%WINDIR%\myfav\Radio Station Guide.url
%WINDIR%\myfav\MSN.com.url
%TEMP%\nsw3.tmp\InetLoad.dll
%TEMP%\nsw3.tmp\System.dll
%TEMP%\nsw3.tmp\time.dll
%TEMP%\nsg2.tmp
%TEMP%\nsw3.tmp\Math.dll
%TEMP%\nsw3.tmp\ns4.tmp
%TEMP%\nsw3.tmp\nsExec.dll
%HOMEPATH%\Favorites\ЙМТµµјєЅ.url
%HOMEPATH%\Favorites\ГАЕ®КУЖµ.url
%HOMEPATH%\Favorites\»ўДкФЛіМ.url
%HOMEPATH%\Favorites\НшЦ·ґуИ«.url
%HOMEPATH%\Favorites\МФ±¦№єОп.url
%HOMEPATH%\Favorites\КЦ»ъЧЈёЈ.url
%HOMEPATH%\Favorites\ёцРФЗ©Гы.url
%WINDIR%\myfav\Links\Windows Media.url
%WINDIR%\myfav\Links\Windows Marketplace.url
%WINDIR%\myfav\Links\Free Hotmail.url
%HOMEPATH%\Favorites\ІШН·К«ґК.url
%HOMEPATH%\Favorites\°ЛШФЙ«Нј.url
%WINDIR%\myfav\Links\Windows.url