Trojan.DownLoader6.34742

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '360Safebox' = '"%PROGRAM_FILES%\360Safebox\safeboxTray.exe" /r'

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\SafeBoxKrnl] 'Start' = '00000001'

Вредоносные функции:

Создает и запускает на исполнение:

%PROGRAM_FILES%\360Safebox\safeboxTray.exe /i

Изменения в файловой системе:

Создает следующие файлы:

%PROGRAM_FILES%\360Safebox\icon\МмБъ°ЛІї.ico
%PROGRAM_FILES%\360Safebox\icon\МЪС¶TM.ico
%PROGRAM_FILES%\360Safebox\icon\МЪС¶QQ.ico
%PROGRAM_FILES%\360Safebox\icon\Н¬»ЁЛі2008.ico
%PROGRAM_FILES%\360Safebox\icon\ХчНѕ.ico
%PROGRAM_FILES%\360Safebox\icon\ХРРРЧЁТµ°ж.ico
%PROGRAM_FILES%\360Safebox\icon\ХРЙМТшРР.ico
%PROGRAM_FILES%\360Safebox\icon\Иэ№ъХщ°Ф.ico
%PROGRAM_FILES%\360Safebox\icon\Д§КЮКАЅз.ico
%PROGRAM_FILES%\360Safebox\icon\ГО»ГОчУО.ico
%PROGRAM_FILES%\360Safebox\icon\ѕўОиНЕ.ico
%PROGRAM_FILES%\360Safebox\icon\Е©ТµТшРР.ico
%PROGRAM_FILES%\360Safebox\icon\ИИСЄЅєю.ico
%PROGRAM_FILES%\360Safebox\icon\ЖжјЈКАЅз.ico
%PROGRAM_FILES%\360Safebox\icon\ЕЬЕЬїЁ¶Ўіµ.ico
%HOMEPATH%\Start Menu\Programs\360±ЈПХПд\360±ЈПХПд.lnk
%HOMEPATH%\Desktop\360±ЈПХПд.lnk
%PROGRAM_FILES%\360Safebox\ListBlackO.dat
%HOMEPATH%\Start Menu\Programs\360±ЈПХПд\Р¶ФШ360±ЈПХПд.lnk
%PROGRAM_FILES%\360Safebox\sprotect.ini
%PROGRAM_FILES%\360Safebox\uninst.exe
%HOMEPATH%\Start Menu\Programs\360±ЈПХПд\РЮёґ360±ЈПХПд.url
%PROGRAM_FILES%\360Safebox\ListPreDef.dat
%PROGRAM_FILES%\360Safebox\icon\ЦпПЙ.ico
%PROGRAM_FILES%\360Safebox\icon\ЦРРЕТшРР.ico
%PROGRAM_FILES%\360Safebox\icon\ЦР№ъТшРР.ico
%PROGRAM_FILES%\360Safebox\icon\ЧїФЅЦ®ЅЈ.ico
%PROGRAM_FILES%\360Safebox\360.dat
%PROGRAM_FILES%\360Safebox\box.dat
%PROGRAM_FILES%\360Safebox\liveupdate.ini
%PROGRAM_FILES%\360Safebox\GuardField.exe
%PROGRAM_FILES%\360Safebox\safebank.exe
%PROGRAM_FILES%\360Safebox\liveupdate.dll
%PROGRAM_FILES%\360Safebox\rptup.dll
%PROGRAM_FILES%\360Safebox\icon\Skype.ico
%PROGRAM_FILES%\360Safebox\dpath.ini
%PROGRAM_FILES%\360Safebox\GFCfg.ini
%PROGRAM_FILES%\360Safebox\safeboxTray.exe
%TEMP%\nsu2.tmp
<Текущая директория>\VM303SCTI.EXE
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\0[1].htm
%TEMP%\nsp3.tmp\System.dll
%PROGRAM_FILES%\360Safebox\SafeboxApi.dll
%PROGRAM_FILES%\360Safebox\SafeboxKrnl.sys
%PROGRAM_FILES%\360Safebox\360safebox.exe
%PROGRAM_FILES%\360Safebox\icon\»ЄОчЦ¤ИЇНшЙПРРЗй.ico
%PROGRAM_FILES%\360Safebox\icon\»ЄОчЦ¤ИЇНшЙПЅ»ТЧ.ico
%PROGRAM_FILES%\360Safebox\icon\№ъМ©ѕэ°Іё»ТЧЦ¤ИЇЅ»ТЧ.ico
%PROGRAM_FILES%\360Safebox\icon\»ЄПДТшРР.ico
%PROGRAM_FILES%\360Safebox\icon\ЅЦН·АєЗт.ico
%PROGRAM_FILES%\360Safebox\icon\Ѕ»НЁТшРР.ico
%PROGRAM_FILES%\360Safebox\icon\ЅЁЙиТшРР.ico
%PROGRAM_FILES%\360Safebox\icon\№г¶«·ўХ№ТшРР.ico
%PROGRAM_FILES%\360Safebox\icon\ґу»°ОчУОII.ico
%PROGRAM_FILES%\360Safebox\icon\±±ѕ©ТшРР.ico
%PROGRAM_FILES%\360Safebox\icon\msn.ico
%PROGRAM_FILES%\360Safebox\icon\ґуЦЗ»Ы.ico
%PROGRAM_FILES%\360Safebox\icon\№вґуТшРР.ico
%PROGRAM_FILES%\360Safebox\icon\№¤ЙМТшРР.ico
%PROGRAM_FILES%\360Safebox\icon\·ЅХэЦ¤ИЇН¬»ЁЛіНкГА°ж.ico