Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'QQPlugIn' = 'C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\QQPet.exe'
Вредоносные функции:
Создает и запускает на исполнение:
- 'C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\QQPet.exe'
Запускает на исполнение:
- '<SYSTEM32>\cmd.exe' /c ""<SYSTEM32>\del.bat" "
Изменения в файловой системе:
Создает следующие файлы:
- <SYSTEM32>\del.bat
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\QQPet.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\SysMsg\gb.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\SysMsg\dbtys.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\SysMsg\dbty.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\SysMsg\hsgb.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\SysMsg\QQxlog.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\SysMsg\qqlog.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\SysMsg\JB.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\PopMsg\zjtyjb.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\PopMsg\zcty.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\PopMsg\yxjdb.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\PopMsg\zsjdb.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\SysMsg\ckxx.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\SysMsg\ck.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\PopMsg\zxjdb.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\SysMsg\zxjwk.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\SysMsg\zxh.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\SysMsg\zsjlk.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\QQPet.exe
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\QQPlugHook.dll
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\QQPlugUpdate.exe
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\QQPlugIn.dll
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\SysMsg\ysjdb.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\SysMsg\ycty.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\SysMsg\title.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\SysMsg\ysjlk.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\SysMsg\zsjdb.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\SysMsg\zcty.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\SysMsg\yxjwk.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\Mini\yctys.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\Mini\UnChk.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\Mini\QQMini.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\Mini\ysjnk.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\Mini\yxjwk.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\Mini\yxjnk.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\Mini\ysjwk.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\Mini\Chk.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\KillKIS.dll
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\ClickLoadDrv.dll
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\Mini\dbty.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\Mini\QQExit.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\Mini\log.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\Mini\dbtys.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\PopMsg\lkjbx.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\PopMsg\gb.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\PopMsg\fdj.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\PopMsg\qqlog.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\PopMsg\ysjdb.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\PopMsg\ysg.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\PopMsg\ycty.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\Mini\zsjwk.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\Mini\zsjnk.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\Mini\zctys.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\Mini\zxjnk.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\PopMsg\dbtys.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\PopMsg\dbty.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\Mini\zxjwk.png
Перемещает следующие файлы:
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp в C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\SysMsg\gb.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp в C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\SysMsg\dbtys.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp в C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\SysMsg\dbty.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp в C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\SysMsg\hsgb.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp в C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\SysMsg\QQxlog.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp в C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\SysMsg\qqlog.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp в C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\SysMsg\JB.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp в C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\PopMsg\zjtyjb.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp в C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\PopMsg\zcty.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp в C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\PopMsg\yxjdb.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp в C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\PopMsg\zsjdb.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp в C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\SysMsg\ckxx.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp в C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\SysMsg\ck.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp в C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\PopMsg\zxjdb.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp в C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\SysMsg\zxjwk.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp в C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\SysMsg\zxh.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp в C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\SysMsg\zsjlk.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp в C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\QQPet.exe
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp в C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\QQPlugHook.dll
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp в C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\QQPlugUpdate.exe
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp в C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\QQPlugIn.dll
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp в C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\SysMsg\ysjdb.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp в C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\SysMsg\ycty.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp в C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\SysMsg\title.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp в C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\SysMsg\ysjlk.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp в C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\SysMsg\zsjdb.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp в C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\SysMsg\zcty.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp в C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\SysMsg\yxjwk.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp в C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\Mini\yctys.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp в C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\Mini\UnChk.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp в C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\Mini\QQMini.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp в C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\Mini\ysjnk.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp в C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\Mini\yxjwk.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp в C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\Mini\yxjnk.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp в C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\Mini\ysjwk.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp в C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\Mini\Chk.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp в C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\KillKIS.dll
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp в C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\ClickLoadDrv.dll
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp в C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\Mini\dbty.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp в C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\Mini\QQExit.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp в C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\Mini\log.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp в C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\Mini\dbtys.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp в C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\PopMsg\lkjbx.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp в C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\PopMsg\gb.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp в C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\PopMsg\fdj.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp в C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\PopMsg\qqlog.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp в C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\PopMsg\ysjdb.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp в C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\PopMsg\ysg.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp в C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\PopMsg\ycty.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp в C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\Mini\zsjwk.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp в C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\Mini\zsjnk.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp в C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\Mini\zctys.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp в C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\Mini\zxjnk.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp в C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\PopMsg\dbtys.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp в C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\PopMsg\dbty.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\release.tmp в C:\Documents and Settings\Default User\Local Settings\Application Data\QQPlug\Img\Mini\zxjwk.png
Самоудаляется.
Сетевая активность:
Подключается к:
- 'www.d9##.com':80
UDP:
- DNS ASK www.d9##.com
Другое:
Ищет следующие окна:
- ClassName: '#32770 (Dialog)' WindowName: '??????????????'
- ClassName: 'Indicator' WindowName: ''
