Technical Information
Malicious functions:
Executes the following:
- <SYSTEM32>\reg.exe add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel" /v {871C5380-42A0-1069-A2EA-08002B30309D} /t REG_DWORD /d 1 /F
- <SYSTEM32>\attrib.exe "%APPDATA%\Microsoft\Internet Explorer\Quick Launch\├т╖╤╡ч╙░.lnk" +R +S
- <SYSTEM32>\attrib.exe "%APPDATA%\Microsoft\Internet Explorer\Quick Launch\Internet Expleror.lnk" +R +S
- <SYSTEM32>\attrib.exe "%APPDATA%\Microsoft\Internet Explorer\Quick Launch\╘┌╧▀╨б╙╬╧╖.lnk" +R +S
- <SYSTEM32>\cacls.exe "%ALLUSERSPROFILE%\╫└├ц\Internet Expleror.lnk" /p everyone:R
- <SYSTEM32>\cacls.exe "%APPDATA%\Microsoft\Internet Explorer\Quick Launch\Internet Expleror.lnk" /p everyone:R
- <SYSTEM32>\cacls.exe "%APPDATA%\Microsoft\Internet Explorer\Quick Launch\╘┌╧▀╨б╙╬╧╖.lnk" /p everyone:R
- <SYSTEM32>\cacls.exe "%ALLUSERSPROFILE%\╫└├ц\╨б╙╬╧╖.lnk" /p everyone:R
- <SYSTEM32>\cacls.exe "%ALLUSERSPROFILE%\╫└├ц\├т╖╤╘┌╧▀╡ч╙░.lnk" /p everyone:R
- <SYSTEM32>\attrib.exe "%ALLUSERSPROFILE%\╫└├ц\╨б╙╬╧╖.lnk" +R +S
- <SYSTEM32>\wscript.exe "%PROGRAM_FILES%\qq2000\pp.vbs"
- <SYSTEM32>\wscript.exe "%PROGRAM_FILES%\qq2000\hao.vbs"
- <SYSTEM32>\wscript.exe "%PROGRAM_FILES%\qq2000\dd.vbs"
- <SYSTEM32>\wscript.exe "%PROGRAM_FILES%\qq2000\3.vbs"
- %WINDIR%\regedit.exe "%PROGRAM_FILES%\qq2000\kk.reg"
- <SYSTEM32>\attrib.exe "%ALLUSERSPROFILE%\╫└├ц\├т╖╤╘┌╧▀╡ч╙░.lnk" +R +S
- <SYSTEM32>\reg.exe add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\ClassicStartMenu" /v {871C5380-42A0-1069-A2EA-08002B30309D} /t REG_DWORD /d 1 /F
- <SYSTEM32>\cmd.exe /c ""%PROGRAM_FILES%\QQ2000\22.bat" "
- <SYSTEM32>\attrib.exe "%ALLUSERSPROFILE%\╫└├ц\Internet Expleror.lnk" +R +S
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system :
Creates the following files:
- %HOMEPATH%\Start Menu\Programs\РЎУОП·.lnk
- %HOMEPATH%\Start Menu\Programs\Гв·СФЪПЯµзУ°.lnk
- %HOMEPATH%\Start Menu\Programs\Internet Expleror.lnk
- %HOMEPATH%\Start Menu\Programs\ГАЕ®Нјїв.lnk
- %PROGRAM_FILES%\qq2000\zq.ico
- %PROGRAM_FILES%\qq2000\yx.ico
- %PROGRAM_FILES%\qq2000\СёАЧ.lnk
- %PROGRAM_FILES%\qq2000\±©·зУ°Тф.lnk
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Internet Expleror.lnk
- %HOMEPATH%\Favorites\РЎУОП·.lnk
- %HOMEPATH%\Favorites\Гв·СФЪПЯµзУ°.lnk
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\fenlei[1].htm
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\index1[1].html
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\ФЪПЯРЎУОП·.lnk
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Гв·СФЪПЯµзУ°.lnk
- %HOMEPATH%\Favorites\НшЦ·µјєЅ.lnk
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\index1[1].html
- %PROGRAM_FILES%\qq2000\hao.vbs
- %PROGRAM_FILES%\qq2000\favicon.ico
- %PROGRAM_FILES%\qq2000\mediaplayer_icon.gif
- %PROGRAM_FILES%\qq2000\kk.reg
- %PROGRAM_FILES%\qq2000\3.vbs
- %PROGRAM_FILES%\qq2000\22.bat
- %PROGRAM_FILES%\qq2000\dd.vbs
- %PROGRAM_FILES%\qq2000\360°ІИ«ОАКї.lnk
- %PROGRAM_FILES%\qq2000\mm.ico
- %PROGRAM_FILES%\qq2000\taobao.ico
- %PROGRAM_FILES%\qq2000\qq2010.vbs
- %PROGRAM_FILES%\qq2000\yx.htm
- %PROGRAM_FILES%\qq2000\vd.htm
- %PROGRAM_FILES%\qq2000\pp.vbs
- %PROGRAM_FILES%\qq2000\mn.htm
- %PROGRAM_FILES%\qq2000\qq.ico
- %PROGRAM_FILES%\qq2000\qm.ico
Sets the 'hidden' attribute to the following files:
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Internet Expleror.lnk
Deletes the following files:
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\index1[1].html
Network activity:
Connects to:
- 'fz##isi.com':80
- 'www.78##.com':80
- 'localhost':1036
TCP:
HTTP GET requests:
- fz##isi.com/fenlei.htm
- www.78##.com/index1.html
UDP:
- DNS ASK fz##isi.com
- DNS ASK www.78##.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: '' WindowName: '%HOMEPATH%\Desktop'
- ClassName: 'RegEdit_RegEdit' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: '' WindowName: ''
