Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'ctfmon.exe' = '<SYSTEM32>\ctfmon.exe'
- [<HKLM>\SOFTWARE\Microsoft\Internet Explorer\Extensions\{6096E38F-5AC1-9527-8EC4-75DFA92FB32F}] 'Exec' = 'www.97796.cn/?ico'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,'
Malicious functions:
To complicate detection of its presence in the operating system,
blocks the following features:
- System File Checker (SFC)
Creates and executes the following:
- %TEMP%\IEDATA.exe
Executes the following:
- <SYSTEM32>\cmd.exe /c ""%TEMP%\7ZSfx000.cmd" "
- <SYSTEM32>\cmd.exe /c %TEMP%\com.bat
- %WINDIR%\regedit.exe /s %TEMP%\url.reg
- <SYSTEM32>\cmd.exe /c %TEMP%\cmdcom.bat
- %WINDIR%\regedit.exe /s %TEMP%\xpstart.reg
- <SYSTEM32>\ping.exe 127.0.0.1 -n 3
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system :
Creates the following files:
- %APPDATA%\360SE\extensions\Favorites\Log\360log_2010_07_23.log
- %APPDATA%\360SE\stat.ini
- %APPDATA%\360SE\extensions\Favorites\Log\360log_2010_07_26.log
- %APPDATA%\360SE\extensions\Favorites\Log\360log_2010_08_01.log
- %APPDATA%\360SE\extensions\Favorites\Log\360log_2010_07_27.log
- %APPDATA%\360SE\extensions\ExtAddons\recommend.ini
- %APPDATA%\360SE\extensions\ExtProxy\proxy.ini
- %APPDATA%\360SE\extensions\SafeCentral\SafeCentral.ini
- %APPDATA%\360SE\extensions\ExtChongzhi\stat.ini
- %APPDATA%\360SE\extensions\SafeCentral\sc.ini
- %APPDATA%\360SE\extensions\Favorites\Log\360log_2010_08_03.log
- %APPDATA%\SogouExplorer\Openpage.xml
- %APPDATA%\SogouExplorer\configlocal.xml
- %APPDATA%\360SE\extensions\ExtDoctor\doctor.dll
- %TEMP%\url.reg
- %TEMP%\7ZSfx000.cmd
- %APPDATA%\Tencent\TencentTraveler\100\ttproxy.pac
- %APPDATA%\360SE\extensions\Favorites\Log\360log_2010_08_04.log
- %APPDATA%\SogouExplorer\SEacc_refresh_pattern.txt
- %APPDATA%\SogouExplorer\Config.xml
- %APPDATA%\SogouExplorer\CommCfg.xml
- %APPDATA%\Tencent\TencentTraveler\100\NewMostVisitInfo.ini
- %APPDATA%\360SE\data\ico\www.youdao.com.ico
- %APPDATA%\Tencent\TencentTraveler\100\favicon\www.soso.com_favicon.ico
- %APPDATA%\360SE\data\ico\wxfy.wan.360.cn.ico
- %APPDATA%\360SE\data\ico\zhidao.baidu.com.ico
- %APPDATA%\360SE\data\ico\yahoo.cn.ico
- %APPDATA%\360SE\data\ico\www.sina.com.cn.ico
- %APPDATA%\360SE\data\ico\www.qihoo.com.ico
- %APPDATA%\360SE\data\ico\www.sogou.com.ico
- %APPDATA%\360SE\data\ico\www.soso.com.ico
- %APPDATA%\360SE\data\ico\www.sohu.com.ico
- %APPDATA%\360SE\data\ico\zqjl.wan.360.cn.ico
- %APPDATA%\360SE\extensions\ExtDoctor\ExtDoctor.ini
- %APPDATA%\360SE\extensions\ExtAdfilter\extadfilter.ini
- %APPDATA%\360SE\extensions\ExtAddons\ExtStats.ini
- %APPDATA%\360SE\extensions\ExtAddons\ganzhi.ini
- %APPDATA%\360SE\extensions\Favorites\Favorites.ini
- %APPDATA%\Tencent\TencentTraveler\Config.ini
- %APPDATA%\360SE\360SE.ini
- %APPDATA%\Tencent\TencentTraveler\Data.ini
- %APPDATA%\360SE\extensions\ExtAddons\ExtAddons.ini
- %APPDATA%\360SE\extensions\SafeCentral\esimple.ini
- %TEMP%\aut17.tmp
- %HOMEPATH%\Favorites\淘宝网.lnk
- %HOMEPATH%\Favorites\三国英雄.url
- %HOMEPATH%\Favorites\QQ农场外挂.url
- %TEMP%\aut18.tmp
- %HOMEPATH%\Favorites\电脑主题,桌面主题,电脑桌面,XP主题,Win7主题-主题之家.url
- %TEMP%\aut14.tmp
- %TEMP%\aut15.tmp
- %TEMP%\aut16.tmp
- %HOMEPATH%\Favorites\QQ个性搞笑表情下载 - 猫猫表情站.url
- %TEMP%\aut19.tmp
- %HOMEPATH%\Favorites\JJ斗地主.url
- %TEMP%\aut1C.tmp
- %HOMEPATH%\Start Menu\Programs\百货网.lnk
- %HOMEPATH%\Start Menu\Programs\主题之家.lnk
- %HOMEPATH%\Start Menu\Programs\淘宝网.lnk
- %TEMP%\aut1A.tmp
- %HOMEPATH%\Favorites\非主流个性网.url
- %HOMEPATH%\Favorites\百货网.lnk
- %HOMEPATH%\Favorites\绿色下载.url
- %TEMP%\aut1B.tmp
- %HOMEPATH%\Favorites\windows7系统免费下载.url
- %TEMP%\autC.tmp
- %APPDATA%\home.html
- %HOMEPATH%\Favorites\2548绿色网址导航.url
- %HOMEPATH%\Favorites\深度系统下载.url
- %TEMP%\autD.tmp
- %APPDATA%\360SE\360se.old.bak
- %TEMP%\com.bat
- %APPDATA%\SogouExplorer\Config.old.bak
- %TEMP%\autB.tmp
- %APPDATA%\Tencent\TencentTraveler\100\TtConf.old.bak
- %TEMP%\autE.tmp
- %HOMEPATH%\Favorites\4399小游戏,单人游戏,双人游戏.url
- %TEMP%\aut11.tmp
- %TEMP%\aut12.tmp
- %TEMP%\aut13.tmp
- %HOMEPATH%\Favorites\单机游戏下载.url
- %TEMP%\autF.tmp
- %HOMEPATH%\Favorites\最新XP系统免费下载.url
- %HOMEPATH%\Favorites\电脑装机必备软件.url
- %HOMEPATH%\Favorites\雨林木风系统下载.url
- %TEMP%\aut10.tmp
- %APPDATA%\360SE\data\ico\www.kappa.com.cn.ico
- %APPDATA%\SogouExplorer\Webkit\VisitedLinks
- %APPDATA%\SogouExplorer\videopattern
- %APPDATA%\Tencent\TencentTraveler\100\TtConf.dat.bak
- %APPDATA%\SogouExplorer\adbdata.dat
- %APPDATA%\360SE\extensions\ExtAddons\ExtStats.ini.cfg
- %APPDATA%\ylmf.ico
- %TEMP%\autA.tmp
- %APPDATA%\SogouExplorer\abw
- %APPDATA%\SogouExplorer\dew
- %APPDATA%\SogouExplorer\Webkit\Cookies
- %APPDATA%\SogouExplorer\Favorite2.dat
- %APPDATA%\360SE\data\user.dat
- %APPDATA%\360SE\extensions\SafeCentral\urllibauth.dat
- %APPDATA%\360SE\data\360sefav.db
- %APPDATA%\SogouExplorer\Misc.db
- %APPDATA%\SogouExplorer\MCPattern.db
- %APPDATA%\360SE\data\history.dat
- %APPDATA%\SogouExplorer\FormData.dat
- %APPDATA%\360SE\extensions\SafeCentral\SafeProtect.dat
- %APPDATA%\360SE\extensions\SafeCentral\urllib.dat
- %APPDATA%\Tencent\TencentTraveler\100\TtConf.dat
- %APPDATA%\bd.ico
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Internet 浏览器.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\一键清理系统垃圾文件.bat
- %TEMP%\aut3.tmp
- %TEMP%\cmdcom.bat
- %TEMP%\xpstart.reg
- %TEMP%\IEDATA.exe
- %TEMP%\aut1.tmp
- %TEMP%\aut2.tmp
- %HOMEPATH%\Start Menu\一键清理系统垃圾文件.bat
- %WINDIR%\一键清理系统垃圾文件.bat
- %TEMP%\aut4.tmp
- <SYSTEM32>\tbw.ico
- %TEMP%\aut7.tmp
- %TEMP%\aut8.tmp
- %TEMP%\aut9.tmp
- <SYSTEM32>\bhw.ico
- %TEMP%\aut5.tmp
- <SYSTEM32>\jj.ico
- <SYSTEM32>\zt.ico
- <SYSTEM32>\favicon.ico
- %TEMP%\aut6.tmp
- %APPDATA%\360SE\data\ico\niudaowenhua.blog.sohu.com.ico
- %APPDATA%\360SE\data\ico\news.sohu.com.ico
- %APPDATA%\360SE\data\ico\plsm.wan.360.cn.ico
- %APPDATA%\360SE\data\ico\se.360.cn.ico
- %APPDATA%\360SE\data\ico\poker.wan.360.cn.ico
- %APPDATA%\360SE\data\ico\ks.cn.yahoo.com.ico
- %APPDATA%\SogouExplorer\FavIcon\http_www.97796.cn_80_fav.ico
- %APPDATA%\360SE\data\ico\mcsd.wan.360.cn.ico
- %APPDATA%\360SE\data\ico\money.finance.sina.com.cn.ico
- %APPDATA%\360SE\data\ico\me.360.cn.ico
- %APPDATA%\360SE\data\ico\search8.taobao.com.ico
- %APPDATA%\360SE\data\ico\www.baidu.com.ico
- %APPDATA%\Tencent\TencentTraveler\100\favicon\www.2548.cn_favicon.ico
- %APPDATA%\360SE\data\ico\www.donews.com.ico
- %APPDATA%\360SE\data\ico\www.google.com.hk.ico
- %APPDATA%\360SE\data\ico\www.ghost2.cn.ico
- %APPDATA%\360SE\data\ico\t.sohu.com.ico
- %APPDATA%\360SE\data\ico\shihb.blog.sohu.com.ico
- %APPDATA%\360SE\data\ico\translate.google.com.hk.ico
- %APPDATA%\360SE\data\ico\www.2548.cn.ico
- %APPDATA%\360SE\data\ico\wan.360.cn.ico
- %APPDATA%\SogouExplorer\FavIcon\http_www.2548.cn_80_fav.ico
- %APPDATA%\360SE\data\ico\avc.360.cn.ico
- %APPDATA%\Tencent\TencentTraveler\100\RecommandUrls.html
- %APPDATA%\360SE\data\ico\baike.baidu.com.ico
- %APPDATA%\360SE\data\ico\cn.bing.com.ico
- %APPDATA%\360SE\data\ico\biz.finance.sina.com.cn.ico
- %APPDATA%\SogouExplorer\uhistory.db
- %APPDATA%\Tencent\TencentTraveler\100\navinfo.db
- %APPDATA%\SogouExplorer\UserId.enc
- %APPDATA%\360SE\data\DailyBackup\360sefav_2010_08_04.favdb
- %APPDATA%\360SE\data\DailyBackup\360sefav_2010_07_23.favdb
- %APPDATA%\360SE\data\ico\cz.360.cn.ico
- %APPDATA%\360SE\data\ico\free.donews.com.ico
- %APPDATA%\360SE\data\ico\finance.sina.com.cn.ico
- %APPDATA%\360SE\data\ico\hao.360.cn.ico
- %APPDATA%\SogouExplorer\FavIcon\http_ie.sogou.com_80_fav.ico
- %APPDATA%\360SE\data\ico\hero.wan.360.cn.ico
- %APPDATA%\SogouExplorer\FavIcon\default_page.ico
- %APPDATA%\360SE\data\ico\ddt.wan.360.cn.ico
- %APPDATA%\360SE\data\ico\dgcs.wan.360.cn.ico
- %APPDATA%\360SE\data\ico\farm.wan.360.cn.ico
- %APPDATA%\360SE\data\ico\dh.wan.360.cn.ico
Sets the 'hidden' attribute to the following files:
- %APPDATA%\bd.ico
- %APPDATA%\ylmf.ico
- %APPDATA%\SogouExplorer\UserId.enc
- <SYSTEM32>\jj.ico
- <SYSTEM32>\zt.ico
- <SYSTEM32>\favicon.ico
Deletes the following files:
- %TEMP%\aut13.tmp
- %TEMP%\aut12.tmp
- %TEMP%\aut15.tmp
- %TEMP%\aut14.tmp
- %TEMP%\autF.tmp
- %TEMP%\autE.tmp
- %TEMP%\aut11.tmp
- %TEMP%\aut10.tmp
- %TEMP%\aut16.tmp
- %TEMP%\aut1C.tmp
- %TEMP%\aut1B.tmp
- %TEMP%\xpstart.reg
- %TEMP%\cmdcom.bat
- %TEMP%\aut18.tmp
- %TEMP%\aut17.tmp
- %TEMP%\aut1A.tmp
- %TEMP%\aut19.tmp
- %TEMP%\aut6.tmp
- %TEMP%\aut5.tmp
- %TEMP%\aut8.tmp
- %TEMP%\aut7.tmp
- %TEMP%\aut2.tmp
- %TEMP%\aut1.tmp
- %TEMP%\aut4.tmp
- %TEMP%\aut3.tmp
- %TEMP%\aut9.tmp
- %TEMP%\autB.tmp
- %TEMP%\url.reg
- %TEMP%\autD.tmp
- %TEMP%\autC.tmp
- %TEMP%\IEDATA.exe
- %TEMP%\autA.tmp
- %TEMP%\com.bat
- %TEMP%\7ZSfx000.cmd
Deletes itself.
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'RegEdit_RegEdit' WindowName: ''