Technical Information
Malicious functions:
Creates and executes the following:
- %PROGRAM_FILES%\Baidu\AddressBar\ASBarBroker.exe -RegServer
- %PROGRAM_FILES%\їмЅЭ·ЅКЅ\KKDock.exe
- %HOMEPATH%\Templates\installstat.exe
- %HOMEPATH%\Templates\dzl_722160.exe
Searches for registry branches where third party applications store passwords:
- [<HKLM>\SOFTWARE\FlashFXP]
- [<HKCU>\Software\FlashFXP]
Modifies settings of Windows Explorer:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoInternetIcon' = '00000001'
Modifies file system :
Creates the following files:
- %PROGRAM_FILES%\їмЅЭ·ЅКЅ\icons\ОТµДОДµµ.png
- %PROGRAM_FILES%\їмЅЭ·ЅКЅ\icons\ОТµДµзДФ.png
- %PROGRAM_FILES%\їмЅЭ·ЅКЅ\icons\soft\ACDSee.png
- %PROGRAM_FILES%\їмЅЭ·ЅКЅ\icons\soft\FXP.png
- %PROGRAM_FILES%\їмЅЭ·ЅКЅ\icons\soft\CS.png
- %PROGRAM_FILES%\їмЅЭ·ЅКЅ\icons\їШЦЖГж°е.png
- %PROGRAM_FILES%\їмЅЭ·ЅКЅ\icons\IE1.png
- %PROGRAM_FILES%\їмЅЭ·ЅКЅ\KKDock.exe
- %PROGRAM_FILES%\їмЅЭ·ЅКЅ\icons\IE2.png
- %PROGRAM_FILES%\їмЅЭ·ЅКЅ\icons\јЗКВ±ѕ.png
- %PROGRAM_FILES%\їмЅЭ·ЅКЅ\icons\јЖЛгЖч.png
- %PROGRAM_FILES%\їмЅЭ·ЅКЅ\icons\soft\MSN.png
- %PROGRAM_FILES%\їмЅЭ·ЅКЅ\icons\soft\З§З§ѕІМэ.png
- %PROGRAM_FILES%\їмЅЭ·ЅКЅ\icons\soft\їб№·.png
- %PROGRAM_FILES%\їмЅЭ·ЅКЅ\icons\soft\УЕ»ЇґуК¦.png
- %PROGRAM_FILES%\їмЅЭ·ЅКЅ\kkjDock.cfg
- %PROGRAM_FILES%\їмЅЭ·ЅКЅ\uninst.exe
- %PROGRAM_FILES%\їмЅЭ·ЅКЅ\icons\soft\і¬ј¶НГЧУ.png
- %PROGRAM_FILES%\їмЅЭ·ЅКЅ\icons\soft\QQ.png
- %PROGRAM_FILES%\їмЅЭ·ЅКЅ\icons\soft\PS.png
- %PROGRAM_FILES%\їмЅЭ·ЅКЅ\icons\soft\RealOne.png
- %PROGRAM_FILES%\їмЅЭ·ЅКЅ\icons\soft\Word.png
- %PROGRAM_FILES%\їмЅЭ·ЅКЅ\icons\soft\Winamp.png
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Internet Exlporer.jnk
- %HOMEPATH%\My Documents\backup\Windows Media Player.lnk
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.txt
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.txt
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf
- %HOMEPATH%\My Documents\backup\Show Desktop.scf
- %PROGRAM_FILES%\Internet Explorer\SIGNUP\msn.jnk
- %TEMP%\nsd2.tmp\System.dll
- %HOMEPATH%\Desktop\Internet Exlporer.jnk
- %HOMEPATH%\My Documents\backup\Launch Internet Explorer Browser.lnk
- %HOMEPATH%\My Documents\backup\desktop.ini
- %PROGRAM_FILES%\Internet Explorer\SIGNUP\in
- %PROGRAM_FILES%\Baidu\AddressBar\AddressBar.dll
- %PROGRAM_FILES%\Baidu\AddressBar\AddressBar_Tmp\AddressBar.dll
- %PROGRAM_FILES%\Baidu\AddressBar\ASBarBroker.exe
- %ALLUSERSPROFILE%\Start Menu\Programs\百度地址栏\卸载百度地址栏.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\百度地址栏\百度地址栏官网.url
- %HOMEPATH%\Templates\readme.txt
- %HOMEPATH%\Favorites\УгУгРЎУОП·.url
- %PROGRAM_FILES%\Internet Explorer\SIGNUP\t
- %PROGRAM_FILES%\Internet Explorer\SIGNUP\t.jnk
- %HOMEPATH%\Templates\installstat.exe
- %HOMEPATH%\Desktop\МФ±¦µј№єНш.jnk
Deletes the following files:
- %HOMEPATH%\Templates\dzl_722160.exe
- %HOMEPATH%\Templates\installstat.exe
- %TEMP%\nsd2.tmp\System.dll
- %PROGRAM_FILES%\їмЅЭ·ЅКЅ\uninst.exe
- %HOMEPATH%\My Documents\backup\Launch Internet Explorer Browser.txt
- %HOMEPATH%\My Documents\backup\desktop.ini
- %HOMEPATH%\My Documents\backup\Windows Media Player.txt
- %HOMEPATH%\My Documents\backup\Show Desktop.scf
Miscellaneous:
Searches for the following windows:
- ClassName: 'Progman' WindowName: 'Program Manager'
- ClassName: 'Shell_TrayWnd' WindowName: ''