BAT.KillFiles.35

Technical Information

Modifies file system

Creates the following files

%ProgramFiles%\win32games\bb.tmp
C:\users\public\desktop\firefox.ink
%HOMEPATH%\desktop\google chrome.ink
%TEMP%\is-cvhr4.tmp\_isetup\_shfoldr.dll
%TEMP%\is-cvhr4.tmp\_isetup\_setup64.tmp
%TEMP%\is-cvhr4.tmp\_isetup\_regdll.tmp
%TEMP%\is-q9rm0.tmp\setup1.tmp
%ProgramFiles%\win32games\doset.bat
%ProgramFiles%\win32games\setup.bat
%ProgramFiles%\win32games\aaa.bat
%ProgramFiles%\win32games\xianjian.ico
%ProgramFiles%\win32games\wingames.exe
%ProgramFiles%\win32games\url.txt
%ProgramFiles%\win32games\url.dll
%ProgramFiles%\win32games\thumbs.db
%ProgramFiles%\win32games\taobao.ico
%ProgramFiles%\win32games\syspowerues.dll
%ProgramFiles%\win32games\zhuoyue.ico
%ProgramFiles%\win32games\setup.exe
%HOMEPATH%\favorites\ВµВ±ВµВ±ГГё.ink
%HOMEPATH%\favorites\Г®Г·ГіГ®ГЇГ©ВЅВЈ.ink
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\В·ВЅВ±ГЈВїГ¬Г«Г№Г«Г±Г«Г·\В·ВЅВ±ГЈВїГ¬Г«Г№Г«Г±Г«Г·.lnk
%ProgramFiles(x86)%\В·ВЅВ±ГЈВїГ¬Г«Г№Г«Г±Г«Г·\is-btb3r.tmp
%ProgramFiles(x86)%\В·ВЅВ±ГЈВїГ¬Г«Г№Г«Г±Г«Г·\is-a959c.tmp
%ProgramFiles(x86)%\В·ВЅВ±ГЈВїГ¬Г«Г№Г«Г±Г«Г·\is-tskn4.tmp
%HOMEPATH%\desktop\Г¬ГґВ±В¦ГГёВЅГ±ГЁГµГ¬ГёВјГ»Г§Гё.ink
%HOMEPATH%\desktop\Г®Г·ГіГ®ГЇГ©ВЅВЈ.ink
%HOMEPATH%\desktop\Г®Г·ГіГ®ГГё.ink
%HOMEPATH%\favorites\Г—ВїГґВЅГГё.ink
%HOMEPATH%\favorites\ВіВЈГіГЈ\ВµВ±ВµВ±ГГё.ink
%APPDATA%\microsoft\windows\start menu\internet explorer.ink
%APPDATA%\microsoft\windows\start menu\Г¬ГґВ±В¦ГГёВЅГ±ГЁГµГ¬ГёВјГ»Г§Гё.ink
%HOMEPATH%\favorites\ВіВЈГіГЈ\Г®Г·ГіГ®ГГё.ink
%HOMEPATH%\favorites\Г®Г·ГіГ®ГГё.ink
%HOMEPATH%\favorites\ВіВЈГіГЈ\Г¬ГґВ±В¦ГГёВЅГ±ГЁГµГ¬ГёВјГ»Г§Гё.ink
%HOMEPATH%\favorites\Г¬ГґВ±В¦ГГёВЅГ±ГЁГµГ¬ГёВјГ»Г§Гё.ink
%HOMEPATH%\favorites\ВіВЈГіГЈ\Г—ВїГґВЅГГё.ink
%HOMEPATH%\favorites\ВіВЈГіГЈ\Г®Г·ГіГ®ГЇГ©ВЅВЈ.ink
%ProgramFiles%\win32games\newdel.bat
%ProgramFiles%\win32games\jiuzhou.ico
%ProgramFiles%\win32games\images\xu.swf
%ProgramFiles%\win32games\images\pic_01.jpg
%ProgramFiles%\win32games\images\login.gif
%ProgramFiles%\win32games\images\loading.gif
%ProgramFiles%\win32games\images\e.gif
%ProgramFiles%\win32games\images\dds.swf
%ProgramFiles%\win32games\images\css.css
%ProgramFiles%\win32games\images\pic_03.jpg
%ProgramFiles%\win32games\images\btn.jpg
%ProgramFiles%\win32games\images\bg.gif
%ProgramFiles%\win32games\default.html
%ProgramFiles%\win32games\dangdangwang.ico
%ProgramFiles%\win32games\config.ini
%ProgramFiles%\win32games\bookmarks.dat
%ProgramFiles%\win32games\baidu.ico
%ProgramFiles%\win32games\2xi.ico
%ProgramFiles%\win32games\images\bg.jpg
%ProgramFiles%\win32games\images\pic_04.jpg
%ProgramFiles%\win32games\images\pic_02.jpg
%ProgramFiles%\win32games\images\pic_05.jpg
%ProgramFiles%\win32games\images\thumbs.db
%ProgramFiles%\win32games\images\pic_15.jpg
%ProgramFiles%\win32games\images\serverbox.gif
%ProgramFiles%\win32games\images\regbox.gif
%ProgramFiles%\win32games\images\reg.htm
%ProgramFiles%\win32games\images\reg.gif
%ProgramFiles%\win32games\images\r.gif
%ProgramFiles%\win32games\images\pic_19.gif
%ProgramFiles%\win32games\images\pic_16.jpg
%ProgramFiles%\win32games\images\pic_14.jpg
%ProgramFiles%\win32games\images\pic_06.jpg
%ProgramFiles%\win32games\images\pic_13.jpg
%ProgramFiles%\win32games\images\pic_12.jpg
%ProgramFiles%\win32games\images\pic_11.jpg
%ProgramFiles%\win32games\images\pic_10.jpg
%ProgramFiles%\win32games\images\pic_09.jpg
%ProgramFiles%\win32games\images\pic_08.jpg
%ProgramFiles%\win32games\images\pic_07.jpg
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\startup\В·ВЅВ±ГЈВїГ¬Г«Г№Г«Г±Г«Г·.lnk
%ProgramFiles(x86)%\В·ВЅВ±ГЈВїГ¬Г«Г№Г«Г±Г«Г·\unins000.dat

Deletes the following files

%ProgramFiles%\win32games\bb.tmp
%TEMP%\is-cvhr4.tmp\_isetup\_regdll.tmp
%TEMP%\is-cvhr4.tmp\_isetup\_setup64.tmp
%TEMP%\is-cvhr4.tmp\_isetup\_shfoldr.dll
%TEMP%\is-q9rm0.tmp\setup1.tmp

Moves the following files

from %ProgramFiles%\win32games\syspowerues.dll to %WINDIR%\syswow64\syspowerues.dll
from %ProgramFiles%\win32games\setup.exe to %WINDIR%\syswow64\setup1.exe
from %ProgramFiles(x86)%\В·ВЅВ±ГЈВїГ¬Г«Г№Г«Г±Г«Г·\is-tskn4.tmp to %ProgramFiles(x86)%\В·ВЅВ±ГЈВїГ¬Г«Г№Г«Г±Г«Г·\unins000.exe
from %ProgramFiles(x86)%\В·ВЅВ±ГЈВїГ¬Г«Г№Г«Г±Г«Г·\is-a959c.tmp to %ProgramFiles(x86)%\В·ВЅВ±ГЈВїГ¬Г«Г№Г«Г±Г«Г·\fangbian.exe
from %ProgramFiles(x86)%\В·ВЅВ±ГЈВїГ¬Г«Г№Г«Г±Г«Г·\is-btb3r.tmp to %ProgramFiles(x86)%\В·ВЅВ±ГЈВїГ¬Г«Г№Г«Г±Г«Г·\getmessage.dll

Network activity

Connects to

'w.##i.com':80

UDP

DNS ASK so#.5k5.net
DNS ASK bz.#ee.cn
DNS ASK w.##i.com

Miscellaneous

Searches for the following windows

ClassName: 'MS_AutodialMonitor' WindowName: ''
ClassName: 'MS_WebCheckMonitor' WindowName: ''
ClassName: 'MS_WINHELP' WindowName: ''

Creates and executes the following

'%ProgramFiles%\win32games\wingames.exe' "%ProgramFiles%\Win32Games\default.html"
'%WINDIR%\syswow64\setup1.exe' /SUPPRESSMSGBOXES /VERYSILENT
'%TEMP%\is-q9rm0.tmp\setup1.tmp' /SL5="$3026A,266676,51712,%WINDIR%\SysWOW64\setup1.exe" /SUPPRESSMSGBOXES /VERYSILENT

Executes the following

'%WINDIR%\syswow64\cmd.exe' /c ""%ProgramFiles%\Win32Games\aaa.bat" "
'%WINDIR%\syswow64\cmd.exe' /c ""%ProgramFiles%\Win32Games\doset.bat" "
'%WINDIR%\syswow64\cmd.exe' /c ""%ProgramFiles%\Win32Games\setup.bat" "
'%WINDIR%\syswow64\rundll32.exe' "%ProgramFiles%\Win32Games\URL.dll" doset
'%WINDIR%\syswow64\regsvr32.exe' syspowerues.dll /s
'%WINDIR%\syswow64\cmd.exe' /c ""%ProgramFiles%\Win32Games\aaa.bat" "' (with hidden window)
'%ProgramFiles%\win32games\wingames.exe' "%ProgramFiles%\Win32Games\default.html"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c ""%ProgramFiles%\Win32Games\doset.bat" "' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c ""%ProgramFiles%\Win32Games\setup.bat" "' (with hidden window)

Technologies

Begriffe

Schulung und Training

Mythen

Technical Information

Curing recommendations

Free trial