Trojan.AutoIt.221

Technical Information

Malicious functions

Executes the following

'%ProgramFiles(x86)%\internet explorer\iexplore.exe' http://www.21#7.cn/?ne####

Modifies file system

Creates the following files

%TEMP%\autac84.tmp
%HOMEPATH%\favorites\【网址导航】.url
%HOMEPATH%\favorites\【疯狂购物】.url
%HOMEPATH%\favorites\【淘宝风云榜】.url
%HOMEPATH%\favorites\【淘宝特卖】.url
%HOMEPATH%\favorites\【当当商城】.url
%HOMEPATH%\favorites\在线网游.url
%HOMEPATH%\favorites\【台湾美食】.url
%HOMEPATH%\favorites\【凡客诚品】.url
%ProgramFiles(x86)%\theworld3\2\系统下载.url
%TEMP%\autb08e.tmp
%ProgramFiles(x86)%\theworld3\2\百度.url
%TEMP%\autb03f.tmp
%ProgramFiles(x86)%\theworld3\2\电视直播.url
%HOMEPATH%\favorites\【卓越特价商城】.url
%ProgramFiles(x86)%\theworld3\2\在线网游.url
%HOMEPATH%\favorites\实用查询.url
%TEMP%\autb6d8.tmp
%TEMP%\autb698.tmp
%TEMP%\autb678.tmp
%APPDATA%\microsoft\internet explorer\quick launch\世界之窗浏览器.txt
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\世界之窗浏览器.txt
%ALLUSERSPROFILE%\microsoft\windows\start menu\世界之窗浏览器.txt
%TEMP%\autb01f.tmp
%HOMEPATH%\favorites\【美容秘籍】.url
%HOMEPATH%\favorites\系统下载.url
%HOMEPATH%\favorites\百度.url
%HOMEPATH%\favorites\电视直播.url
%HOMEPATH%\favorites\游戏下载.url
%HOMEPATH%\favorites\淘宝网.url
%HOMEPATH%\favorites\家电商城.url
C:\世界之窗浏览器.lnk
%HOMEPATH%\favorites\家居玩具.url
%ProgramFiles(x86)%\theworld3\2\游戏下载.url
%TEMP%\autaffe.tmp
%ProgramFiles(x86)%\theworld3\2\淘宝网.url
%ProgramFiles(x86)%\theworld3\2\【凡客诚品】.url
%ProgramFiles(x86)%\theworld3\世界之窗.exe
%TEMP%\autad7e.tmp
%ProgramFiles(x86)%\theworld3\世界之窗.ini
%TEMP%\autad9f.tmp
%ProgramFiles(x86)%\theworld3\2\favorder3.dat
%TEMP%\autb746.tmp
%TEMP%\autadbf.tmp
%ProgramFiles(x86)%\theworld3\2\【淘宝特卖】.url
%ProgramFiles(x86)%\theworld3\2\【卓越特价商城】.url
%TEMP%\autade0.tmp
%ProgramFiles(x86)%\theworld3\2\【台湾美食】.url
%TEMP%\autadf1.tmp
%ProgramFiles(x86)%\theworld3\2\【当当商城】.url
%TEMP%\autadc0.tmp
C:\users\public\desktop\世界之窗浏览器.txt
%TEMP%\autae21.tmp
%ProgramFiles(x86)%\theworld3\2\【疯狂购物】.url
%ProgramFiles(x86)%\theworld3\2\【淘宝风云榜】.url
%TEMP%\autafcf.tmp
%ProgramFiles(x86)%\theworld3\2\家电商城.url
%TEMP%\autaef3.tmp
%ProgramFiles(x86)%\theworld3\2\家居玩具.url
%TEMP%\autaec3.tmp
%TEMP%\autae42.tmp
%ProgramFiles(x86)%\theworld3\2\实用查询.url
%TEMP%\autae11.tmp
%TEMP%\autae83.tmp
%ProgramFiles(x86)%\theworld3\2\【美容秘籍】.url
%TEMP%\autae63.tmp
%ProgramFiles(x86)%\theworld3\2\【网址导航】.url
%TEMP%\autae52.tmp
%TEMP%\autae94.tmp
%TEMP%\autb756.tmp

Sets the 'hidden' attribute to the following files

%ProgramFiles(x86)%\theworld3\世界之窗.ini

Deletes the following files

%TEMP%\autac84.tmp
%TEMP%\autb6d8.tmp
%TEMP%\autb698.tmp
%TEMP%\autb678.tmp
%TEMP%\autb08e.tmp
%TEMP%\autb03f.tmp
%TEMP%\autb01f.tmp
%TEMP%\autaffe.tmp
%TEMP%\autafcf.tmp
%TEMP%\autaef3.tmp
%TEMP%\autaec3.tmp
%TEMP%\autae94.tmp
%TEMP%\autae83.tmp
%TEMP%\autae63.tmp
%TEMP%\autae52.tmp
%TEMP%\autae42.tmp
%TEMP%\autae21.tmp
%TEMP%\autae11.tmp
%TEMP%\autadf1.tmp
%TEMP%\autade0.tmp
%TEMP%\autadc0.tmp
%TEMP%\autadbf.tmp
%TEMP%\autad9f.tmp
%TEMP%\autad7e.tmp
%TEMP%\autb746.tmp
%TEMP%\autb756.tmp

Moves the following files

from C:\users\public\desktop\世界之窗浏览器.txt to C:\users\public\desktop\绿色浏览器.lnk
from %ALLUSERSPROFILE%\microsoft\windows\start menu\世界之窗浏览器.txt to %ALLUSERSPROFILE%\microsoft\windows\start menu\世界之窗浏览器.lnk
from %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\世界之窗浏览器.txt to %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\世界之窗浏览器.lnk
from %APPDATA%\microsoft\internet explorer\quick launch\世界之窗浏览器.txt to %APPDATA%\microsoft\internet explorer\quick launch\世界之窗浏览器.lnk

Modifies the following files

Deletes itself.

Network activity

Connects to