Trojan.Click2.58731

Technical Information

Malicious functions:

To complicate detection of its presence in the operating system,

forces the system hide from view:

file extensions

Creates and executes the following:

'%TEMP%\nsf5.tmp\ns6.tmp' cmd.exe /c taskkill.exe /f /im zhudongfangyu.exe
'%TEMP%\nsf5.tmp\ns7.tmp' cmd.exe /c wscript.exe "<LS_APPDATA>\Temp\safeme.js"
'%TEMP%\nsf5.tmp\ns8.tmp' cmd.exe /c wscript.exe "<LS_APPDATA>\Temp\rang.vbs"
'%PROGRAM_FILES%\NetMeeting\msconf.exe'
'%PROGRAM_FILES%\winsoft9\test.exe'
'%PROGRAM_FILES%\winsoft9\t2.exe'
'%PROGRAM_FILES%\winsoft9\bho.exe'
'%PROGRAM_FILES%\NetMeeting\msconf.exe' (downloaded from the Internet)

Executes the following:

'<SYSTEM32>\wscript.exe' "<LS_APPDATA>\Temp\rang.vbs"
'<SYSTEM32>\wscript.exe' "<LS_APPDATA>\Temp\safeme.js"
'<SYSTEM32>\taskkill.exe' /f /im zhudongfangyu.exe
'<SYSTEM32>\ping.exe' 127.0.0.1 -n 6
'%WINDIR%\regedit.exe' /s %WINDIR%\reg.reg
'<SYSTEM32>\regsvr32.exe' /s "%PROGRAM_FILES%\ou\dllgnzhv.dll"
'<SYSTEM32>\wscript.exe' "%PROGRAM_FILES%\winsoft9\1.vbs"
'<SYSTEM32>\wscript.exe' "%PROGRAM_FILES%\winsoft9\3.vbs"
'<SYSTEM32>\wscript.exe' "%PROGRAM_FILES%\winsoft9\2222.vbs"
'<SYSTEM32>\reg.exe' add "HKEY_CLASSES_ROOT\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command" /v "" /d "%PROGRAM_FILES%\Internet Explorer\iexplore.exe http://www.73##.com/?we###### /f
'<SYSTEM32>\reg.exe' del "HKEY_CLASSES_ROOT\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command" /v
'<SYSTEM32>\cmd.exe' /c ""%PROGRAM_FILES%\winsoft9\3.bat" "

Sets a new unauthorized home page for Windows Internet Explorer.

Modifies file system :

Creates the following files:

%HOMEPATH%\Favorites\їґїґµзКУѕзФЪПЯґуИ«,,,ЧоєГВМЙ«ЧоРВёЯЛЩГв·СµзКУѕзНшХѕ!!!.url
<LS_APPDATA>\Temp\360se.gif
%HOMEPATH%\Favorites\µ±µ±НшЎЄНшЙП№єОпЦРРДЈєНјКйЎўДёУ¤ЎўГАЧ±ЎўјТѕУЎўКэВлЎўјТµзЎў·юЧ°ЎўР¬°ьµИЈ¬ХэЖ·µНјЫЈ¬»хµЅё¶їо.url
%HOMEPATH%\Favorites\ЧїФЅСЗВнС·НшЙП№єОпНјКйЈ¬КЦ»ъЈ¬КэВлЈ¬јТµзЈ¬»ЇЧ±Ж·Ј¬ЦУ±нЈ¬КЧКОµИФЪПЯПъКЫ.url
%HOMEPATH%\Favorites\°¬іИЕ®Ч°--ЧоГААцК±ЙРµДЕ®Ч°.ГАЕ®ВтТВЈ¬ГлЙ±°¬іИЕ®Ч°!!!.url
<LS_APPDATA>\Temp\sg.gif
%HOMEPATH%\Favorites\јх·КЈЎїмµЅИГДгјвЅРЈЎєюДПОАКУНЖјцЧуРэИвјојх·К!.url
%HOMEPATH%\Favorites\ГАЕ®·бРШґуГШѕч-20МмДЪСёЛЩФцґуґуґу!.url
%HOMEPATH%\Favorites\ЦР№ъёЈАыІКЖ±Ј¬МеУэІКЖ±µДН¶ЧўЦРРД.ІКЖ±ґуУ®јТЈЎ.url
%HOMEPATH%\Favorites\ЧоРВФЪПЯРЎЛµГв·СµДФД¶Б.·бё»ДЪИЭЛЩ¶ИїмµДРЎЛµХѕ!!!.url
%HOMEPATH%\Favorites\ЖЇББµДГАГјНјµДґујЇ...Зеґїј«Ж·і¬ј¶ГАГДРґХжЈЎЈЎ.url
%HOMEPATH%\Favorites\ЧоРВј«Ж·ВМЙ«єГµДµзУ°ївГв·С.ёЯЗеёЯЛЩЈЎМмМмёьРВ!!!.url
<LS_APPDATA>\Temp\ff.gif
%HOMEPATH%\Favorites\45575.comФЪПЯµДРЎУОП·.ЧоєГНжЧоРВЧоїмїбі¬ј¶РЎУОП·!!!.url
%HOMEPATH%\Favorites\ИЛМеѕшГАµДТХКхХѕ.Ч·ЗуЧоГАИЛМеј«Ж·ЙгУ°ОЁГАРґХж!!.url
%HOMEPATH%\Favorites\МФ±¦Нш - МФЈЎОТПІ»¶.url
%TEMP%\nsf5.tmp\ns7.tmp
%ALLUSERSPROFILE%\Desktop\Internet Explorer.exe
%TEMP%\nsf5.tmp\ns6.tmp
%ALLUSERSPROFILE%\Desktop\IESafe.lnk
<SYSTEM32>\ShowDisktop.SCF
%WINDIR%\reg.reg
%TEMP%\nsf5.tmp\ns8.tmp
%PROGRAM_FILES%\ou\dllgnzhv.dll
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.exe
%ALLUSERSPROFILE%\Desktop\НшЙПМФ±¦.exe
C:\safelog.js
%TEMP%\nsf5.tmp\ShellLink.dll
%PROGRAM_FILES%\NetMeeting\msconf.exe
%TEMP%\nsf5.tmp\nsExec.dll
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\huachi[1].htm
%ALLUSERSPROFILE%\Desktop\ФЪПЯРЎУОП·.exe
%PROGRAM_FILES%\winsoft9\test.exe
%PROGRAM_FILES%\winsoft9\bho.exe
%PROGRAM_FILES%\winsoft9\1.vbs
%PROGRAM_FILES%\winsoft9\2222.vbs
<SYSTEM32>\nsf4tmp\nsp2tmp.exe
<LS_APPDATA>\Temp\tb.gif
%PROGRAM_FILES%\winsoft9\t2.exe
%TEMP%\nsf5.tmp\System.dll
%PROGRAM_FILES%\winsoft9\77zb.ico
%PROGRAM_FILES%\winsoft9\game.ico
%PROGRAM_FILES%\winsoft9\3.bat
%PROGRAM_FILES%\winsoft9\3.vbs
%PROGRAM_FILES%\winsoft9\taobao.ico
%PROGRAM_FILES%\winsoft9\mm.ico
%PROGRAM_FILES%\winsoft9\kusila.ico
%PROGRAM_FILES%\winsoft9\qq.ico
%TEMP%\nsf5.tmp\VPatch.dll
<LS_APPDATA>\Temp\xyx.gif
<LS_APPDATA>\Temp\safeme.js
<LS_APPDATA>\Temp\rang.vbs
%HOMEPATH%\Favorites\ј«єГµДФЪПЯНшВзµзКУ.lnk
<LS_APPDATA>\Temp\tt.gif
%WINDIR%\userid.txt
<LS_APPDATA>\Temp\ie.gif
<LS_APPDATA>\Temp\ie.pat
<LS_APPDATA>\Temp\tt.pat
<LS_APPDATA>\Temp\xyx.pat
<LS_APPDATA>\Temp\sg.pat
<LS_APPDATA>\Temp\jia.reg
<LS_APPDATA>\Temp\ff.pat
<LS_APPDATA>\Temp\360se.pat