Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Classes\CLSID\{27AEF9E8-063F-0757-829C-A93075890E80}\Shell\Open\Command] '' = '%PROGRAM_FILES%\Internet Explorer\SIGNUP\wwwwwww.exe %w%w%w.08%184%19.%c%o%m'
Malicious functions:
Creates and executes the following:
- %WINDIR%\RkRealTech.exe \??\%WINDIR%\regedit.exe 1568 "%TEMP%\$rar10943.tmp"
- %WINDIR%\RtkSYUdp.exe filldelete ""%APPDATA%\Microsoft\Internet Explorer\Quick Launch\desktop.ini"" filldelete ""%APPDATA%\Microsoft\Internet Explorer\Quick Launch\LAUNCH~1.LNK"" filldelete ""%APPDATA%\Microsoft\Internet Explorer\Quick Launch\."" filldelete ""%APPDATA%\Microsoft\Internet Explorer\Quick Launch\..""
- %PROGRAM_FILES%\Baidu\Toolbar\BarBroker.exe -RegServer
Executes the following:
- %WINDIR%\regedit.exe
- %WINDIR%\regedit.exe /s "%TEMP%\$$RAR110987.tmp"
- <SYSTEM32>\reg.exe delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU /f
- <SYSTEM32>\cmd.exe /c "%TEMP%\$$dmsf.bat"
- <SYSTEM32>\cmd.exe /c "%TEMP%\$$rcqi.bat"
- <SYSTEM32>\cmd.exe /c "%TEMP%\$$RAVSING.bat"
- %WINDIR%\regedit.exe /s "%TEMP%\$rar10987.tmp"
- <SYSTEM32>\cmd.exe /c "%TEMP%\$$edbs.bat"
- %WINDIR%\regedit.exe /s "%TEMP%\hhhhhhh.tmp"
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system :
Creates the following files:
- %ALLUSERSPROFILE%\Start Menu\Programs\百度工具栏\垃圾清理.url
- %ALLUSERSPROFILE%\Start Menu\Programs\百度工具栏\广告拦截.url
- %ALLUSERSPROFILE%\Start Menu\Programs\百度工具栏\修复功能.url
- %ALLUSERSPROFILE%\Start Menu\Programs\百度工具栏\个性化首页.url
- %ALLUSERSPROFILE%\Start Menu\Programs\百度工具栏\隐私保护.url
- %TEMP%\hhhhhhh.tmp
- %PROGRAM_FILES%\Internet Explorer\SIGNUP\wwwwwww.exe
- %ALLUSERSPROFILE%\Start Menu\Programs\百度工具栏\屏蔽列表.url
- %ALLUSERSPROFILE%\Start Menu\Programs\百度工具栏\帮助指南.url
- %ALLUSERSPROFILE%\Start Menu\Programs\百度工具栏\伴侣导航.url
- %TEMP%\$$rcqi.bat
- %TEMP%\wwwwwww.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\005[1].htm
- %TEMP%\$$dmsf.bat
- %TEMP%\pyversion.ini
- %TEMP%\$$edbs.bat
- %ALLUSERSPROFILE%\Start Menu\Programs\百度工具栏\自定义按钮.url
- %TEMP%\$$RAR110987.tmp
- %TEMP%\version.ini
- %ALLUSERSPROFILE%\Start Menu\Programs\百度工具栏\卸载百度工具栏.lnk
- %PROGRAM_FILES%\Baidu\Toolbar\BaiduBarX_Tmp\BaiduBarX.dll
- %TEMP%\nsk3.tmp
- %PROGRAM_FILES%\Baidu\Toolbar\BaiduBarX_Tmp\rc.dll
- %WINDIR%\RkRealTech.exe
- %PROGRAM_FILES%\Baidu\Toolbar\BaiduBarX_Tmp\BarBroker.exe
- %TEMP%\ljm.exe
- %TEMP%\Baidu-Toolbar.exe
- %TEMP%\cf.exe
- %TEMP%\sogou_pinyin_mini_5072.exe
- %TEMP%\SeFastInstall.exe
- %PROGRAM_FILES%\Baidu\Toolbar\rc.dll
- %PROGRAM_FILES%\Baidu\Toolbar\BarBroker.exe
- %TEMP%\НшЦ·Ц®јТ.tmp
- %TEMP%\$$RAVSING.bat
- %CommonProgramFiles%\TaoBao\МФ±¦.tmp
- %CommonProgramFiles%\TaoBao\МФ±¦.ico
- %WINDIR%\RtkSYUdp.exe
- %TEMP%\$rar10987.tmp
- %PROGRAM_FILES%\Baidu\Toolbar\BaiduBarX.dll
- %TEMP%\$rar10943.tmp
Deletes the following files:
- %WINDIR%\RkRealTech.exe
- %WINDIR%\RtkSYUdp.exe
- %TEMP%\$rar10943.tmp
- %TEMP%\$rar10987.tmp
- %TEMP%\ljm.exe
- %TEMP%\$$RAR110987.tmp
- %TEMP%\hhhhhhh.tmp
Network activity:
Connects to:
- 'im#.#ogou.com':80
- 'pi##.#e.sogou.com':80
- 'co####.ie.sogou.com':80
- 'localhost':1034
- 'www.tt##r.com':80
TCP:
HTTP GET requests:
- im#.#ogou.com/fastversion.txt
- pi##.#e.sogou.com/sepush.gif?h=########################################################
- www.tt##r.com/ietj/005.htm?08##
- co####.ie.sogou.com/seversion.txt?h=################################
UDP:
- DNS ASK im#.#ogou.com
- DNS ASK pi##.#e.sogou.com
- DNS ASK www.tt##r.com
- DNS ASK co####.ie.sogou.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'MS_WINHELP' WindowName: ''
- ClassName: '' WindowName: '??????????? ??'
- ClassName: 'RegEdit_RegEdit' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
