Avira 病毒搜尋

TR/Razy.yhtwk

  • 名稱
    TR/Razy.yhtwk
  • 发现日期
    2017年7月18日
  • 類型
    Malware
  • 影響
     
  • 報告的感染
     
  • 作業系統
    Windows
  • VDF 版本
    7.14.17.236 (2017-07-18 18:40)

'TR' 一詞表示特洛伊木馬程式,它能夠偵察資料來侵害您的隱私,或是對系統執行有害的通知。

  • VDF
    7.14.17.236 (2017-07-18 18:40)
  • 檔案
    變更下列檔案:
    • %APPDATA%\Microsoft\Protect\CREDHIST
    • %APPDATA%\Microsoft\Protect\S-1-5-21-602162358-879983540-682003330-1003\Preferred
    • %temporary internet files%\Content.IE5\index.dat
    • %USERPROFILE%\Cookies\index.dat
    • %USERPROFILE%\Local Settings\History\History.IE5\index.dat
    建立下列檔案:
    • %APPDATA%\Microsoft\Protect\S-1-5-21-602162358-879983540-682003330-1003\a92a20c8-c321-421b-9ee4-ca2d9e5a2bbc
    • %APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-602162358-879983540-682003330-1003\9d1627c087e30ee6fe8c9cce3c77e841_43055624-2155-436a-a244-4fe4e5b10e24
    • %APPDATA%\BitTorrent\settings.dat.new
    • %TEMPDIR%\HYD1.tmp
    • %TEMPDIR%\HYD1.tmp.1500399985\index.hta.log
    • %USERPROFILE%\Cookies\[email protected][1].txt
    • %TEMPDIR%\HYD1.tmp.1500399985\HTA\install.1500399985.zip
    • %TEMPDIR%\HYD1.tmp.1500399985\HTA\index.hta
    • %TEMPDIR%\HYD1.tmp.1500399985\HTA\uninstall.hta
    • %TEMPDIR%\HYD1.tmp.1500399985\HTA\3rdparty\FS.dll
    • %TEMPDIR%\HYD1.tmp.1500399985\HTA\3rdparty\FS.ocx
    • %TEMPDIR%\HYD1.tmp.1500399985\HTA\i18n\br.json
    • %TEMPDIR%\HYD1.tmp.1500399985\HTA\i18n\de.json
    • %TEMPDIR%\HYD1.tmp.1500399985\HTA\i18n\en.json
    • %TEMPDIR%\HYD1.tmp.1500399985\HTA\i18n\es.json
    • %TEMPDIR%\HYD1.tmp.1500399985\HTA\i18n\fr.json
    • %TEMPDIR%\HYD1.tmp.1500399985\HTA\i18n\it.json
    • %TEMPDIR%\HYD1.tmp.1500399985\HTA\i18n\ko.json
    • %TEMPDIR%\HYD1.tmp.1500399985\HTA\i18n\pt.json
    • %TEMPDIR%\HYD1.tmp.1500399985\HTA\i18n\ru.json
    • %TEMPDIR%\HYD1.tmp.1500399985\HTA\images\bt_icon_48px.png
    • %TEMPDIR%\HYD1.tmp.1500399985\HTA\images\loading.gif
    • %TEMPDIR%\HYD1.tmp.1500399985\HTA\images\main_bittorrent.ico
    • %TEMPDIR%\HYD1.tmp.1500399985\HTA\images\main_icon.png
    • %TEMPDIR%\HYD1.tmp.1500399985\HTA\images\main_utorrent.ico
    • %TEMPDIR%\HYD1.tmp.1500399985\HTA\scripts\common.js
    • %TEMPDIR%\HYD1.tmp.1500399985\HTA\scripts\es5-shim.js
    • %TEMPDIR%\HYD1.tmp.1500399985\HTA\scripts\initialize.js
    • %TEMPDIR%\HYD1.tmp.1500399985\HTA\scripts\install.js
    • %TEMPDIR%\HYD1.tmp.1500399985\HTA\scripts\uninstall.js
    • %TEMPDIR%\HYD1.tmp.1500399985\HTA\shell_scripts\check_if_cscript_is_working.js
    • %TEMPDIR%\HYD1.tmp.1500399985\HTA\shell_scripts\shell_install_offer.js
    • %TEMPDIR%\HYD1.tmp.1500399985\HTA\shell_scripts\shell_ping_after_close.js
    • %TEMPDIR%\HYD1.tmp.1500399985\HTA\styles\common.css
    • %TEMPDIR%\HYD1.tmp.1500399985\HTA\styles\installer.css
    • %USERPROFILE%\Cookies\[email protected][2].txt
    重新命名下列檔案:
    • %APPDATA%\BitTorrent\settings.dat.new
    刪除下列檔案:
  • 插入
    • %SYSDIR%\svchost.exe{<-\RPC Control\DNSResolver}
    • %SYSDIR%\lsass.exe{<-\RPC Control\protected_storage}
    • %SYSDIR%\services.exe{<-\RPC Control\ntsvcs}
    • %SYSDIR%\svchost.exe{<-\RPC Control\IcaApi}
  • 登錄
    新增下列登錄授權碼:
    • [HKEY_CLASSES_ROOT\FalconBetaAccount] "remote_access_client_id" = "5361761192"
    • [HKEY_CLASSES_ROOT\TypeLib\{C86D85A1-58F7-4E88-993F-F6435AAAAE5F}\1.0] @ = "ActiveBinderProj Library"
    • [HKEY_CLASSES_ROOT\TypeLib\{C86D85A1-58F7-4E88-993F-F6435AAAAE5F}\1.0\FLAGS] @ = "2"
    • [HKEY_CLASSES_ROOT\TypeLib\{C86D85A1-58F7-4E88-993F-F6435AAAAE5F}\1.0\0\win32] @ = "%TEMPDIR%\HYD1.tmp.1500399985\HTA\3rdparty\FS.ocx"
    • [HKEY_CLASSES_ROOT\TypeLib\{C86D85A1-58F7-4E88-993F-F6435AAAAE5F}\1.0\HELPDIR] @ = "%TEMPDIR%\HYD1.tmp.1500399985\HTA\3rdparty\"
    • [HKEY_CLASSES_ROOT\Interface\{8ACDC97A-ED69-44A0-9FA7-214AB3450F2D}] @ = "FS"
    • [HKEY_CLASSES_ROOT\Interface\{8ACDC97A-ED69-44A0-9FA7-214AB3450F2D}\ProxyStubClsid] @ = "{00020424-0000-0000-C000-000000000046}"
    • [HKEY_CLASSES_ROOT\Interface\{8ACDC97A-ED69-44A0-9FA7-214AB3450F2D}\ProxyStubClsid32] @ = "{00020424-0000-0000-C000-000000000046}"
    • [HKEY_CLASSES_ROOT\Interface\{8ACDC97A-ED69-44A0-9FA7-214AB3450F2D}\TypeLib] @ = "{C86D85A1-58F7-4E88-993F-F6435AAAAE5F}" "Version" = "1.0"
    • [HKEY_CLASSES_ROOT\Interface\{C936EC34-11FC-4F15-81C3-8AA143BA8E4B}] @ = "IActiveBinderXEvents"
    • [HKEY_CLASSES_ROOT\Interface\{C936EC34-11FC-4F15-81C3-8AA143BA8E4B}\ProxyStubClsid] @ = "{00020420-0000-0000-C000-000000000046}"
    • [HKEY_CLASSES_ROOT\Interface\{C936EC34-11FC-4F15-81C3-8AA143BA8E4B}\ProxyStubClsid32] @ = "{00020420-0000-0000-C000-000000000046}"
    • [HKEY_CLASSES_ROOT\Interface\{C936EC34-11FC-4F15-81C3-8AA143BA8E4B}\TypeLib] @ = "{C86D85A1-58F7-4E88-993F-F6435AAAAE5F}" "Version" = "1.0"
    • [HKEY_CLASSES_ROOT\CLSID\{4E120188-0CAC-468C-B2D9-9D1F079EBC25}] @ = "ActiveBinderX Control"
    • [HKEY_CLASSES_ROOT\CLSID\{4E120188-0CAC-468C-B2D9-9D1F079EBC25}\InprocServer32] @ = "%TEMPDIR%\HYD1.tmp.1500399985\HTA\3rdparty\FS.ocx" "ThreadingModel" = "Apartment"
    • [HKEY_CLASSES_ROOT\FS.ActiveBinderX] @ = "ActiveBinderX Control"
    • [HKEY_CLASSES_ROOT\FS.ActiveBinderX\Clsid] @ = "{4E120188-0CAC-468C-B2D9-9D1F079EBC25}"
    • [HKEY_CLASSES_ROOT\CLSID\{4E120188-0CAC-468C-B2D9-9D1F079EBC25}\ProgID] @ = "FS.ActiveBinderX"
    • [HKEY_CLASSES_ROOT\CLSID\{4E120188-0CAC-468C-B2D9-9D1F079EBC25}\Version] @ = "1.0"
    • [HKEY_CLASSES_ROOT\CLSID\{4E120188-0CAC-468C-B2D9-9D1F079EBC25}\TypeLib] @ = "{C86D85A1-58F7-4E88-993F-F6435AAAAE5F}"
    • [HKEY_CLASSES_ROOT\CLSID\{4E120188-0CAC-468C-B2D9-9D1F079EBC25}\MiscStatus] @ = "0"
    • [HKEY_CLASSES_ROOT\CLSID\{4E120188-0CAC-468C-B2D9-9D1F079EBC25}\MiscStatus\1] @ = "205201"
    • [HKEY_CLASSES_ROOT\CLSID\{4E120188-0CAC-468C-B2D9-9D1F079EBC25}\ToolboxBitmap32] @ = "%TEMPDIR%\HYD1.tmp.1500399985\HTA\3rdparty\FS.ocx,1"
    • [HKEY_CLASSES_ROOT\CLSID\{4E120188-0CAC-468C-B2D9-9D1F079EBC25}\Control] @ = ""
    • [HKEY_CLASSES_ROOT\CLSID\{4E120188-0CAC-468C-B2D9-9D1F079EBC25}\Verb] @ = ""
    • [HKEY_CLASSES_ROOT\CLSID\{4E120188-0CAC-468C-B2D9-9D1F079EBC25}\Verb\0] @ = "Properties,0,2"
  • HTTP 請求
    • i*****.com/json?callback=jQuery19107599283328536606_1500399995900&_=1500399995901
  • 別名
    G Data: Gen:Variant.Razy.203901

將可疑的檔案/URL 送予我們分析,助力構建更安全的網站。

送出您的檔案/URL 或者 請前往 Avira 問答區

為何送出可疑的檔案?

如果您遇到不在我們資料庫中的可疑檔案或網站,我們會對其進行分析,確定其是否有害。我們的分析結果將向數百萬名用戶公開,並納入下一次病毒資料庫更新。如果您擁有 Avira,您也將取得此更新。尚未擁有 Avira?請前往 我們的首頁獲取。

何為 Avira 問答區?

Avira 問答區是我們大力發展的社區,由專業技術人員和兼職專家並肩合作,幫助解決技術問題。這一 Avira 用戶社區是您提出問題的絕佳場所。