Trojan.KillProc.18590

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKCU>\Control Panel\Desktop] 'SCRNSAVE.EXE' = '<SYSTEM32>\Funshion.scr'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Funshion' = '"%PROGRAM_FILES%\Funshion Online\Funshion\Funshion.exe" startbywindows tray'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Funshion' = '%PROGRAM_FILES%\Funshion Online\Funshion\funshion.exe startbywindows tray'
[<HKLM>\SOFTWARE\Classes\fsp\shell\open\command] '' = '"%PROGRAM_FILES%\Funshion Online\Funshion\funshion.exe" %1'
[<HKLM>\SOFTWARE\Classes\Funshion Task\shell\open\Command] '' = '"%PROGRAM_FILES%\Funshion Online\Funshion\funshion.exe" "%1"'
[<HKLM>\SOFTWARE\Classes\FunshionRMVB\shell\open\command] '' = '"%PROGRAM_FILES%\Funshion Online\Funshion\Funshion.exe" "%1"'
[<HKLM>\SOFTWARE\Classes\fsp\shell\open\command] '' = '"%PROGRAM_FILES%\Funshion Online\Funshion\Funshion.exe" "%1"'
[<HKLM>\SOFTWARE\Classes\FunshionMp4\shell\open\command] '' = '"%PROGRAM_FILES%\Funshion Online\Funshion\Funshion.exe" "%1"'
[<HKLM>\SOFTWARE\Classes\fsp\shell\open\command] '' = '"%PROGRAM_FILES%\Funshion Online\Funshion\Funshion.exe" "%1" /dummy'
[<HKLM>\SOFTWARE\Classes\Funshion Task\shell\open\Command] '' = '"%PROGRAM_FILES%\Funshion Online\Funshion\Funshion.exe" "%1" /dummy'

Malicious functions:

To bypass firewall, removes or modifies the following registry keys:

[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\Funshion Online\Funshion\FunshionUpgrade.exe' = '%PROGRAM_FILES%\Funshion Online\Funshion\FunshionUpgrade.exe:*:Enabled:FunshionUpgrade'
[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\Funshion Online\Funshion\FunshionService.exe' = '%PROGRAM_FILES%\Funshion Online\Funshion\FunshionService.exe:*:Enabled:FunshionService'

Creates and executes the following:

%PROGRAM_FILES%\Funshion Online\Funshion\Funshion.exe startbyinstall
%PROGRAM_FILES%\Funshion Online\Funshion\FunshionService.exe UISTARTFSPSERVER
%TEMP%\FunshionInstall_C66549.exe /S
%TEMP%\xml2fspdata.exe "%PROGRAM_FILES%\Funshion Online\Funshion\control\\"

Executes the following:

<SYSTEM32>\regsvr32.exe /s "<SYSTEM32>\quartz.dll"
<SYSTEM32>\taskkill.exe /f /im "FunshionUpgrade.exe"
<SYSTEM32>\taskkill.exe /f /im "funshion.scr"
<SYSTEM32>\regsvr32.exe /s "%PROGRAM_FILES%\Funshion Online\Funshion\FunshionAddr\funshionAddr.dll"
<SYSTEM32>\taskkill.exe /f /im "FunshionUpdate.exe"
<SYSTEM32>\taskkill.exe /f /im "FSPServer.exe"
<SYSTEM32>\taskkill.exe /f /im "Funshion.exe"
<SYSTEM32>\taskkill.exe /f /im "Updater.exe"
<SYSTEM32>\taskkill.exe /f /im "FunshionService.exe"

Modifies file system :

Creates the following files:

%PROGRAM_FILES%\Funshion Online\Funshion\skin\TaskText.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\TaskTextEn.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\TaskTabBtnPopIcon.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\TaskMngBtnIcon.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\TaskTabBkgnd.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\TaskToolBarDelete.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\TaskToolBarDiskClear.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\TaskToolBarBkgnd.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\TaskToolBarBk.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\TaskToolBarBk000.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\TaskMgnBarCurItem.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\TaskMgnBarItem.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\TaskMgnBarBk.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\TaskManagerCloseBtn.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\TaskManagerCloseTxtBtn.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\TaskMgnTitleLeft.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\TaskMgnTitleRight.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\TaskMgnTitleBkgnd.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\TaskMgnBarLScrollBtn.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\TaskMgnBarRScrollBtn.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\UpdateBtmBkgnd.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\UpdateBtmCloseBtn.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\TipTopArrow.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\TipBottomArrow.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\TipRightArrow.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\UpdateCapCloseBtn.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\UpdateCaption.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\UpdateCapBkgnd.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\UpdateBtmIgoreBtn.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\UpdateBtmUpdateBtn.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\TaskToolBarPlay.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\TaskToolBarRestore.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\TaskToolBarMoveUp.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\TaskToolBarDownload.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\TaskToolBarMoveDown.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\TaskToolBarStop.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\TextBtnBk.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\TaskToolBarSplid.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\TaskToolBarShowWeb.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\TaskToolBarShowWebEn.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\ScrollBarVerWidgetHeadHover.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\ScrollBarVerWidgetHeadL.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\ScrollBarVerWidgetHead.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\ScrollBarVerWidgetBkgndHover.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\ScrollBarVerWidgetBkgndL.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\ScrollBarVerWidgetTrail.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\ScrollBarVerWidgetTrailHover.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\ScrollBarVerWidgetMidL.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\ScrollBarVerWidgetMid.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\ScrollBarVerWidgetMidHover.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\ScrollBarDownArrowRound.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\ScrollBarUpArrow.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\ScrollBarDownArrowL.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\Scroll.gif
%PROGRAM_FILES%\Funshion Online\Funshion\skin\ScrollBarDownArrow.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\ScrollBarVerBkgndL.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\ScrollBarVerWidgetBkgnd.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\ScrollBarVerBkgnd.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\ScrollBarUpArrowL.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\ScrollBarUpArrowRound.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\TaskBarTipDownArrow.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\TaskListBtnHide.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\TaskBarBtnOpenLcl.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\TabModeBtn.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\TaskBarBtnMenu.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\TaskListStatIcons.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\TaskListStatSelIcon.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\TaskListRightLine.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\TaskListBtnShow.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\TaskListRePlayBtn.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\ShowPlayInfoBtn.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\SplidBarBkgnd.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\ScrollLinkFrm.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\ScrollBarVerWidgetTrailL.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\ScrollLinkBkgnd.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\StatusBarRight.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\StatusBarSplid.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\StatusBarLeft.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\SplidBarMark.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\StatusBarBkgnd.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\Media\Start Funshion.lnk
%PROGRAM_FILES%\Funshion Online\Funshion\Media\Install Latest Funshion.lnk
%ALLUSERSPROFILE%\Start Menu\Funshion.lnk
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\Funshion.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Funshion\Funshion.lnk
%TEMP%\xml2fspdata.exe
%TEMP%\nsm5.tmp\ExecDos.dll
%HOMEPATH%\Cookies\%USERNAME%@funshion[1].txt
%PROGRAM_FILES%\Funshion Online\Funshion\Uninstall.exe
%ALLUSERSPROFILE%\Start Menu\Programs\Funshion\Uninstall Funshion.lnk
%PROGRAM_FILES%\Funshion Online\Funshion\Funshop2.ico
%ALLUSERSPROFILE%\Desktop\Shopping Sites.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Funshion\Pop Game.lnk
%TEMP%\funpost.dat
%ALLUSERSPROFILE%\Start Menu\Programs\Funshion\Shopping Sites.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Funshion\Update History.lnk
%ALLUSERSPROFILE%\Desktop\Funshion.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Funshion\Funshion Use Help.lnk
%HOMEPATH%\funshion\update\Pop Game.lnk
%HOMEPATH%\funshion\update\Shopping Sites.lnk
<SYSTEM32>\Funshion.scr
%PROGRAM_FILES%\Funshion Online\Funshion\FunshionService.diagnose
%TEMP%\nsm5.tmp\nsisXML.dll
%PROGRAM_FILES%\Funshion Online\Funshion\FunshionAddr\conf.xml
%PROGRAM_FILES%\Funshion Online\Funshion\FunshionAddr\funshionAddr.dll
%HOMEPATH%\funshion\update\flashParam.txt
%HOMEPATH%\funshion\update\flashParam.txt.bak
%HOMEPATH%\funshion\ini\httpfile.ini
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\first[1]
%HOMEPATH%\funshion\ini\temp_config.ini
%PROGRAM_FILES%\Funshion Online\Funshion\Dump.dll
%PROGRAM_FILES%\Funshion Online\Funshion\nicdescr.dat
%PROGRAM_FILES%\Funshion Online\Funshion\GetMACAddress.dll
%PROGRAM_FILES%\Funshion Online\Funshion\FunshionUpgrade.exe
%PROGRAM_FILES%\Funshion Online\Funshion\dbghelp.dll
%HOMEPATH%\funshion\install.ini
%PROGRAM_FILES%\Funshion Online\Funshion\FunshionAddr\ASBarBroker.exe
%TEMP%\post.dat
%HOMEPATH%\Cookies\%USERNAME%@funshion[2].txt
%PROGRAM_FILES%\Funshion Online\Funshion\skin\bmpQuestion.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\bmpTimerClose.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\bmpPrompt.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\bmpMenuBk.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\bmpPlayBarTip.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\vodPlay.gif
%PROGRAM_FILES%\Funshion Online\Funshion\skin\vodPlayEn.gif
%PROGRAM_FILES%\Funshion Online\Funshion\skin\list_expend.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\imgCleanFileBtn.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\imgDrawMenuItem.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\WebCloseBtn.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\WebCloseBtnRgn.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\UpdateIconSuc.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\UpdateIconFail.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\UpdateIconInit.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\bmpError.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\bmpListHeaderBk.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\bmpClearDisk.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\WebToolBarBk.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\bmpCleanFile.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\coreavc.ax
%HOMEPATH%\funshion\cache\Cacheflash\donghuanew_18.swf
%PROGRAM_FILES%\Funshion Online\Funshion\CoreAAC.ax
%PROGRAM_FILES%\Funshion Online\Funshion\cook.dll
%PROGRAM_FILES%\Funshion Online\Funshion\drvc.dll
%PROGRAM_FILES%\Funshion Online\Funshion\FunshionGame2.ico
%ALLUSERSPROFILE%\Desktop\Pop Game.lnk
%PROGRAM_FILES%\Funshion Online\Funshion\Funshion-install.ico
%HOMEPATH%\funshion\cache\Cacheflash\blankFs.swf
%PROGRAM_FILES%\Funshion Online\Funshion\FunShion.ini
%PROGRAM_FILES%\Funshion Online\Funshion\icon\MP4.ico
<SYSTEM32>\funshion.ini
%PROGRAM_FILES%\Funshion Online\Funshion\icon\RMVB.ico
%PROGRAM_FILES%\Funshion Online\Funshion\skin\vodWeb.gif
%PROGRAM_FILES%\Funshion Online\Funshion\skin\vodWebEn.gif
%PROGRAM_FILES%\Funshion Online\Funshion\pndx5032.dll
%PROGRAM_FILES%\Funshion Online\Funshion\rmoc3260.dll
%PROGRAM_FILES%\Funshion Online\Funshion\pndx5016.dll
%HOMEPATH%\funshion.ini
%PROGRAM_FILES%\Funshion Online\Funshion\pncrt.dll
%PROGRAM_FILES%\Funshion Online\Funshion\skin\RpcStartDlgBk.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\GetFspFile.gif
%PROGRAM_FILES%\Funshion Online\Funshion\skin\HidePlayInfoBtn.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\DragCorner.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\CheckBox_Check.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\DiskWarnning.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\IeToolBarBkgnd.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\IeToolBarForward.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\IeToolBarBack.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\IErrorReshBtn.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\IErrorWndBk.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\CaptionMenuFEn.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\CaptionMinBtn.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\CaptionMenuF.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\CaptionMenuBtn.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\CaptionMenuBtnEn.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\ChangeModeBtn.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\CheckBox_Box.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\CaptionTextEn.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\CaptionNormalBtn.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\CaptionText.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\MainNcFrameTop.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\MainNcLeftBtmCorner.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\MainNcFrameRight.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\MainNcFrameBtm.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\MainNcFrameLeft.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\OpenLocalBtnMenu.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\OptionBtnArrow.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\MainNcRightTopCorner.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\MainNcLeftTopCorner.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\MainNcRightBtmCorner.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\IeToolBarShopPage.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\IeToolBarShowPlayer.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\IeToolBarRefresh.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\IeToolBarGamePage.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\IeToolBarHomePage.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\ListHeaderSplid.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\LoadTeleplayWeb.gif
%PROGRAM_FILES%\Funshion Online\Funshion\skin\ListHeaderBkgnd.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\IeToolBarShowPlayerEn.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\IntergrateModeBtn.bmp
%TEMP%\welcome.bmp
%TEMP%\welcomekugou.bmp
%TEMP%\instpath.ini
%TEMP%\nsm5.tmp\InstPath.ini
%TEMP%\welcomepage.ini
%TEMP%\installpathen.bmp
%TEMP%\installfilescn.bmp
%TEMP%\installpathcn.bmp
%TEMP%\licensecn.bmp
%TEMP%\licenseen.bmp
%TEMP%\FunshionInstall_C66549.exe
%TEMP%\nsm4.tmp
%TEMP%\aut2.tmp
%TEMP%\aut1.tmp
%TEMP%\config.xml
%TEMP%\nsm5.tmp\ExecCmd.dll
%TEMP%\nsm5.tmp\WelcomePage.ini
%TEMP%\nsm5.tmp\KillProcDLL.dll
%TEMP%\nsm5.tmp\System.dll
%TEMP%\nsm5.tmp\FindProcDLL.dll
%PROGRAM_FILES%\Funshion Online\Funshion\quality.dll
%PROGRAM_FILES%\Funshion Online\Funshion\fpsrv.dll
%PROGRAM_FILES%\Funshion Online\Funshion\LangResEnAmerican.dll
%PROGRAM_FILES%\Funshion Online\Funshion\funshionplugin2.dll
%PROGRAM_FILES%\Funshion Online\Funshion\FunshionService.exe
%PROGRAM_FILES%\Funshion Online\Funshion\skin\CaptionCloseBtn.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\CaptionMaxBtn.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\CaptionBkgnd.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\fptassrv.dll
%PROGRAM_FILES%\Funshion Online\Funshion\skin\Buffering.gif
%TEMP%\nicdescr.dat
%TEMP%\Dump.dll
%TEMP%\getmacaddress.dll
%TEMP%\installfilesen.bmp
%TEMP%\funshion.ini
%PROGRAM_FILES%\Funshion Online\Funshion\CrashReport.exe
%PROGRAM_FILES%\Funshion Online\Funshion\Funshion.exe
%TEMP%\posts.dat
%TEMP%\nsm5.tmp\md5dll.dll
%TEMP%\nsm5.tmp\NSISdl.dll
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayerBarBtnNonTop.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayerBarBtnNormal.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayerBarBtnNextSmall.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayerBarBtnMuteSmall.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayerBarBtnNext.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayerBarBtnPlayList.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayerBarBtnPlaySmall.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayerBarBtnPlay.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayerBarBtnPause.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayerBarBtnPauseSmall.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlaySplidBarThumb.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlaySplidBarThumbSmall.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlaySplidBarHeadSmall.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlaySplidBarDownloadSmall.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlaySplidBarHead.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayerBarBtnFullView.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayerBarBtnMute.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayerBarBkgnd.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlaySplidBarTrail.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlaySplidBarTrailSmall.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayerHideBtnEn.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayerSimpleBarBk.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayerHideBtn.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayerBarRightBk.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayerBarSplid.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\RadioBtnPt.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\RpcLoading.gif
%PROGRAM_FILES%\Funshion Online\Funshion\skin\RadioBtnBox.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayerSimpleBarBkgnd.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayerTipCloseBtn.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayerBarBtnSimple.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayerBarBtnStop.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayerBarBtnSetting.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayerBarBtnPre.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayerBarBtnPreSmall.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayerBarBtnVolumeSmall.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayerBarLeftBk.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayerBarBtnVolume.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayerBarBtnStopSmall.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayerBarBtnTop.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayBarVolumeBarBkgndRightSmall.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayBarVolumeBarBkgndSmall.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayBarVolumeBarBkgndRight.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayBarSplidRgn.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayBarVolumeBarBkgnd.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayBufferInfoWndLeft.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayBufferInfoWndRight.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayBufferInfoWndBkgnd.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayBarVolumeBarThumb.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayBarVolumeBarThumbSmall.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\OptionSplideBarBkgnd.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\OptionSplideBarThumb.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\OptionSplidBarTrail.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\OptionBtnBk.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\OptionSplidBarHead.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PauseFlickerBtn.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayBarSplidLineBk.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PauseAdCloseBtn.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\OptionText.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\OptionTextEn.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayListVerSplid.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayListVerSplidMark.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayListRemove.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayInfoTitleEn.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayListAddBtn.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlaySplidBarBkgndSmall.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlaySplidBarDownload.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlaySplidBarBkgnd.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlaySplidBarBefore.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlaySplidBarBeforeSmall.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayInfoBtnMenu.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayInfoCurPlay.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayInfoBtmBar.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayInfoBkgnd.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayInfoBkgndSel.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayInfoTitle.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayInfoTitleBk.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayInfoItemTextHover.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayInfoHeaderBkgnd.bmp
%PROGRAM_FILES%\Funshion Online\Funshion\skin\PlayInfoItemTextBk.bmp

Deletes the following files:

%PROGRAM_FILES%\Funshion Online\Funshion\FunshionAddr\conf.xml
%TEMP%\nsm5.tmp\ExecCmd.dll
%TEMP%\nsm5.tmp\ExecDos.dll
%TEMP%\config.xml
%TEMP%\installpathen.bmp
%TEMP%\installfilescn.bmp
%TEMP%\installfilesen.bmp
%TEMP%\nsm5.tmp\FindProcDLL.dll
%TEMP%\nsm5.tmp\nsisXML.dll
%TEMP%\nsm5.tmp\System.dll
%TEMP%\nsm5.tmp\WelcomePage.ini
%TEMP%\nsm5.tmp\NSISdl.dll
%TEMP%\nsm5.tmp\InstPath.ini
%TEMP%\nsm5.tmp\KillProcDLL.dll
%TEMP%\nsm5.tmp\md5dll.dll
%TEMP%\installpathcn.bmp
%TEMP%\funpost.dat
%TEMP%\xml2fspdata.exe
%HOMEPATH%\Cookies\%USERNAME%@funshion[1].txt
%TEMP%\posts.dat
%TEMP%\aut1.tmp
%TEMP%\aut2.tmp
%TEMP%\funshion.ini
%HOMEPATH%\Cookies\%USERNAME%@funshion[2].txt
%TEMP%\welcomekugou.bmp
%TEMP%\licensecn.bmp
%TEMP%\licenseen.bmp
%TEMP%\welcome.bmp
%TEMP%\post.dat
%TEMP%\welcomepage.ini
%TEMP%\instpath.ini

Network activity:

Connects to:

'up####.funshion.com':80
'sq#.##nshion.com':8000
'se#####-bs.funshion.com':8000
'ad.##nshion.com':80
'st##.#unshion.net':80
'pa#####.funshion.com':80
'fs.##nshion.com':80
'localhost':1043

TCP:

HTTP GET requests:

st##.#unshion.net/client/screensaver_oversee?ma###############################################################################
up####.funshion.com/fpupdate/INI/config_update_funplayer.txt
ad.##nshion.com/control/adredirect.html
up####.funshion.com/fpupdate/UPDATE/HttpFile.txt
fs.##nshion.com/publish/first?ve###
st##.#unshion.net/ecom-vas/desktop?gr##########################################################
pa#####.funshion.com/partner/install_start.php?s=##########################################################################################
pa#####.funshion.com/partner/query_banding_stat.php?s=##################################################################################################################################################################################
pa#####.funshion.com/partner/install_statistic.php?s=###############################################################################################################################################################################

UDP:

DNS ASK ns#.##nshion.com
DNS ASK sq#.##nshion.com
DNS ASK ad.##nshion.com
DNS ASK up####.funshion.com
DNS ASK se#####-bs.funshion.com
DNS ASK pa#####.funshion.com
DNS ASK st##.#unshion.net
DNS ASK fs.##nshion.com
DNS ASK ns.##nshion.com
'ns#.##nshion.com':8080
'ns.##nshion.com':8080
'se#####-bs.funshion.com':8000
'ns.##nshion.com':8000
'ns#.##nshion.com':8000

Miscellaneous:

Searches for the following windows:

ClassName: 'Shell_TrayWnd' WindowName: ''
ClassName: 'MS_AutodialMonitor' WindowName: ''
ClassName: 'MS_WebcheckMonitor' WindowName: ''
ClassName: '' WindowName: ''
ClassName: 'funshion_updater_msg' WindowName: ''
ClassName: 'NDDEAgnt' WindowName: 'NetDDE Agent'

技术

术语

教育培训

误区

Technical Information

Curing recommendations

Free trial