Adware.BGuard.37

Техническая информация

Вредоносные функции:

Создает и запускает на исполнение:

'%TEMP%\install_helper.exe' /browser=IE /guid={18DBB6CE-3148-4FEC-B481-103CB3290427}
'%APPDATA%\SpeedAnalysis2\install_helper.exe' /browser=CH /path="%APPDATA%\SpeedAnalysis2\SpeedAnalysis.crx" /id=dgjkhjdcljddbedokogakmmdjgnbeanf
'%TEMP%\speedanalysis.exe' /S
'%PROGRAM_FILES%\Speed Analysis 2\BackgroundHost.exe' /RegServer

Запускает на исполнение:

'<SYSTEM32>\regsvr32.exe' /s "%PROGRAM_FILES%\Speed Analysis 2\ScriptHost.dll"
'<SYSTEM32>\regsvr32.exe' /s "%PROGRAM_FILES%\Speed Analysis 2\ButtonSite.dll"
'<SYSTEM32>\regsvr32.exe' /s "%PROGRAM_FILES%\Speed Analysis 2\AddonsFramework.Typelib.dll"
'<SYSTEM32>\taskkill.exe' /F /IM PropertySync.exe
'<SYSTEM32>\taskkill.exe' /F /IM BackgroundHost.exe
'<SYSTEM32>\taskkill.exe' /F /IM BackgroundHost64.exe

Завершает или пытается завершить

следующие пользовательские процессы:

firefox.exe

Изменения в файловой системе:

Создает следующие файлы:

%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\Extensions\speedanalysis02@SpeedAnalysis.com\chrome\content\framework.js
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\Extensions\speedanalysis02@SpeedAnalysis.com\chrome\content\framework.png
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\Extensions\speedanalysis02@SpeedAnalysis.com\chrome\content\config.js
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\Extensions\speedanalysis02@SpeedAnalysis.com\chrome\content\content.js
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\Extensions\speedanalysis02@SpeedAnalysis.com\chrome\content\icon16.png
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\Extensions\speedanalysis02@SpeedAnalysis.com\chrome\content\icon18.ico
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\Extensions\speedanalysis02@SpeedAnalysis.com\chrome\content\framework.xul
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\Extensions\speedanalysis02@SpeedAnalysis.com\chrome\content\icon128.png
%TEMP%\che4.tmp
%TEMP%\speedanalysis.xpi
%APPDATA%\SpeedAnalysis2\speedanalysis.crx
%APPDATA%\SpeedAnalysis2\install_helper.exe
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\Extensions\speedanalysis02@SpeedAnalysis.com\chrome\content\bg.js
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\Extensions\speedanalysis02@SpeedAnalysis.com\chrome\content\button.xml
%TEMP%\nsi5.tmp\nsisunz.dll
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\Extensions\speedanalysis02@SpeedAnalysis.com\chrome\content\background.html
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\Extensions\speedanalysis02@SpeedAnalysis.com\chrome\content\settings.json
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\Extensions\speedanalysis02@SpeedAnalysis.com\chrome\skin\framework.css
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\Extensions\speedanalysis02@SpeedAnalysis.com\chrome\content\mz\content.js
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\Extensions\speedanalysis02@SpeedAnalysis.com\chrome\content\options.xul
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions.sqlite-journal
%PROGRAM_FILES%\Speed Analysis 2\uninst.exe
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\Extensions\speedanalysis02@SpeedAnalysis.com\chrome.manifest
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\Extensions\speedanalysis02@SpeedAnalysis.com\install.rdf
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\Extensions\speedanalysis02@SpeedAnalysis.com\chrome\content\icon24.png
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\Extensions\speedanalysis02@SpeedAnalysis.com\chrome\content\icon32.ico
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\Extensions\speedanalysis02@SpeedAnalysis.com\chrome\content\icon18.png
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\Extensions\speedanalysis02@SpeedAnalysis.com\chrome\content\icon24.ico
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\Extensions\speedanalysis02@SpeedAnalysis.com\chrome\content\jquery-1.9.1.min.js
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\Extensions\speedanalysis02@SpeedAnalysis.com\chrome\content\mz\background.js
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\Extensions\speedanalysis02@SpeedAnalysis.com\chrome\content\icon32.png
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\Extensions\speedanalysis02@SpeedAnalysis.com\chrome\content\icon48.png
%TEMP%\install_helper.exe
%PROGRAM_FILES%\Speed Analysis 2\ScriptHost.dll
%PROGRAM_FILES%\Speed Analysis 2\background.html
%PROGRAM_FILES%\Speed Analysis 2\ButtonSite.dll
%PROGRAM_FILES%\Speed Analysis 2\ButtonSite64.dll
%PROGRAM_FILES%\Speed Analysis 2\content.js
%PROGRAM_FILES%\Speed Analysis 2\icon128.png
%PROGRAM_FILES%\Speed Analysis 2\bg.js
%PROGRAM_FILES%\Speed Analysis 2\config.xml
%TEMP%\nsl3.tmp\ie9install.bmp
%TEMP%\nsl3.tmp\UAC.dll
%TEMP%\speedanalysis.exe
%TEMP%\nsl3.tmp\help_page.ini
%PROGRAM_FILES%\Speed Analysis 2\BackgroundHost64.exe
%PROGRAM_FILES%\Speed Analysis 2\BackgroundHostPS.dll
%PROGRAM_FILES%\Speed Analysis 2\AddonsFramework.Typelib.dll
%PROGRAM_FILES%\Speed Analysis 2\BackgroundHost.exe
%PROGRAM_FILES%\Speed Analysis 2\updater.js
%PROGRAM_FILES%\Speed Analysis 2\updaterWrapper.js
%PROGRAM_FILES%\Speed Analysis 2\jquery-1.9.1.min.js
%PROGRAM_FILES%\Speed Analysis 2\json2.min.js
%PROGRAM_FILES%\Speed Analysis 2\uninstall.exe
%TEMP%\nsl3.tmp\System.dll
%PROGRAM_FILES%\Speed Analysis 2\mz\background.js
%PROGRAM_FILES%\Speed Analysis 2\mz\content.js
%PROGRAM_FILES%\Speed Analysis 2\icon18.png
%PROGRAM_FILES%\Speed Analysis 2\icon24.ico
%PROGRAM_FILES%\Speed Analysis 2\icon16.png
%PROGRAM_FILES%\Speed Analysis 2\icon18.ico
%PROGRAM_FILES%\Speed Analysis 2\icon32.png
%PROGRAM_FILES%\Speed Analysis 2\icon48.png
%PROGRAM_FILES%\Speed Analysis 2\icon24.png
%PROGRAM_FILES%\Speed Analysis 2\icon32.ico