Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'CashBack' = '%PROGRAM_FILES%\CashBack\bin\cashback.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'NaviSearch' = '%PROGRAM_FILES%\NaviSearch\bin\nls.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'BullsEye Network' = '%PROGRAM_FILES%\BullsEye Network\bin\bargains.exe'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\ZESOFT] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- <SYSTEM32>\exdl3.exe 3~0
- <SYSTEM32>\angelex.exe 0
- %WINDIR%\autoheal.exe
- <SYSTEM32>\instsrv.exe ZESOFT %WINDIR%\zeta.exe
- <SYSTEM32>\exdl1.exe 1~0
- <SYSTEM32>\exdl2.exe 2~0
- <SYSTEM32>\msexreg.exe /S HKLM SOFTWARE\CashBack <SYSTEM32>\vx3.nls /S HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\CashBack <SYSTEM32>\vx3x.nls /S HKLM SOFTWARE\eXactUtil <SYSTEM32>\vx0.nls /S HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\NaviSearch <SYSTEM32>\vx2x.nls /S HKLM SOFTWARE\Bargains <SYSTEM32>\vx1.nls /S HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BargainBuddy <SYSTEM32>\vx1x.nls /S HKLM SOFTWARE\NaviSearch <SYSTEM32>\vx2.nls
- %WINDIR%\cb8036_MARKETING14.exe
- %WINDIR%\nls8037_MARKETING14.exe
- %WINDIR%\adp8036_MARKETING14.exe
- %WINDIR%\exdl.exe 3~No 2~No 1~No
- %PROGRAM_FILES%\BullsEye Network\bin\bargains.exe
- %PROGRAM_FILES%\NaviSearch\bin\nls.exe
- %PROGRAM_FILES%\CashBack\bin\cashback.exe
Запускает на исполнение:
- <SYSTEM32>\regsvr32.exe /s <SYSTEM32>\mscb.dll
- %WINDIR%\explorer.exe "http://www.na###earch.net/redir/fc_install_redir.html"
- <SYSTEM32>\regsvr32.exe /s <SYSTEM32>\msbe.dll
- <SYSTEM32>\regsvr32.exe /s <SYSTEM32>\nvms.dll
Изменения в файловой системе:
Создает следующие файлы:
- <SYSTEM32>\exdl3.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\webservice[1].main
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\webservice[1].main
- %PROGRAM_FILES%\NaviSearch\t1309779143.dec
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\webservice[1].main
- <SYSTEM32>\exdl2.exe
- <SYSTEM32>\instsrv.exe
- <SYSTEM32>\msexreg.exe
- <SYSTEM32>\angelex.exe
- <SYSTEM32>\exdl1.exe
- %TEMP%\nsqA.tmp
- %PROGRAM_FILES%\CashBack\Uninstall.exe
- C:\temp\bb_click_wider.swf
- C:\temp\bb_auto_wider.swf
- %PROGRAM_FILES%\CashBack\bin\flash.exe
- %PROGRAM_FILES%\CashBack\bin\cashback.exe
- %PROGRAM_FILES%\CashBack\bin\cb.exe
- C:\temp\bb_welcome.html
- C:\temp\logo.gif
- <SYSTEM32>\mscb.dll
- C:\temp\icon.gif
- C:\temp\bb_welcome1.swf
- C:\temp\blank.gif
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\webservice[2].main
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\fc_install_redir[1].html
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\webservice[2].main
- <SYSTEM32>\vx3x.nls
- <SYSTEM32>\psis80ex.ax
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\webservice[3].main
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\webservice[3].main
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\webservice[4].main
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\webservice[3].main
- <SYSTEM32>\vx0.nls
- <SYSTEM32>\netut80ex.vxd
- <SYSTEM32>\vx3.nls
- <SYSTEM32>\mac80ex.idf
- <SYSTEM32>\vx2.nls
- <SYSTEM32>\vx1x.nls
- %WINDIR%\zeta.exe
- <SYSTEM32>\vx1.nls
- <SYSTEM32>\vx2x.nls
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\webservice[2].main
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\webservice[2].main
- <SYSTEM32>\javex80.vxd
- <SYSTEM32>\t1309779158.dec
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\webservice[1].main
- %PROGRAM_FILES%\CashBack\logo.gif
- %PROGRAM_FILES%\BullsEye Network\adv.exe
- %PROGRAM_FILES%\BullsEye Network\adx.exe
- %PROGRAM_FILES%\BullsEye Network\bargains.exe
- %WINDIR%\adp8036_MARKETING14.exe
- %TEMP%\nsa4.tmp
- %PROGRAM_FILES%\BullsEye Network\msbe.dll
- <SYSTEM32>\msbe.dll
- %PROGRAM_FILES%\BullsEye Network\Uninstall.exe
- %PROGRAM_FILES%\BullsEye Network\bin\adx.exe
- %PROGRAM_FILES%\BullsEye Network\bin\bargains.exe
- %PROGRAM_FILES%\BullsEye Network\bin\adv.exe
- <SYSTEM32>\exclean.exe
- %WINDIR%\bbchk.exe
- <SYSTEM32>\exdl.exe
- %WINDIR%\exul.exe
- %TEMP%\nsi2.tmp
- %WINDIR%\exdl.exe
- <SYSTEM32>\mqexdlm.srg
- %WINDIR%\autoheal.exe
- %WINDIR%\exclean.exe
- <SYSTEM32>\bbchk.exe
- <SYSTEM32>\exul.exe
- <SYSTEM32>\javexulm.vxd
- %PROGRAM_FILES%\CashBack\template.html
- %PROGRAM_FILES%\CashBack\template2.html
- %PROGRAM_FILES%\CashBack\flash.exe
- %PROGRAM_FILES%\CashBack\cashback.exe
- %PROGRAM_FILES%\CashBack\cb.exe
- %PROGRAM_FILES%\CashBack\bb_click_wider.swf
- %PROGRAM_FILES%\CashBack\blank.gif
- %PROGRAM_FILES%\CashBack\icon.gif
- %PROGRAM_FILES%\CashBack\bb_welcome1.swf
- %PROGRAM_FILES%\CashBack\bb_auto_wider.swf
- %PROGRAM_FILES%\CashBack\bb_welcome.html
- %PROGRAM_FILES%\CashBack\mscb.dll
- %PROGRAM_FILES%\NaviSearch\nls.exe
- %PROGRAM_FILES%\NaviSearch\ad-nls.dat
- %PROGRAM_FILES%\NaviSearch\nvms.dll
- %WINDIR%\nls8037_MARKETING14.exe
- %TEMP%\nsj6.tmp
- %PROGRAM_FILES%\NaviSearch\bin\nls.exe
- %WINDIR%\cb8036_MARKETING14.exe
- %TEMP%\nsq8.tmp
- %PROGRAM_FILES%\NaviSearch\Uninstall.exe
- %PROGRAM_FILES%\NaviSearch\ad.dat
- <SYSTEM32>\nvms.dll
Удаляет следующие файлы:
- %WINDIR%\cb8036_MARKETING14.exe
- %WINDIR%\exdl.exe
- %PROGRAM_FILES%\CashBack\flash.exe
- %PROGRAM_FILES%\CashBack\cashback.exe
- %PROGRAM_FILES%\CashBack\cb.exe
- %PROGRAM_FILES%\NaviSearch\t1309779143.dec
- <SYSTEM32>\t1309779158.dec
- %WINDIR%\exclean.exe
- %WINDIR%\exul.exe
- %WINDIR%\bbchk.exe
- %PROGRAM_FILES%\BullsEye Network\adx.exe
- %WINDIR%\adp8036_MARKETING14.exe
- %PROGRAM_FILES%\BullsEye Network\adv.exe
- %PROGRAM_FILES%\BullsEye Network\msbe.dll
- %PROGRAM_FILES%\BullsEye Network\bargains.exe
- %WINDIR%\nls8037_MARKETING14.exe
- %PROGRAM_FILES%\CashBack\mscb.dll
- %PROGRAM_FILES%\NaviSearch\ad-nls.dat
- %PROGRAM_FILES%\NaviSearch\nvms.dll
- %PROGRAM_FILES%\NaviSearch\nls.exe
Сетевая активность:
Подключается к:
- 'www.na###earch.net':80
- 'localhost':1049
- 'ad#####r.outblaze.com':80
TCP:
Запросы HTTP GET:
- ad#####r.outblaze.com/scripts/adpopper/webservice.main?ve###############################################
- ad#####r.outblaze.com/scripts/adpopper/webservice.main?ve####################################################
- www.na###earch.net/redir/fc_install_redir.html
- ad#####r.outblaze.com/scripts/adpopper/webservice.main?ve###################################################
- ad#####r.outblaze.com/scripts/adpopper/webservice.main?ty##########
UDP:
- DNS ASK www.na###earch.net
- DNS ASK ad#####r.outblaze.com
Другое:
Ищет следующие окна:
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'ThunderRT6Main' WindowName: 'CashBack by BargainBuddy'
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'adp_wnd_class' WindowName: 'adp module'
- ClassName: 'adp_wnd_class' WindowName: 'adp'
- ClassName: 'cashback_wnd_class' WindowName: 'cashback module'
- ClassName: 'nls_wnd_class' WindowName: 'nls module'
