Техническая информация
Вредоносные функции:
Создает и запускает на исполнение:
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\TbHelper2.exe -Embedding -RegServer
- %ALLUSERSPROFILE%\Application Data\WidgetServer\WidgetServ.exe -regserver system
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\setup_widget_serv.exe /id={1BB22D38-A411-4B13-A746-C2A4F4EC7344} /mode=system
Запускает на исполнение:
- <SYSTEM32>\regsvr32.exe /s "%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\TbCommonUtils.dll"
- <SYSTEM32>\regsvr32.exe /s "%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\tbcore3.dll"
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\fb_22.png
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\fb_11.png
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\fb_00.png
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\fb_33.png
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\fb_events.png
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\fb_55.png
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\fb_44.png
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\facebook_oauth.html
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\facebook.png
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\DynamicMenuConfig-32-Assorted-634332933718100000.gif
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\DynamicMenuConfig-29-Assorted-634332942087787500.gif
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\facebook_cmd.js
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\facebook_logout.js
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\facebook_frame.html
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\facebook_ex_oauth.js
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\fb_friends.png
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\highlighter.png
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\head-logo.png
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\games.png
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\html.png
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\info.txt
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\image.png
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\icons.bmp
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\fb_notes.png
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\fb_loader.gif
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\fb_index.html
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\fb_groups.png
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\fb_menuscript.js
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\fb_news.png
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\fb_messages.png
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\fb_menustyle.css
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\DynamicMenuConfig-28-Assorted-634332935629975000.gif
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\633773901302025000.gif
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\633647037138212500.gif
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\633576113266550000.gif
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\633801340473856250.gif
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\alert_plugin.js
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\634050554397183750.png
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\633936233259281250.gif
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\633377522185887500.gif
- %TEMP%\nso2.tmp\inetc.dll
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\your_logo.png
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\ws_30.png
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\statistics[1]
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\633311923915725000.gif
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\16 Arrow-Down.png
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\-1704670046.gif
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\alert_template.htm
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\Downloadve.png
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\download.png
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\documentsearch.png
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\DynamicMenuConfig-0-Nature-634332948606381250.gif
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\DynamicMenuConfig-25-Assorted-634332936749818750.gif
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\DynamicMenuConfig-14-Media-634332948606850000.gif
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\DynamicMenuConfig-1-Nature-634332948606537500.gif
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\computer_delete.png
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\basis.xml
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\arrow_refresh.png
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\alert_widget.js
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\bg.gif
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\cog.png
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\close.gif
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\clock.png
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\inst.tmp
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\twitter.png
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\twitter-sprite-icons.png
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\theegg.gif
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\twitter_cmd.js
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\twitter_frame.html
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\twitter_ex_oauthsimple.js
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\twitter_ex_oauth.js
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\tbs_include_script_022747.js
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\TbHelper2.exe
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\sha1.js
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\setup_widget_serv.exe
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\tbs_include_script_001217.js
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\tbs_include_script_016974.js
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\tbs_include_script_014761.js
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\tbs_include_script_008195.js
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\twitter_logout.js
- %ALLUSERSPROFILE%\Application Data\WidgetServer\WidgetServ.exe
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\your_logo.png
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\ws_30.png
- %ALLUSERSPROFILE%\Application Data\WidgetServer\uninst.exe
- %TEMP%\nso2.tmp\System.dll
- %TEMP%\nst5.tmp\AccessControl.dll
- %ALLUSERSPROFILE%\Application Data\WidgetServer\users.ini
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\volume.gif
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\uninstall.exe
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\twitter_popup.html
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\twitter_oauth.html
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\uninstaller.exe
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\video.png
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\version.txt
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\update.exe
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\settings.gif
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\mipony barra 25.bmp
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\minimize.gif
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\lt.gif
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\mipony16.png
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\oauth.js
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\NotesRed.png
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\news.png
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\logo.png
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\jquery-ui-1.8.13.custom.css
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\jquery-1.5.1.min.js
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\jquery-1.3.2.min.js
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\jquery-ui-1.8.13.custom.min.js
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\lb.gif
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\kart.gif
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\jquery.json-2.2.min.js
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\onclose.gif
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\radio_prev.png
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\radio_next.png
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\radio_02.png
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\rb.gif
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\rt.gif
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\remote_en.xml
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\rb_res.gif
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\radio_01.png
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\onsettings.gif
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\onontop.gif
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\onminimize.gif
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\ontop.gif
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\polarity.gif
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\PlayerPlug.cfg
- %APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\pixel.gif
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\fb_11.png
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\fb_00.png
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\facebook_oauth.html
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\fb_22.png
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\fb_55.png
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\fb_44.png
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\fb_33.png
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\facebook_logout.js
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\DynamicMenuConfig-32-Assorted-634332933718100000.gif
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\DynamicMenuConfig-29-Assorted-634332942087787500.gif
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\DynamicMenuConfig-28-Assorted-634332935629975000.gif
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\facebook.png
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\facebook_frame.html
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\facebook_ex_oauth.js
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\facebook_cmd.js
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\fb_events.png
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\head-logo.png
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\games.png
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\fb_notes.png
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\highlighter.png
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\image.png
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\icons.bmp
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\html.png
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\fb_news.png
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\fb_index.html
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\fb_groups.png
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\fb_friends.png
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\fb_loader.gif
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\fb_messages.png
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\fb_menustyle.css
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\fb_menuscript.js
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\DynamicMenuConfig-25-Assorted-634332936749818750.gif
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\633647037138212500.gif
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\633576113266550000.gif
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\633377522185887500.gif
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\633773901302025000.gif
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\634050554397183750.png
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\633936233259281250.gif
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\633801340473856250.gif
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\633311923915725000.gif
- %TEMP%\nso2.tmp\UserInfo.dll
- %TEMP%\nso2.tmp\Processes.dll
- %TEMP%\nso2.tmp\UAC.dll
- %TEMP%\mipony-plugin-2-remote.cab
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\16 Arrow-Down.png
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\-1704670046.gif
- %TEMP%\nso2.tmp\CabDLL.dll
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\alert_plugin.js
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\download.png
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\documentsearch.png
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\computer_delete.png
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\Downloadve.png
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\DynamicMenuConfig-14-Media-634332948606850000.gif
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\DynamicMenuConfig-1-Nature-634332948606537500.gif
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\DynamicMenuConfig-0-Nature-634332948606381250.gif
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\cog.png
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\arrow_refresh.png
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\alert_widget.js
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\alert_template.htm
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\basis.xml
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\close.gif
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\clock.png
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\bg.gif
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\info.txt
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\tbs_include_script_008195.js
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\tbs_include_script_001217.js
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\TbHelper2.exe
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\tbs_include_script_014761.js
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\theegg.gif
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\tbs_include_script_022747.js
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\tbs_include_script_016974.js
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\tbhelper.dll
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\setup_widget_serv.exe
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\settings.gif
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\rt.gif
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\sha1.js
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\tbcore3.dll
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\TbCommonUtils.dll
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\stations.dll
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\twitter-sprite-icons.png
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\update.exe
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\uninstaller.exe
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\uninstall.exe
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\version.txt
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\Widget.dll
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\volume.gif
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\video.png
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\twitter_popup.html
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\twitter_ex_oauth.js
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\twitter_cmd.js
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\twitter.png
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\twitter_ex_oauthsimple.js
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\twitter_oauth.html
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\twitter_logout.js
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\twitter_frame.html
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\remote_en.xml
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\minimize.gif
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\lt.gif
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\logo.png
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\mipony barra 25.bmp
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\news.png
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\mipony16.png
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\mipony-plugin-2-remote.dll
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\lb.gif
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\jquery-1.5.1.min.js
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\jquery-1.3.2.min.js
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\inst.tmp
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\jquery-ui-1.8.13.custom.css
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\kart.gif
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\jquery.json-2.2.min.js
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\jquery-ui-1.8.13.custom.min.js
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\NotesRed.png
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\radio_02.png
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\radio_01.png
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\polarity.gif
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\radio_next.png
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\rb_res.gif
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\rb.gif
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\radio_prev.png
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\PlayerPlug.cfg
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\onminimize.gif
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\onclose.gif
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\oauth.js
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\onontop.gif
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\pixel.gif
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\ontop.gif
- %PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\onsettings.gif
Удаляет следующие файлы:
- %TEMP%\nso2.tmp\System.dll
- %TEMP%\nso2.tmp\UAC.dll
- %TEMP%\nso2.tmp\UserInfo.dll
- %TEMP%\nso2.tmp\Processes.dll
- %TEMP%\nst5.tmp\AccessControl.dll
- %TEMP%\nso2.tmp\CabDLL.dll
- %TEMP%\nso2.tmp\inetc.dll
Сетевая активность:
Подключается к:
- 'to####rserver.com':80
TCP:
Запросы HTTP GET:
- to####rserver.com/statistics/?tb######################################################################################
UDP:
- DNS ASK to####rserver.com
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'SysListView32' WindowName: ''
- ClassName: '#32770' WindowName: ''
