Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'swg' = '"%PROGRAM_FILES%\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'swg' = '%PROGRAM_FILES%\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe'
Вредоносные функции:
Создает и запускает на исполнение:
- %PROGRAM_FILES%\Google\Common\Google Updater\GoogleUpdaterService.exe /install /appid=swg
- %PROGRAM_FILES%\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe /RegServer "/dll=%PROGRAM_FILES%\Google\GoogleToolbarNotifier\5.5.5126.1836\gtn.dll"
- %PROGRAM_FILES%\Google\Common\Google Updater\GoogleUpdaterService.exe
- %PROGRAM_FILES%\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe -Embedding
- %PROGRAM_FILES%\Google\Google Toolbar\Component\SearchWithGoogleUpdate_6805C127AD7DF030.exe ietb GGLL
- %PROGRAM_FILES%\Google\Google Toolbar\Component\GoogleToolbarManager_BC0E306DC7DB1112.exe /install /sid:S-1-5-21-2052111302-484763869-725345543-1003 /e:asknot /expon:HTOL /l:zh-CN /d:set /h:asknot /p:asknot /r:GGLL /installwindow:65756
- %TEMP%\googletoolbarinstaller.exe
- %PROGRAM_FILES%\Google\Common\Google Updater\GoogleUpdaterService.exe /Service
- %PROGRAM_FILES%\Google\Google Toolbar\Component\GoogleUpdaterService_5898FABCFA121C11.exe /install /appid=tbie
Запускает на исполнение:
- <SYSTEM32>\msiexec.exe /V
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\79841F8EF00FBA86D33CC5A47696F165
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\79841F8EF00FBA86D33CC5A47696F165
- %TEMP%\GoogleToolbarInstaller1.log
- %PROGRAM_FILES%\Google\Google Toolbar\GoogleToolbarUser_32.exe
- %PROGRAM_FILES%\Google\Google Toolbar\GoogleToolbar_32.dll
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\303572DF538EDD8B1D606185F1D559B8
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\wpad[1].dat
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\wpad[1].dat
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\0797C381B2F87EB5A1D5573BD15BA4F4
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\303572DF538EDD8B1D606185F1D559B8
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\0797C381B2F87EB5A1D5573BD15BA4F4
- %PROGRAM_FILES%\Google\Google Toolbar\GoogleToolbarHelper_signed.msi
- %PROGRAM_FILES%\Google\GoogleToolbarNotifier\5.5.5126.1836\gtn.dll
- %PROGRAM_FILES%\Google\GoogleToolbarNotifier\5.5.5126.1836\swg.dll
- %PROGRAM_FILES%\Google\GoogleToolbarNotifier\5.5.5126.1836\gth.dll
- %PROGRAM_FILES%\Google\GoogleToolbarNotifier\5.5.5126.1836\Readme.url
- %PROGRAM_FILES%\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
- %PROGRAM_FILES%\Google\Common\Google Updater\GoogleUpdaterService.exe
- %WINDIR%\Installer\22551.msi
- %PROGRAM_FILES%\Google\Google Toolbar\GoogleToolbarHelperPatch_signed.msp
- C:\Config.Msi\22554.rbs
- %WINDIR%\Installer\MSI6.tmp
- %PROGRAM_FILES%\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89C30F0F8BD011D2.dll
- %PROGRAM_FILES%\Google\Google Toolbar\Component\GoogleToolbarDynamic_32_A36FE5F33EB728AE.dll
- %PROGRAM_FILES%\Google\Google Toolbar\Component\GoogleToolbarManager_BC0E306DC7DB1112.exe
- %PROGRAM_FILES%\Google\Google Toolbar\Component\GoogleUpdaterService_5898FABCFA121C11.exe
- %PROGRAM_FILES%\Google\Google Toolbar\Component\GoogleToolbarUser_32_2FE1ACAB9D6C4698.exe
- %PROGRAM_FILES%\Google\Google Toolbar\Component\GoogleToolbar_32_3316CAE4A88EB2A9.dll
- %TEMP%\nsq2.tmp\System.dll
- %TEMP%\googletoolbarinstaller.exe
- %TEMP%\GoogleToolbarInstaller2.log
- %PROGRAM_FILES%\Google\Google Toolbar\Component\GoogleToolbar.6.6.729.120.manifest.xml
- %TEMP%\nsq2.tmp\inetc.dll
- %PROGRAM_FILES%\Google\Google Toolbar\Component\SearchWithGoogleUpdate_6805C127AD7DF030.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\GoogleToolbarDynamic_ext_zh-CN_32_E1F35357A8A033CC[1]
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\GoogleToolbarDynamic_ext_zh-CN_32_E1F35357A8A033CC.dll[1].lz
- %PROGRAM_FILES%\Google\Google Toolbar\Component\cmp5.tmp
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\60E31627FDA0A46932B0E5948949F2A5
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\60E31627FDA0A46932B0E5948949F2A5
- %PROGRAM_FILES%\Google\Google Toolbar\Component\cmp4.tmp
- %TEMP%\nsq2.tmp\configuration.ini
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\9[1].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\GoogleToolbarDynamic_ext_zh-CN_32_E1F35357A8A033CC.dll[1].lz
- %TEMP%\Google Toolbar\gt3.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\GoogleToolbarDynamic_ext_zh-CN_32_E1F35357A8A033CC[1].dll
Удаляет следующие файлы:
- C:\Config.Msi\22554.rbs
- %WINDIR%\Installer\MSI6.tmp
- %TEMP%\nsq2.tmp\System.dll
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\wpad[1].dat
- %WINDIR%\Installer\22553.ipi
- %WINDIR%\Installer\22551.msi
- %TEMP%\Google Toolbar\gt3.tmp
- %PROGRAM_FILES%\Google\Google Toolbar\Component\cmp5.tmp
- %PROGRAM_FILES%\Google\Google Toolbar\Component\cmp4.tmp
- %TEMP%\nsq2.tmp\inetc.dll
- %TEMP%\nsq2.tmp\configuration.ini
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\wpad[1].dat
Сетевая активность:
Подключается к:
- 'wp#d':80
- 'crl.verisign.com':80
- 'cs#######-2-crl.verisign.com':80
- 'www.pp##.com':80
- 'localhost':1037
- '74.##5.232.51':80
TCP:
Запросы HTTP GET:
- cs#######-2-crl.verisign.com/CSC3-2009-2.crl
- crl.verisign.com/pca3.crl
- crl.verisign.com/ThawteTimestampingCA.crl
- 74.##5.232.51/tools/swg2/update?ty############################################################################################################################################################################
- crl.verisign.com/tss-ca.crl
- wp#d/wpad.dat
- 74.##5.232.51/edgedl/toolbar/components/GoogleToolbarDynamic_ext_zh-CN_32_E1F35357A8A033CC.dll.lz
- www.pp##.com/9.php?sa###
- 74.##5.232.51/edgedl/toolbar/components/GoogleToolbarDynamic_ext_zh-CN_32_E1F35357A8A033CC.dll
- 74.##5.232.51/edgedl/toolbar/components/GoogleToolbarDynamic_ext_zh-CN_32_E1F35357A8A033CC.dll?zx######
- 74.##5.232.51/edgedl/toolbar/components/GoogleToolbarDynamic_ext_zh-CN_32_E1F35357A8A033CC.dll.lz?zx######
UDP:
- DNS ASK crl.verisign.com
- DNS ASK cs#######-2-crl.verisign.com
- DNS ASK cl####s1.google.com
- DNS ASK wp#d
- DNS ASK www.pp##.com
- DNS ASK www.pp##.net
- DNS ASK ca###.#ack.google.com
Другое:
Ищет следующие окна:
- ClassName: '{A7E495BF-9589-4a6e-8479-DDA2D8D3C05F}' WindowName: ''
- ClassName: 'Indicator' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
