Adware.Downware.2146

Техническая информация

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\DllHost.exe' /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\ish1349689\images\Color_Button_Hover.png
%TEMP%\ish1349689\images\default_tb.png
%TEMP%\ish1349689\images\Close_Hover.png
%TEMP%\ish1349689\images\Color_Button.png
%TEMP%\ish1349689\images\default_wi.png
%TEMP%\ish1349689\images\Icon_Generic.png
%TEMP%\ish1349689\images\Loader.gif
%TEMP%\ish1349689\images\Grey_Button.png
%TEMP%\ish1349689\images\Grey_Button_Hover.png
%TEMP%\ish1349689\images\Close.png
%TEMP%\ish1349689\css\sdk-ui\images\button-bg.png
%TEMP%\ish1349689\css\sdk-ui\images\progress-bg-corner.png
%TEMP%\ish1349689\css\sdk-ui\button.css
%TEMP%\ish1349689\css\sdk-ui\checkbox.css
%TEMP%\ish1349689\css\sdk-ui\images\progress-bg.png
%TEMP%\ish1349689\csshover3.htc
%TEMP%\ish1349689\images\BG.png
%TEMP%\ish1349689\css\sdk-ui\images\progress-bg2.png
%TEMP%\ish1349689\css\sdk-ui\progress-bar.css
%TEMP%\0014B615.log
%TEMP%\ICReinstall_<Имя вируса>.exe
%TEMP%\ish1349689\locale\FR.locale
%TEMP%\ish1349689\bootstrap_18340.html
%HOMEPATH%\Desktop\Continue Telecharger et Installer Installation.lnk
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\real-player[1].jpg
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\YF7T7AK2\windows_logo_32_32[1].png
%TEMP%\0014B875.log
%TEMP%\ish1349689\locale\ES.locale
%TEMP%\ish1349689\images\ProgressBar.png
%TEMP%\ish1349689\images\Quick_Specs.png
%TEMP%\ish1349689\images\Pause_Button.png
%TEMP%\ish1349689\images\Progress.png
%TEMP%\ish1349689\images\Resume_Button.png
%TEMP%\ish1349689\locale\DE.locale
%TEMP%\ish1349689\locale\EN.locale
%TEMP%\ish1349689\images\secured.png
%TEMP%\ish1349689\images\sponsored.png
%TEMP%\ish1349689\css\sdk-ui\browse.css
%TEMP%\ish1348191\images\BG.png
%TEMP%\ish1348191\images\Close.png
%TEMP%\ish1348191\css\sdk-ui\progress-bar.css
%TEMP%\ish1348191\csshover3.htc
%TEMP%\ish1348191\images\Close_Hover.png
%TEMP%\ish1348191\images\default_tb.png
%TEMP%\ish1348191\images\default_wi.png
%TEMP%\ish1348191\images\Color_Button.png
%TEMP%\ish1348191\images\Color_Button_Hover.png
%TEMP%\ish1348191\css\sdk-ui\images\progress-bg2.png
%TEMP%\ish1348191\css\main.css
%TEMP%\ish1348191\css\sdk-ui\browse.css
%TEMP%\0014925F.log
%TEMP%\ish1348191\css\ie6_main.css
%TEMP%\ish1348191\css\sdk-ui\button.css
%TEMP%\ish1348191\css\sdk-ui\images\progress-bg-corner.png
%TEMP%\ish1348191\css\sdk-ui\images\progress-bg.png
%TEMP%\ish1348191\css\sdk-ui\checkbox.css
%TEMP%\ish1348191\css\sdk-ui\images\button-bg.png
%TEMP%\ish1348191\locale\EN.locale
%TEMP%\ish1348191\locale\ES.locale
%TEMP%\ish1348191\images\sponsored.png
%TEMP%\ish1348191\locale\DE.locale
%TEMP%\ish1348191\locale\FR.locale
%TEMP%\ish1349689\css\ie6_main.css
%TEMP%\ish1349689\css\main.css
%TEMP%\00149694.log
%TEMP%\0014978D.log
%TEMP%\ish1348191\images\secured.png
%TEMP%\ish1348191\images\Icon_Generic.png
%TEMP%\ish1348191\images\Loader.gif
%TEMP%\ish1348191\images\Grey_Button.png
%TEMP%\ish1348191\images\Grey_Button_Hover.png
%TEMP%\ish1348191\images\Pause_Button.png
%TEMP%\ish1348191\images\Quick_Specs.png
%TEMP%\ish1348191\images\Resume_Button.png
%TEMP%\ish1348191\images\Progress.png
%TEMP%\ish1348191\images\ProgressBar.png