Техническая информация
Вредоносные функции:
Запускает на исполнение:
- '%TEMP%\nsb5.tmp\ytb_setup.exe' /S /ysc=cclean /ydc=cclean /yinstytff /ytc=defrag /ydontask /ybsini=%TEMP%\nsb5.tmp\BOOTST~1.INI
- '%ProgramFiles%\Yahoo!\Companion\Installs\cpn\ytbb.exe' /RegServer
- '%TEMP%\7ZipSfx.000\dfsetup120.exe' /S /NCRC
- '%TEMP%\ytb.exe' /S /ysc=cclean /ydc=cclean /yinstytff /ytc=defrag /ydontask
Регистрирует BHO:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}\NoExplorer']
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}']
Изменения в файловой системе:
Создает следующие файлы:
- %ProgramFiles%\Yahoo!\Companion\Data\dlg_flktipg.html
- %ProgramFiles%\Yahoo!\Companion\Data\dlg_flktip.html
- %ProgramFiles%\Yahoo!\Companion\Data\dlg_grptipg.html
- %ProgramFiles%\Yahoo!\Companion\Data\dlg_grptip.html
- %ProgramFiles%\Yahoo!\Companion\Data\dlg_fantipg.html
- %ProgramFiles%\Yahoo!\Companion\Data\dlg_fantip.html
- %ProgramFiles%\Yahoo!\Companion\Data\dlg_fintipg.html
- %ProgramFiles%\Yahoo!\Companion\Data\dlg_fintip.html
- %ProgramFiles%\Yahoo!\Companion\Data\dlg_map.html
- %ProgramFiles%\Yahoo!\Companion\Data\dlg_mailtip.html
- %ProgramFiles%\Yahoo!\Companion\Data\dlg_mlbtipg.html
- %ProgramFiles%\Yahoo!\Companion\Data\dlg_mlbtip.html
- %ProgramFiles%\Yahoo!\Companion\Data\dlg_loctipg.html
- %ProgramFiles%\Yahoo!\Companion\Data\dlg_loctip.html
- %ProgramFiles%\Yahoo!\Companion\Data\dlg_mailatip.html
- %ProgramFiles%\Yahoo!\Companion\Data\dlg_logtip.html
- %ProgramFiles%\Yahoo!\Companion\Data\dlg_ctb.html
- %ProgramFiles%\Yahoo!\Companion\Data\dlg_anstipg.html
- %ProgramFiles%\Yahoo!\Companion\Data\dlg_anstip.html
- %ProgramFiles%\Yahoo!\Companion\Data\dlg_atb.html
- %ProgramFiles%\Yahoo!\Companion\Data\dlg_as.html
- %ProgramFiles%\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
- %ProgramFiles%\Yahoo!\Companion\Installs\cpn\ytbb.exe
- %ProgramFiles%\Yahoo!\Companion\Installs\cpn\YMERemote.dll
- %ProgramFiles%\Yahoo!\Companion\Installs\cpn\YTNavAssist.dll
- %ProgramFiles%\Yahoo!\Companion\Data\dlg_clutipg.html
- %ProgramFiles%\Yahoo!\Companion\Data\dlg_clutip.html
- %ProgramFiles%\Yahoo!\Companion\Data\dlg_cotb.html
- %ProgramFiles%\Yahoo!\Companion\Data\dlg_cnf.html
- %ProgramFiles%\Yahoo!\Companion\Data\dlg_auttipg.html
- %ProgramFiles%\Yahoo!\Companion\Data\dlg_auttip.html
- %ProgramFiles%\Yahoo!\Companion\Data\dlg_catb.html
- %ProgramFiles%\Yahoo!\Companion\Data\dlg_bootip.html
- %ProgramFiles%\Yahoo!\Companion\Data\dlg_movtip.html
- %ProgramFiles%\Yahoo!\Companion\Data\dlg_weatipg.html
- %ProgramFiles%\Yahoo!\Companion\Data\dlg_weatip.html
- %ProgramFiles%\Yahoo!\Companion\Data\dlg_wp2.html
- %ProgramFiles%\Yahoo!\Companion\Data\dlg_wp.html
- %ProgramFiles%\Yahoo!\Companion\Data\dlg_tratip.html
- %ProgramFiles%\Yahoo!\Companion\Data\dlg_srchtip.html
- %ProgramFiles%\Yahoo!\Companion\Data\dlg_upg.html
- %ProgramFiles%\Yahoo!\Companion\Data\dlg_tratipg.html
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\appusage[1].htm
- %ProgramFiles%\Yahoo!\Common\unyt.exe
- %ProgramFiles%\Defraggler\uninst.exe
- %TEMP%\nsl7.tmp\nsf9.tmp.htm
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\_Y=[1]
- %TEMP%\nsl7.tmp\InetLoad.dll
- %ProgramFiles%\Yahoo!\Common\unyt_wrap.exe
- %TEMP%\nsl7.tmp\nsk8.tmp.htm
- %ProgramFiles%\Yahoo!\Companion\Data\dlg_shotipg.html
- %ProgramFiles%\Yahoo!\Companion\Data\dlg_nbatip.html
- %ProgramFiles%\Yahoo!\Companion\Data\dlg_mustipg.html
- %ProgramFiles%\Yahoo!\Companion\Data\dlg_newstip.html
- %ProgramFiles%\Yahoo!\Companion\Data\dlg_nbatipg.html
- %ProgramFiles%\Yahoo!\Companion\Data\dlg_msgratip.html
- %ProgramFiles%\Yahoo!\Companion\Data\dlg_movtipg.html
- %ProgramFiles%\Yahoo!\Companion\Data\dlg_mustip.html
- %ProgramFiles%\Yahoo!\Companion\Data\dlg_msgrtip.html
- %ProgramFiles%\Yahoo!\Companion\Data\dlg_opt.html
- %ProgramFiles%\Yahoo!\Companion\Data\dlg_nfltipg.html
- %ProgramFiles%\Yahoo!\Companion\Data\dlg_shotip.html
- %ProgramFiles%\Yahoo!\Companion\Data\dlg_pub.html
- %ProgramFiles%\Yahoo!\Companion\Data\dlg_newtip.html
- %ProgramFiles%\Yahoo!\Companion\Data\dlg_newstipg.html
- %ProgramFiles%\Yahoo!\Companion\Data\dlg_nfltip.html
- %ProgramFiles%\Yahoo!\Companion\Data\dlg_newtipg.html
- %ProgramFiles%\Defraggler\Lang\lang-1046.dll
- %ProgramFiles%\Defraggler\Lang\lang-1035.dll
- %ProgramFiles%\Defraggler\Lang\lang-1029.dll
- %ProgramFiles%\Defraggler\Lang\lang-1038.dll
- %ProgramFiles%\Defraggler\Lang\lang-1045.dll
- %ProgramFiles%\Defraggler\Lang\lang-1034.dll
- %ProgramFiles%\Defraggler\Lang\lang-1030.dll
- %ProgramFiles%\Defraggler\Lang\lang-1028.dll
- %ProgramFiles%\Defraggler\Lang\lang-1025.dll
- %ProgramFiles%\Defraggler\Lang\lang-1055.dll
- %ProgramFiles%\Defraggler\Lang\lang-1063.dll
- %ProgramFiles%\Defraggler\Lang\lang-1048.dll
- %ProgramFiles%\Defraggler\Lang\lang-1027.dll
- %ProgramFiles%\Defraggler\Lang\lang-2052.dll
- %ProgramFiles%\Defraggler\Lang\lang-1032.dll
- %ProgramFiles%\Defraggler\Lang\lang-1037.dll
- %ProgramFiles%\Defraggler\Lang\lang-1036.dll
- %ProgramFiles%\Defraggler\CheckUpdate.log
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\installcheck[1].aspx
- %ProgramFiles%\Defraggler\df.exe
- %ProgramFiles%\Defraggler\Defraggler.exe
- %TEMP%\nsm3.tmp\System.dll
- %TEMP%\7ZipSfx.000\dfsetup120.exe
- %TEMP%\nsm3.tmp\inetc.dll
- %TEMP%\nsm3.tmp\ioFileY.ini
- %ProgramFiles%\Defraggler\Lang\lang-1040.dll
- %ProgramFiles%\Defraggler\Lang\lang-1044.dll
- %ProgramFiles%\Defraggler\Lang\lang-1043.dll
- %ProgramFiles%\Defraggler\Lang\lang-2070.dll
- %ProgramFiles%\Defraggler\Lang\lang-1041.dll
- %ProgramFiles%\Defraggler\Lang\lang-1031.dll
- %ProgramFiles%\Defraggler\Lang\lang-1053.dll
- %ProgramFiles%\Defraggler\Lang\lang-1049.dll
- %ProgramFiles%\Defraggler\Lang\lang-1052.dll
- %ProgramFiles%\Yahoo!\Companion\Installs\cpn\yt.dll
- %TEMP%\nsl7.tmp\toolbar.bmp
- %ProgramFiles%\Yahoo!\Companion\Installs\cpn\YPUBC.dll
- %ProgramFiles%\Yahoo!\Companion\Installs\cpn\pubmod.dll
- %TEMP%\nsl7.tmp\welcome.unicode.ini
- %TEMP%\nsl7.tmp\System.dll
- %TEMP%\nsl7.tmp\privacy.unicode.ini
- %TEMP%\nsl7.tmp\finish.unicode.ini
- %ProgramFiles%\Yahoo!\Companion\Installs\cpn\YTAntiSpy.dll
- %ProgramFiles%\Yahoo!\Companion\Installs\cpn\inyt.exe.manifest
- %TEMP%\nsb5.tmp\nsisProcMgr_U.dll
- %ProgramFiles%\Yahoo!\Companion\Installs\cpn\YCAPlugin.dll
- %ProgramFiles%\Yahoo!\Companion\Installs\cpn\YTabBar.dll
- %ProgramFiles%\Yahoo!\Companion\Installs\cpn\YTMsgr.dll
- %ProgramFiles%\Yahoo!\Companion\Installs\cpn\inyt.exe
- %ProgramFiles%\Yahoo!\Companion\Installs\cpn\YTBM.dll
- %TEMP%\nsb5.tmp\ytb_setup.exe
- %ProgramFiles%\Defraggler\Lang\lang-1061.dll
- %ProgramFiles%\Defraggler\Lang\lang-1050.dll
- %ProgramFiles%\Defraggler\Lang\lang-1067.dll
- %ProgramFiles%\Defraggler\Lang\lang-1066.dll
- %ProgramFiles%\Defraggler\Lang\lang-5146.dll
- %ProgramFiles%\Defraggler\Lang\lang-1051.dll
- %ProgramFiles%\Defraggler\Lang\lang-1058.dll
- %ProgramFiles%\Defraggler\Lang\lang-1026.dll
- %HOMEPATH%\Start Menu\Programs\Defraggler\Uninstall Defraggler.lnk
- %HOMEPATH%\Start Menu\Programs\Defraggler\Defraggler Homepage.url
- %TEMP%\nsb5.tmp\bootstrap.ini
- %TEMP%\nsb5.tmp\System.dll
- %ProgramFiles%\Defraggler\Lang\lang-1079.dll
- %ProgramFiles%\Defraggler\Lang\lang-1065.dll
- %HOMEPATH%\Start Menu\Programs\Defraggler\Defraggler.lnk
- %HOMEPATH%\Desktop\Defraggler.lnk
Удаляет следующие файлы:
- %TEMP%\nsb5.tmp\System.dll
- %TEMP%\nsb5.tmp\ytb_setup.exe
- %TEMP%\nsb5.tmp\bootstrap.ini
- %TEMP%\nsb5.tmp\nsisProcMgr_U.dll
- %TEMP%\ytb.exe
- %TEMP%\nsm3.tmp\System.dll
- %TEMP%\7ZipSfx.000\dfsetup120.exe
- %TEMP%\nsm3.tmp\inetc.dll
- %TEMP%\nsm3.tmp\ioFileY.ini
- %TEMP%\nsl7.tmp\InetLoad.dll
- %TEMP%\nsl7.tmp\nsf9.tmp.htm
- %ProgramFiles%\Defraggler\CheckUpdate.log
- %TEMP%\nsl7.tmp\finish.unicode.ini
- %TEMP%\nsl7.tmp\nsk8.tmp.htm
- %TEMP%\nsl7.tmp\toolbar.bmp
- %TEMP%\nsl7.tmp\welcome.unicode.ini
- %TEMP%\nsl7.tmp\privacy.unicode.ini
- %TEMP%\nsl7.tmp\System.dll
Сетевая активность:
Подключается к:
- '67.##5.160.76':80
- 'se#####.piriform.com':80
TCP:
Запросы HTTP GET:
- http://pc####.#nternal.yahoo.com/p/s=97314528/lng=us/rand=2534872/_B=/_Y= via 67.##5.160.76
- http://se#####.piriform.com/installcheck.aspx?p=###################################
Запросы HTTP POST:
- http://in######rstats.yahoo.com/appusage.asp via 67.##5.160.76
UDP:
- DNS ASK in######rstats.yahoo.com
- DNS ASK pc####.#nternal.yahoo.com
- DNS ASK se#####.piriform.com
Другое:
Ищет следующие окна:
- ClassName: '#32770' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: '' WindowName: 'Piriform Defraggler'
- ClassName: '' WindowName: 'Defraggler'
