Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Classes\MSProgramGroup\Shell\Open\Command] '' = '<SYSTEM32>\grpconv.exe %1'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'GrpConv' = 'grpconv -o'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\IDMTDI] 'ImagePath' = 'system32\DRIVERS\idmtdi.sys'
- [<HKLM>\SYSTEM\ControlSet001\Services\IDMTDI] 'Start' = '00000001'
Вредоносные функции:
Завершает или пытается завершить
следующие системные процессы:
- <SYSTEM32>\cmd.exe
Изменения в файловой системе:
Создает следующие файлы:
- %ProgramFiles%\Internet Download Manager\Languages\inst_cz.lng
- %ProgramFiles%\Internet Download Manager\Languages\inst_cht.lng
- %ProgramFiles%\Internet Download Manager\Languages\inst_de.lng
- %ProgramFiles%\Internet Download Manager\Languages\inst_es.lng
- %ProgramFiles%\Internet Download Manager\Languages\inst_dk.lng
- %ProgramFiles%\Internet Download Manager\Languages\inst_al.lng
- %ProgramFiles%\Internet Download Manager\Languages\idm_ua.lng
- %ProgramFiles%\Internet Download Manager\Languages\inst_ar.lng
- %ProgramFiles%\Internet Download Manager\Languages\inst_chn.lng
- %ProgramFiles%\Internet Download Manager\Languages\inst_bg.lng
- %ProgramFiles%\Internet Download Manager\Languages\inst_fa.lng
- %ProgramFiles%\Internet Download Manager\Languages\inst_kr.lng
- %ProgramFiles%\Internet Download Manager\Languages\inst_iw.lng
- %ProgramFiles%\Internet Download Manager\Languages\inst_my.lng
- %ProgramFiles%\Internet Download Manager\Languages\inst_pt.lng
- %ProgramFiles%\Internet Download Manager\Languages\inst_pl.lng
- %ProgramFiles%\Internet Download Manager\Languages\inst_gr.lng
- %ProgramFiles%\Internet Download Manager\Languages\inst_fr.lng
- %ProgramFiles%\Internet Download Manager\Languages\inst_hu.lng
- %ProgramFiles%\Internet Download Manager\Languages\inst_it.lng
- %ProgramFiles%\Internet Download Manager\Languages\inst_id.lng
- %ProgramFiles%\Internet Download Manager\IDMEdgeExt\images\logoTonec.gif
- %ProgramFiles%\Internet Download Manager\IDMEdgeExt\images\logoSmall.png
- %ProgramFiles%\Internet Download Manager\Languages\grabber_ru.chm
- %ProgramFiles%\Internet Download Manager\Languages\idm_de.lng
- %ProgramFiles%\Internet Download Manager\Languages\idm_ar.lng
- %ProgramFiles%\Internet Download Manager\IDMEdgeExt\images\dwnlLink.png
- %ProgramFiles%\Internet Download Manager\IDMEdgeExt\_metadata\verified_contents.json
- %ProgramFiles%\Internet Download Manager\IDMEdgeExt\images\headBkgd.gif
- %ProgramFiles%\Internet Download Manager\IDMEdgeExt\images\logoBig.png
- %ProgramFiles%\Internet Download Manager\IDMEdgeExt\images\headTitle.gif
- %ProgramFiles%\Internet Download Manager\Languages\idm_es.lng
- %ProgramFiles%\Internet Download Manager\Languages\idm_ru.chm
- %ProgramFiles%\Internet Download Manager\Languages\idm_ptbr.lng
- %ProgramFiles%\Internet Download Manager\Languages\idm_ru.lng
- %ProgramFiles%\Internet Download Manager\Languages\idm_tr.lng
- %ProgramFiles%\Internet Download Manager\Languages\idm_th.lng
- %ProgramFiles%\Internet Download Manager\Languages\idm_fr.lng
- %ProgramFiles%\Internet Download Manager\Languages\idm_fa.lng
- %ProgramFiles%\Internet Download Manager\Languages\idm_it.lng
- %ProgramFiles%\Internet Download Manager\Languages\idm_pl.lng
- %ProgramFiles%\Internet Download Manager\Languages\idm_nl.lng
- %ProgramFiles%\Internet Download Manager\Toolbar\3d_largeHot_3_hdpi15.bmp
- %ProgramFiles%\Internet Download Manager\Toolbar\3d_largeHot_3.bmp
- %ProgramFiles%\Internet Download Manager\Toolbar\3d_large_3.bmp
- %ProgramFiles%\Internet Download Manager\Toolbar\3d_smallHot_3.bmp
- %ProgramFiles%\Internet Download Manager\Toolbar\3d_large_3_hdpi15.bmp
- %ProgramFiles%\Internet Download Manager\Languages\tips_th.txt
- %ProgramFiles%\Internet Download Manager\Languages\tips_ru.txt
- %ProgramFiles%\Internet Download Manager\Languages\tips_tr.txt
- %ProgramFiles%\Internet Download Manager\Languages\tut_ru.chm
- %ProgramFiles%\Internet Download Manager\Languages\tips_ua.txt
- %ProgramFiles%\Internet Download Manager\Toolbar\3d_small_3.bmp
- %TEMP%\Cab10.tmp
- %TEMP%\CabE.tmp
- %WINDIR%\inf\oem3.inf
- <DRIVERS>\SET12.tmp
- %WINDIR%\inf\oem3.PNF
- %ProgramFiles%\Internet Download Manager\Uninstall-ME.exe
- %ProgramFiles%\Internet Download Manager\Toolbar\3d_style_3.tbi
- %TEMP%\Cab8.tmp
- %TEMP%\CabC.tmp
- %TEMP%\CabA.tmp
- %ProgramFiles%\Internet Download Manager\Languages\inst_ua.lng
- %ProgramFiles%\Internet Download Manager\Languages\inst_tr.lng
- %ProgramFiles%\Internet Download Manager\Languages\inst_uz.lng
- %ProgramFiles%\Internet Download Manager\Languages\scheduler_ru.chm
- %ProgramFiles%\Internet Download Manager\Languages\inst_vn.lng
- %ProgramFiles%\Internet Download Manager\Languages\inst_ru.lng
- %ProgramFiles%\Internet Download Manager\Languages\inst_ptbr.lng
- %ProgramFiles%\Internet Download Manager\Languages\inst_sk.lng
- %ProgramFiles%\Internet Download Manager\Languages\inst_th.lng
- %ProgramFiles%\Internet Download Manager\Languages\inst_src.lng
- %ProgramFiles%\Internet Download Manager\Languages\template.lng
- %ProgramFiles%\Internet Download Manager\Languages\tips_it.txt
- %ProgramFiles%\Internet Download Manager\Languages\tips_fr.txt
- %ProgramFiles%\Internet Download Manager\Languages\tips_nl.txt
- %ProgramFiles%\Internet Download Manager\Languages\tips_ptbr.txt
- %ProgramFiles%\Internet Download Manager\Languages\tips_pl.txt
- %ProgramFiles%\Internet Download Manager\Languages\tips_ar.txt
- %ProgramFiles%\Internet Download Manager\Languages\template_inst.lng
- %ProgramFiles%\Internet Download Manager\Languages\tips_de.txt
- %ProgramFiles%\Internet Download Manager\Languages\tips_fa.txt
- %ProgramFiles%\Internet Download Manager\Languages\tips_es.txt
- %ProgramFiles%\Internet Download Manager\downlWithIDM.dll
- %ProgramFiles%\Internet Download Manager\defexclist.txt
- %ProgramFiles%\Internet Download Manager\downlWithIDM64.dll
- %ProgramFiles%\Internet Download Manager\idmBroker.exe
- %ProgramFiles%\Internet Download Manager\grabber.chm
- %ProgramFiles%\Internet Download Manager\IEGetVL2.htm
- %ProgramFiles%\Internet Download Manager\IEGetVL.htm
- %ProgramFiles%\Internet Download Manager\IEMonitor.exe
- %ProgramFiles%\Internet Download Manager\Uninstall.exe
- %ProgramFiles%\Internet Download Manager\MediumILStart.exe
- %ProgramFiles%\Internet Download Manager\idman.chm
- %ProgramFiles%\Internet Download Manager\idmftype.dll
- %ProgramFiles%\Internet Download Manager\idmfsa.dll
- %ProgramFiles%\Internet Download Manager\idmindex.dll
- %ProgramFiles%\Internet Download Manager\idmmzcc.xpi
- %ProgramFiles%\Internet Download Manager\idmmkb.dll
- %ProgramFiles%\Internet Download Manager\idmbrbtn.dll
- %ProgramFiles%\Internet Download Manager\idmantypeinfo.tlb
- %ProgramFiles%\Internet Download Manager\idmbrbtn64.dll
- %ProgramFiles%\Internet Download Manager\idmcchandler7_64.dll
- %ProgramFiles%\Internet Download Manager\idmcchandler7.dll
- %ProgramFiles%\Internet Download Manager\IDMFType64.dll
- %ProgramFiles%\Internet Download Manager\IDMFType.dat
- %ProgramFiles%\Internet Download Manager\IDMGCExt.crx
- %ProgramFiles%\Internet Download Manager\IDMGetAll64.dll
- %ProgramFiles%\Internet Download Manager\IDMGetAll.dll
- %TEMP%\aut1.tmp
- %TEMP%\icon.ico
- %CommonProgramFiles%\System\IDMs.exe
- %ProgramFiles%\Internet Download Manager\Cleanup.cmd
- %TEMP%\nsu3.tmp
- %ProgramFiles%\Internet Download Manager\IDMGrHlp.exe
- %ProgramFiles%\Internet Download Manager\IDMShellExt64.dll
- %ProgramFiles%\Internet Download Manager\IDMShellExt.dll
- %ProgramFiles%\Internet Download Manager\IDMan.exe
- %ProgramFiles%\Internet Download Manager\IEGetAll.htm
- %ProgramFiles%\Internet Download Manager\IEExt.htm
- %ProgramFiles%\Internet Download Manager\IDMIECC64.dll
- %ProgramFiles%\Internet Download Manager\IDMIECC.dll
- %ProgramFiles%\Internet Download Manager\IDMIntegrator64.exe
- %ProgramFiles%\Internet Download Manager\IDMNetMon64.dll
- %ProgramFiles%\Internet Download Manager\IDMNetMon.dll
- %ProgramFiles%\Internet Download Manager\IDMEdgeExt\_locales\es\messages.json
- %ProgramFiles%\Internet Download Manager\IDMEdgeExt\_locales\en\messages.json
- %ProgramFiles%\Internet Download Manager\IDMEdgeExt\_locales\fa\messages.json
- %ProgramFiles%\Internet Download Manager\IDMEdgeExt\_locales\he\messages.json
- %ProgramFiles%\Internet Download Manager\IDMEdgeExt\_locales\fr\messages.json
- %ProgramFiles%\Internet Download Manager\IDMEdgeExt\welcome.html
- %ProgramFiles%\Internet Download Manager\IDMEdgeExt\manifest.json
- %ProgramFiles%\Internet Download Manager\IDMEdgeExt\welcome.js
- %ProgramFiles%\Internet Download Manager\IDMEdgeExt\_locales\de\messages.json
- %ProgramFiles%\Internet Download Manager\IDMEdgeExt\_locales\ar\messages.json
- %ProgramFiles%\Internet Download Manager\IDMEdgeExt\_locales\it\messages.json
- %ProgramFiles%\Internet Download Manager\IDMEdgeExt\_locales\vn\messages.json
- %ProgramFiles%\Internet Download Manager\IDMEdgeExt\_locales\tr\messages.json
- %ProgramFiles%\Internet Download Manager\IDMEdgeExt\_locales\zh_cn\messages.json
- %ProgramFiles%\Internet Download Manager\IDMEdgeExt\_metadata\computed_hashes.json
- %ProgramFiles%\Internet Download Manager\IDMEdgeExt\_locales\zh_tw\messages.json
- %ProgramFiles%\Internet Download Manager\IDMEdgeExt\_locales\pl\messages.json
- %ProgramFiles%\Internet Download Manager\IDMEdgeExt\_locales\nl\messages.json
- %ProgramFiles%\Internet Download Manager\IDMEdgeExt\_locales\pt\messages.json
- %ProgramFiles%\Internet Download Manager\IDMEdgeExt\_locales\th\messages.json
- %ProgramFiles%\Internet Download Manager\IDMEdgeExt\_locales\ru\messages.json
- %ProgramFiles%\Internet Download Manager\idmtdi32.sys
- %ProgramFiles%\Internet Download Manager\idmtdi.inf
- %ProgramFiles%\Internet Download Manager\idmtdi64.sys
- %ProgramFiles%\Internet Download Manager\idmvs.dll
- %ProgramFiles%\Internet Download Manager\idmvconv.dll
- %ProgramFiles%\Internet Download Manager\idmmzcc3.xpi
- %ProgramFiles%\Internet Download Manager\idmmzcc2.xpi
- %ProgramFiles%\Internet Download Manager\idmmzcc7.dll
- %ProgramFiles%\Internet Download Manager\idmtdi.cat
- %ProgramFiles%\Internet Download Manager\idmmzcc7_64.dll
- %ProgramFiles%\Internet Download Manager\idmwfp.cat
- %ProgramFiles%\Internet Download Manager\IDMEdgeExt\background.js
- %ProgramFiles%\Internet Download Manager\tutor.chm
- %ProgramFiles%\Internet Download Manager\IDMEdgeExt\captured.html
- %ProgramFiles%\Internet Download Manager\IDMEdgeExt\document.js
- %ProgramFiles%\Internet Download Manager\IDMEdgeExt\content.js
- %ProgramFiles%\Internet Download Manager\idmwfp32.sys
- %ProgramFiles%\Internet Download Manager\idmwfp.inf
- %ProgramFiles%\Internet Download Manager\idmwfp64.sys
- %ProgramFiles%\Internet Download Manager\tips.txt
- %ProgramFiles%\Internet Download Manager\scheduler.chm
Удаляет следующие файлы:
- %TEMP%\CabC.tmp
- %TEMP%\CabE.tmp
- %TEMP%\Cab10.tmp
- %TEMP%\CabA.tmp
- %TEMP%\icon.ico
- %TEMP%\aut1.tmp
- %TEMP%\Cab8.tmp
Перемещает следующие файлы:
- <DRIVERS>\SET12.tmp в <DRIVERS>\idmtdi.sys
Сетевая активность:
Подключается к:
- 'www.download.windowsupdate.com':80
- 'wp#d':80
TCP:
Запросы HTTP GET:
- http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
- http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt
- http://11#.#11.111.1/wpad.dat via wp#d
UDP:
- DNS ASK www.download.windowsupdate.com
- DNS ASK wp#d
Другое:
Создает и запускает на исполнение:
- '%ProgramFiles%\Internet Download Manager\Uninstall.exe' -instdriv
- '%TEMP%\nsp4.tmp\ns5.tmp' "%ProgramFiles%\Internet Download Manager\Uninstall.exe" -instdriv
- '%CommonProgramFiles%\System\IDMs.exe' /S /EN /ND
Запускает на исполнение:
- '<SYSTEM32>\net.exe' start IDMTDI
- '<SYSTEM32>\net1.exe' start IDMTDI
- '<SYSTEM32>\grpconv.exe' -o
- '<SYSTEM32>\rundll32.exe' SETUPAPI.DLL,InstallHinfSection DefaultInstall 128 %ProgramFiles%\Internet Download Manager\idmtdi.inf
- '<SYSTEM32>\runonce.exe' -r
