Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'wextract_cleanup0' = 'rundll32.exe <SYSTEM32>\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"'
Изменения в файловой системе:
Создает следующие файлы:
- C:\fd4fb59b64fbbdb846e71c8988b3\iedkcs32.dll.mui
- C:\fd4fb59b64fbbdb846e71c8988b3\ieakui.dll.mui
- C:\fd4fb59b64fbbdb846e71c8988b3\ieframe.dll.mui
- C:\fd4fb59b64fbbdb846e71c8988b3\iedw.exe.mui
- C:\fd4fb59b64fbbdb846e71c8988b3\ie4uinit.exe.mui
- C:\fd4fb59b64fbbdb846e71c8988b3\icardie.dll.mui
- C:\fd4fb59b64fbbdb846e71c8988b3\ieaksie.dll.mui
- C:\fd4fb59b64fbbdb846e71c8988b3\ieakeng.dll.mui
- C:\fd4fb59b64fbbdb846e71c8988b3\iepeers.dll.mui
- C:\fd4fb59b64fbbdb846e71c8988b3\inetcpl.cpl.mui
- C:\fd4fb59b64fbbdb846e71c8988b3\iexplore.exe.mui
- C:\fd4fb59b64fbbdb846e71c8988b3\licmgr10.dll.mui
- C:\fd4fb59b64fbbdb846e71c8988b3\inseng.dll.mui
- C:\fd4fb59b64fbbdb846e71c8988b3\iesetup.dll.mui
- C:\fd4fb59b64fbbdb846e71c8988b3\iernonce.dll.mui
- C:\fd4fb59b64fbbdb846e71c8988b3\ieunatt.exe.mui
- C:\fd4fb59b64fbbdb846e71c8988b3\ieui.dll.mui
- C:\fd4fb59b64fbbdb846e71c8988b3\html.iec.mui
- C:\fd4fb59b64fbbdb846e71c8988b3\inetcorp.iem
- C:\fd4fb59b64fbbdb846e71c8988b3\html.iec
- C:\fd4fb59b64fbbdb846e71c8988b3\ieuinit.inf
- C:\fd4fb59b64fbbdb846e71c8988b3\inetset.iem
- C:\fd4fb59b64fbbdb846e71c8988b3\spuninst.exe
- C:\fd4fb59b64fbbdb846e71c8988b3\mshta.exe
- C:\fd4fb59b64fbbdb846e71c8988b3\winfxdocobj.exe
- C:\fd4fb59b64fbbdb846e71c8988b3\spupdsvc.exe
- C:\fd4fb59b64fbbdb846e71c8988b3\occache.ini
- C:\fd4fb59b64fbbdb846e71c8988b3\advpack.dll.mui
- C:\fd4fb59b64fbbdb846e71c8988b3\admparse.dll.mui
- C:\fd4fb59b64fbbdb846e71c8988b3\hmmapi.dll.mui
- C:\fd4fb59b64fbbdb846e71c8988b3\extmgr.dll.mui
- C:\fd4fb59b64fbbdb846e71c8988b3\install.ins
- C:\fd4fb59b64fbbdb846e71c8988b3\webcheck.ini
- C:\fd4fb59b64fbbdb846e71c8988b3\msfeedsbs.mof
- C:\fd4fb59b64fbbdb846e71c8988b3\msfeeds.mof
- C:\fd4fb59b64fbbdb846e71c8988b3\update\idndl.exe
- C:\fd4fb59b64fbbdb846e71c8988b3\update\updspapi.dll
- C:\fd4fb59b64fbbdb846e71c8988b3\update\iesetup.exe
- C:\fd4fb59b64fbbdb846e71c8988b3\update\iereseticons.exe
- C:\fd4fb59b64fbbdb846e71c8988b3\update\ie7.cat
- C:\fd4fb59b64fbbdb846e71c8988b3\popupblk.wav
- C:\fd4fb59b64fbbdb846e71c8988b3\update\legitlibm.dll
- C:\fd4fb59b64fbbdb846e71c8988b3\update\iecustom.dll
- C:\fd4fb59b64fbbdb846e71c8988b3\update\nlsdl.exe
- C:\fd4fb59b64fbbdb846e71c8988b3\update\update.ver
- C:\fd4fb59b64fbbdb846e71c8988b3\update\eula.rtf
- %WINDIR%\ie7_main.log
- C:\fd4fb59b64fbbdb846e71c8988b3\$shtdwn$.req
- C:\fd4fb59b64fbbdb846e71c8988b3\update\xmllitesetup.exe
- C:\fd4fb59b64fbbdb846e71c8988b3\update\update.exe
- C:\fd4fb59b64fbbdb846e71c8988b3\update\update.exe.manifest
- C:\fd4fb59b64fbbdb846e71c8988b3\update\update.inf
- C:\fd4fb59b64fbbdb846e71c8988b3\navstart.wav
- C:\fd4fb59b64fbbdb846e71c8988b3\msrating.dll.mui
- C:\fd4fb59b64fbbdb846e71c8988b3\mshtmler.dll.mui
- C:\fd4fb59b64fbbdb846e71c8988b3\urlmon.dll.mui
- C:\fd4fb59b64fbbdb846e71c8988b3\occache.dll.mui
- C:\fd4fb59b64fbbdb846e71c8988b3\mshta.exe.mui
- C:\fd4fb59b64fbbdb846e71c8988b3\msfeedsbs.dll.mui
- C:\fd4fb59b64fbbdb846e71c8988b3\mshtmled.dll.mui
- C:\fd4fb59b64fbbdb846e71c8988b3\mshtml.dll.mui
- C:\fd4fb59b64fbbdb846e71c8988b3\webcheck.dll.mui
- C:\fd4fb59b64fbbdb846e71c8988b3\mshtml.tlb
- C:\fd4fb59b64fbbdb846e71c8988b3\ticrf.rat
- C:\fd4fb59b64fbbdb846e71c8988b3\infobar.wav
- C:\fd4fb59b64fbbdb846e71c8988b3\feeddisc.wav
- C:\fd4fb59b64fbbdb846e71c8988b3\wininet.dll.mui
- C:\fd4fb59b64fbbdb846e71c8988b3\winfxdocobj.exe.mui
- C:\fd4fb59b64fbbdb846e71c8988b3\icrav03.rat
- C:\fd4fb59b64fbbdb846e71c8988b3\tdc.ocx
- C:\fd4fb59b64fbbdb846e71c8988b3\msfeedssync.exe
- C:\fd4fb59b64fbbdb846e71c8988b3\custsat.dll
- C:\fd4fb59b64fbbdb846e71c8988b3\corpol.dll
- C:\fd4fb59b64fbbdb846e71c8988b3\dxtrans.dll
- C:\fd4fb59b64fbbdb846e71c8988b3\dxtmsft.dll
- C:\fd4fb59b64fbbdb846e71c8988b3\admparse.dll
- C:\fd4fb59b64fbbdb846e71c8988b3\ieapfltr.dat
- C:\fd4fb59b64fbbdb846e71c8988b3\browseui.dll
- C:\fd4fb59b64fbbdb846e71c8988b3\advpack.dll
- C:\fd4fb59b64fbbdb846e71c8988b3\extmgr.dll
- C:\fd4fb59b64fbbdb846e71c8988b3\ieapfltr.dll
- C:\fd4fb59b64fbbdb846e71c8988b3\ieakui.dll
- C:\fd4fb59b64fbbdb846e71c8988b3\ieencode.dll
- C:\fd4fb59b64fbbdb846e71c8988b3\iedkcs32.dll
- C:\fd4fb59b64fbbdb846e71c8988b3\icardie.dll
- C:\fd4fb59b64fbbdb846e71c8988b3\hmmapi.dll
- C:\fd4fb59b64fbbdb846e71c8988b3\ieaksie.dll
- C:\fd4fb59b64fbbdb846e71c8988b3\ieakeng.dll
- C:\fd4fb59b64fbbdb846e71c8988b3\inetcpl.cpl
- %TEMP%\IXP000.TMP\iedkcs32.dll
- %TEMP%\IXP000.TMP\ieakcust.dll
- %TEMP%\IXP000.TMP\BRANDING.CAB
- %TEMP%\IXP000.TMP\iesetup.cif
- %TEMP%\IXP000.TMP\Urlmon.dll
- %TEMP%\IXP000.TMP\Wininet.dll
- %TEMP%\IXP000.TMP\inseng.dll
- %TEMP%\IXP000.TMP\advpack.dll
- %TEMP%\IXP000.TMP\INSTALL.INS
- C:\fd4fb59b64fbbdb846e71c8988b3\ieeula.chm
- C:\fd4fb59b64fbbdb846e71c8988b3\ieakmmc.chm
- C:\fd4fb59b64fbbdb846e71c8988b3\iexplore.chm
- C:\fd4fb59b64fbbdb846e71c8988b3\iesupp.chm
- %TEMP%\IXP000.TMP\IE7-Setup.exe
- %TEMP%\IXP000.TMP\iesetup.ini
- C:\fd4fb59b64fbbdb846e71c8988b3\inetres.adm
- %TEMP%\IXP000.TMP\IE7Setup.cmd
- C:\fd4fb59b64fbbdb846e71c8988b3\shlwapi.dll
- C:\fd4fb59b64fbbdb846e71c8988b3\shdocvw.dll
- C:\fd4fb59b64fbbdb846e71c8988b3\url.dll
- C:\fd4fb59b64fbbdb846e71c8988b3\spmsg.dll
- C:\fd4fb59b64fbbdb846e71c8988b3\mstime.dll
- C:\fd4fb59b64fbbdb846e71c8988b3\msrating.dll
- C:\fd4fb59b64fbbdb846e71c8988b3\pngfilt.dll
- C:\fd4fb59b64fbbdb846e71c8988b3\occache.dll
- C:\fd4fb59b64fbbdb846e71c8988b3\urlmon.dll
- C:\fd4fb59b64fbbdb846e71c8988b3\iedw.exe
- C:\fd4fb59b64fbbdb846e71c8988b3\ie4uinit.exe
- C:\fd4fb59b64fbbdb846e71c8988b3\iexplore.exe
- C:\fd4fb59b64fbbdb846e71c8988b3\ieudinit.exe
- C:\fd4fb59b64fbbdb846e71c8988b3\vgx.dll
- C:\fd4fb59b64fbbdb846e71c8988b3\vbscript.dll
- C:\fd4fb59b64fbbdb846e71c8988b3\wininet.dll
- C:\fd4fb59b64fbbdb846e71c8988b3\webcheck.dll
- C:\fd4fb59b64fbbdb846e71c8988b3\msls31.dll
- C:\fd4fb59b64fbbdb846e71c8988b3\iesetup.dll
- C:\fd4fb59b64fbbdb846e71c8988b3\iertutil.dll
- C:\fd4fb59b64fbbdb846e71c8988b3\imgutil.dll
- C:\fd4fb59b64fbbdb846e71c8988b3\ieui.dll
- C:\fd4fb59b64fbbdb846e71c8988b3\iepeers.dll
- C:\fd4fb59b64fbbdb846e71c8988b3\ieframe.dll
- C:\fd4fb59b64fbbdb846e71c8988b3\iernonce.dll
- C:\fd4fb59b64fbbdb846e71c8988b3\ieproxy.dll
- C:\fd4fb59b64fbbdb846e71c8988b3\inseng.dll
- C:\fd4fb59b64fbbdb846e71c8988b3\mshtml.dll
- C:\fd4fb59b64fbbdb846e71c8988b3\msfeedsbs.dll
- C:\fd4fb59b64fbbdb846e71c8988b3\mshtmler.dll
- C:\fd4fb59b64fbbdb846e71c8988b3\mshtmled.dll
- C:\fd4fb59b64fbbdb846e71c8988b3\jsproxy.dll
- C:\fd4fb59b64fbbdb846e71c8988b3\jscript.dll
- C:\fd4fb59b64fbbdb846e71c8988b3\msfeeds.dll
- C:\fd4fb59b64fbbdb846e71c8988b3\licmgr10.dll
Другое:
Создает и запускает на исполнение:
- 'C:\fd4fb59b64fbbdb846e71c8988b3\update\iesetup.exe' /ieak-full:%TEMP%\IXP000.TMP\
- '%TEMP%\IXP000.TMP\IE7-Setup.exe' /ieak-full:%TEMP%\IXP000.TMP\
Запускает на исполнение:
- '<SYSTEM32>\cmd.exe' /c %TEMP%\IXP000.TMP\IE7Setup.cmd
