Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Adguard' = '%ProgramFiles%\Adguard\Adguard.exe /nosplash'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Adguard Service] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\Adguard Service] 'ImagePath' = '%ProgramFiles%\Adguard\AdguardSvc.exe'
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\net.exe' stop "Adguard Service"
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\7ZipSfx.000\Adguard 6.2.437.2171.exe
- %ProgramFiles%\Adguard\is-MTNBN.tmp
- %ProgramFiles%\Adguard\is-55ONJ.tmp
- %ProgramFiles%\Adguard\is-8FJF5.tmp
- %ProgramFiles%\Adguard\is-PD4I8.tmp
- %ProgramFiles%\Adguard\langs\is-SJR3U.tmp
- %ProgramFiles%\Adguard\langs\is-SUP7L.tmp
- %ProgramFiles%\Adguard\langs\is-SNQID.tmp
- %ProgramFiles%\Adguard\langs\is-P0V1G.tmp
- %ProgramFiles%\Adguard\libs\is-4BIB5.tmp
- %ProgramFiles%\Adguard\nss\is-HNBIP.tmp
- %ProgramFiles%\Adguard\nss\is-03DD2.tmp
- %ProgramFiles%\Adguard\nss\is-THGLM.tmp
- %ProgramFiles%\Adguard\is-D013I.tmp
- %ProgramFiles%\Adguard\is-S8M97.tmp
- %ProgramFiles%\Adguard\nss\is-FUBR5.tmp
- %ProgramFiles%\Adguard\nss\is-50S1J.tmp
- %ProgramFiles%\Adguard\nss\is-N1CHL.tmp
- %ProgramFiles%\Adguard\nss\is-FPSH8.tmp
- %ProgramFiles%\Adguard\nss\is-5P7RG.tmp
- %ProgramFiles%\Adguard\nss\is-22HBU.tmp
- %ProgramFiles%\Adguard\nss\is-PKTGE.tmp
- %ALLUSERSPROFILE%\Application Data\Adguard\is-KUH24.tmp
- %ALLUSERSPROFILE%\Start Menu\Programs\Adguard\Adguard.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\Adguard\Uninstall.lnk
- %ProgramFiles%\Adguard\unins000.dat
- %TEMP%\aut1.tmp
- %TEMP%\ljpssnj
- %ProgramFiles%\Adguard\nss\is-H0HPN.tmp
- %ProgramFiles%\Adguard\nss\is-50E2R.tmp
- %ProgramFiles%\Adguard\is-9HGLS.tmp
- %ProgramFiles%\Adguard\is-UD0CP.tmp
- %ProgramFiles%\Adguard\is-3RARK.tmp
- %TEMP%\is-HC4RM.tmp\_isetup\_RegDLL.tmp
- %TEMP%\is-HC4RM.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-HC4RM.tmp\ISTask.dll
- %TEMP%\is-HC4RM.tmp\VclStylesInno.dll
- %TEMP%\is-HC4RM.tmp\MetroBlue.vsf
- %TEMP%\is-HC4RM.tmp\WizardForm.BitmapImage1.bmp
- %ProgramFiles%\Adguard\is-2CA6E.tmp
- %ProgramFiles%\Adguard\libs\is-K7GKB.tmp
- %ProgramFiles%\Adguard\is-5JJJ7.tmp
- %ProgramFiles%\Adguard\is-55OBQ.tmp
- %ProgramFiles%\Adguard\is-6J5TU.tmp
- %ProgramFiles%\Adguard\is-0IUCS.tmp
- %ProgramFiles%\Adguard\is-DT7SP.tmp
- %TEMP%\is-4B709.tmp\Adguard 6.2.437.2171.tmp
- %ProgramFiles%\Adguard\is-HNB6L.tmp
- %ProgramFiles%\Adguard\is-FMGIH.tmp
- %ProgramFiles%\Adguard\is-7P6O2.tmp
- %ProgramFiles%\Adguard\is-DKPA2.tmp
- %ProgramFiles%\Adguard\is-C3GJ6.tmp
- %ProgramFiles%\Adguard\is-7SHD2.tmp
- %ProgramFiles%\Adguard\is-0QRBQ.tmp
- %ProgramFiles%\Adguard\is-QTINM.tmp
- %ProgramFiles%\Adguard\is-BTBED.tmp
- %ProgramFiles%\Adguard\is-SQ288.tmp
- %ProgramFiles%\Adguard\is-4F4IN.tmp
- %ProgramFiles%\Adguard\is-O59LB.tmp
- %ProgramFiles%\Adguard\is-9AA9N.tmp
- %ProgramFiles%\Adguard\is-B1PJR.tmp
- %ProgramFiles%\Adguard\is-ST6R9.tmp
- %ProgramFiles%\Adguard\libs\blhe.ini
- <DRIVERS>\etc\BACKUP\hosts_2018-06-20_18-02-45.txt
Удаляет следующие файлы:
- %TEMP%\aut1.tmp
- %TEMP%\ljpssnj
Перемещает следующие файлы:
- %ProgramFiles%\Adguard\is-2CA6E.tmp в %ProgramFiles%\Adguard\unins000.exe
- %ProgramFiles%\Adguard\is-S8M97.tmp в %ProgramFiles%\Adguard\Microsoft.Expression.Interactions.dll
- %ProgramFiles%\Adguard\is-MTNBN.tmp в %ProgramFiles%\Adguard\Newtonsoft.Json.dll
- %ProgramFiles%\Adguard\is-55ONJ.tmp в %ProgramFiles%\Adguard\SQLite.Interop.dll
- %ProgramFiles%\Adguard\is-8FJF5.tmp в %ProgramFiles%\Adguard\System.Data.SQLite.dll
- %ProgramFiles%\Adguard\is-PD4I8.tmp в %ProgramFiles%\Adguard\System.Windows.Interactivity.dll
- %ProgramFiles%\Adguard\langs\is-SJR3U.tmp в %ProgramFiles%\Adguard\langs\Adguard.Filter.resources.ru.dll
- %ProgramFiles%\Adguard\langs\is-SUP7L.tmp в %ProgramFiles%\Adguard\langs\Adguard.Filter.resources.uk.dll
- %ProgramFiles%\Adguard\langs\is-SNQID.tmp в %ProgramFiles%\Adguard\langs\Adguard.UI.resources.ru.dll
- %ProgramFiles%\Adguard\langs\is-P0V1G.tmp в %ProgramFiles%\Adguard\langs\Adguard.UI.resources.uk.dll
- %ProgramFiles%\Adguard\libs\is-4BIB5.tmp в %ProgramFiles%\Adguard\libs\inststlib64.dll
- %ProgramFiles%\Adguard\nss\is-HNBIP.tmp в %ProgramFiles%\Adguard\nss\certutil.exe
- %ProgramFiles%\Adguard\nss\is-03DD2.tmp в %ProgramFiles%\Adguard\nss\freebl3.dll
- %ProgramFiles%\Adguard\nss\is-THGLM.tmp в %ProgramFiles%\Adguard\nss\libnspr4.dll
- %ProgramFiles%\Adguard\nss\is-FUBR5.tmp в %ProgramFiles%\Adguard\nss\libplc4.dll
- %ProgramFiles%\Adguard\nss\is-H0HPN.tmp в %ProgramFiles%\Adguard\nss\libplds4.dll
- %ProgramFiles%\Adguard\nss\is-50E2R.tmp в %ProgramFiles%\Adguard\nss\nss3.dll
- %ProgramFiles%\Adguard\nss\is-50S1J.tmp в %ProgramFiles%\Adguard\nss\nssckbi.dll
- %ProgramFiles%\Adguard\nss\is-N1CHL.tmp в %ProgramFiles%\Adguard\nss\nssdbm3.dll
- %ProgramFiles%\Adguard\nss\is-FPSH8.tmp в %ProgramFiles%\Adguard\nss\nssutil3.dll
- %ProgramFiles%\Adguard\nss\is-5P7RG.tmp в %ProgramFiles%\Adguard\nss\smime3.dll
- %ProgramFiles%\Adguard\nss\is-22HBU.tmp в %ProgramFiles%\Adguard\nss\softokn3.dll
- %ProgramFiles%\Adguard\is-D013I.tmp в %ProgramFiles%\Adguard\ICSharpCode.AvalonEdit.dll
- %ProgramFiles%\Adguard\nss\is-PKTGE.tmp в %ProgramFiles%\Adguard\nss\sqlite3.dll
- %ProgramFiles%\Adguard\is-9HGLS.tmp в %ProgramFiles%\Adguard\drivers.bin
- %ProgramFiles%\Adguard\is-3RARK.tmp в %ProgramFiles%\Adguard\Brotli.NET.dll
- %ProgramFiles%\Adguard\libs\is-K7GKB.tmp в %ProgramFiles%\Adguard\libs\blhe.exe
- %ProgramFiles%\Adguard\is-5JJJ7.tmp в %ProgramFiles%\Adguard\Adguard.Commons.dll
- %ProgramFiles%\Adguard\is-55OBQ.tmp в %ProgramFiles%\Adguard\Adguard.exe
- %ProgramFiles%\Adguard\is-6J5TU.tmp в %ProgramFiles%\Adguard\Adguard.exe.config
- %ProgramFiles%\Adguard\is-0IUCS.tmp в %ProgramFiles%\Adguard\Adguard.exe.manifest
- %ProgramFiles%\Adguard\is-DT7SP.tmp в %ProgramFiles%\Adguard\Adguard.Filter.dll
- %ProgramFiles%\Adguard\is-HNB6L.tmp в %ProgramFiles%\Adguard\Adguard.Global.dll
- %ProgramFiles%\Adguard\is-ST6R9.tmp в %ProgramFiles%\Adguard\Adguard.Ipc.dll
- %ProgramFiles%\Adguard\is-FMGIH.tmp в %ProgramFiles%\Adguard\Adguard.Network.dll
- %ProgramFiles%\Adguard\is-7P6O2.tmp в %ProgramFiles%\Adguard\Adguard.Safebrowsing.dll
- %ProgramFiles%\Adguard\is-DKPA2.tmp в %ProgramFiles%\Adguard\Adguard.Service.dll
- %ProgramFiles%\Adguard\is-C3GJ6.tmp в %ProgramFiles%\Adguard\Adguard.Tools.exe
- %ProgramFiles%\Adguard\is-7SHD2.tmp в %ProgramFiles%\Adguard\Adguard.Tools.exe.manifest
- %ProgramFiles%\Adguard\is-0QRBQ.tmp в %ProgramFiles%\Adguard\Adguard.UI.dll
- %ProgramFiles%\Adguard\is-QTINM.tmp в %ProgramFiles%\Adguard\AdguardNetApi.dll
- %ProgramFiles%\Adguard\is-BTBED.tmp в %ProgramFiles%\Adguard\AdguardNetLib.dll
- %ProgramFiles%\Adguard\is-SQ288.tmp в %ProgramFiles%\Adguard\AdguardSvc.exe
- %ProgramFiles%\Adguard\is-4F4IN.tmp в %ProgramFiles%\Adguard\AdguardSvc.exe.config
- %ProgramFiles%\Adguard\is-O59LB.tmp в %ProgramFiles%\Adguard\AdguardSvc.exe.manifest
- %ProgramFiles%\Adguard\is-9AA9N.tmp в %ProgramFiles%\Adguard\brolib32.dll
- %ProgramFiles%\Adguard\is-B1PJR.tmp в %ProgramFiles%\Adguard\brolib64.dll
- %ProgramFiles%\Adguard\is-UD0CP.tmp в %ProgramFiles%\Adguard\default.db
- %ALLUSERSPROFILE%\Application Data\Adguard\is-KUH24.tmp в %ALLUSERSPROFILE%\Application Data\Adguard\adguard.db
Изменяет файл HOSTS.
Другое:
Создает и запускает на исполнение:
- '%TEMP%\7ZipSfx.000\Adguard 6.2.437.2171.exe' /SILENT /VERYSILENT
- '%TEMP%\is-4B709.tmp\Adguard 6.2.437.2171.tmp' /SL5="$40036,31533870,67072,%TEMP%\7ZipSfx.000\Adguard 6.2.437.2171.exe" /SILENT /VERYSILENT
- '%ProgramFiles%\Adguard\libs\blhe.exe' /a api.adguard.com
Запускает на исполнение:
- '<SYSTEM32>\net1.exe' stop "Adguard Service"
- '<SYSTEM32>\ipconfig.exe' /flushdns
- '<SYSTEM32>\sc.exe' create "Adguard Service" binPath= "%ProgramFiles%\Adguard\AdguardSvc.exe" start= auto error= ignore DisplayName= "Adguard Service"
