Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'wextract_cleanup0' = 'rundll32.exe <SYSTEM32>\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"'
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\IXP000.TMP\Wininet.dll
- C:\cd3f20f2823f92e69627bb4b6f80\_sfx_0010._p
- C:\cd3f20f2823f92e69627bb4b6f80\_sfx_0012._p
- C:\cd3f20f2823f92e69627bb4b6f80\_sfx_0000._p
- C:\cd3f20f2823f92e69627bb4b6f80\_sfx_0011._p
- C:\cd3f20f2823f92e69627bb4b6f80\_sfx_0003._p
- C:\cd3f20f2823f92e69627bb4b6f80\_sfx_0002._p
- C:\cd3f20f2823f92e69627bb4b6f80\_sfx_0006._p
- C:\cd3f20f2823f92e69627bb4b6f80\update\update.exe
- C:\cd3f20f2823f92e69627bb4b6f80\spuninst.exe
- C:\cd3f20f2823f92e69627bb4b6f80\update\update_SP2QFE.inf
- C:\cd3f20f2823f92e69627bb4b6f80\update\update_SP2GDR.inf
- C:\7329f19c2a3163410e72dcca\update\nlsdl.exe
- C:\cd3f20f2823f92e69627bb4b6f80\update\branches.inf
- C:\cd3f20f2823f92e69627bb4b6f80\update\updspapi.dll
- C:\cd3f20f2823f92e69627bb4b6f80\SP2GDR\xmllite.dll
- C:\cd3f20f2823f92e69627bb4b6f80\SP2QFE\xmllite.dll
- C:\cd3f20f2823f92e69627bb4b6f80\spmsg.dll
- C:\cd3f20f2823f92e69627bb4b6f80\update\KB915865.CAT
- C:\cd3f20f2823f92e69627bb4b6f80\update\updatebr.inf
- C:\cd3f20f2823f92e69627bb4b6f80\update\spcustom.dll
- %WINDIR%\KB915865.log
- <SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem3.CAT
- %WINDIR%\inf\oem3.inf
- %WINDIR%\inf\oem3.PNF
- C:\cd3f20f2823f92e69627bb4b6f80\_sfx_0004._p
- C:\cd3f20f2823f92e69627bb4b6f80\_sfx_0005._p
- C:\cd3f20f2823f92e69627bb4b6f80\_sfx_0001._p
- C:\cd3f20f2823f92e69627bb4b6f80\_sfx_0009._p
- C:\cd3f20f2823f92e69627bb4b6f80\_sfx_0008._p
- C:\7329f19c2a3163410e72dcca\mshtml.tlb
- C:\7329f19c2a3163410e72dcca\feeddisc.wav
- C:\7329f19c2a3163410e72dcca\infobar.wav
- C:\7329f19c2a3163410e72dcca\navstart.wav
- C:\7329f19c2a3163410e72dcca\popupblk.wav
- C:\7329f19c2a3163410e72dcca\update\ie7.cat
- C:\7329f19c2a3163410e72dcca\update\iecustom.dll
- C:\7329f19c2a3163410e72dcca\update\legitlibm.dll
- C:\7329f19c2a3163410e72dcca\update\updspapi.dll
- C:\7329f19c2a3163410e72dcca\update\idndl.exe
- C:\7329f19c2a3163410e72dcca\update\iereseticons.exe
- %WINDIR%\inf\HFX3.tmp
- C:\cd3f20f2823f92e69627bb4b6f80\update\eula.txt
- C:\7329f19c2a3163410e72dcca\update\iesetup.exe
- C:\7329f19c2a3163410e72dcca\update\xmllitesetup.exe
- C:\7329f19c2a3163410e72dcca\update\update.inf
- C:\7329f19c2a3163410e72dcca\update\update.exe.manifest
- C:\7329f19c2a3163410e72dcca\update\eula.rtf
- C:\7329f19c2a3163410e72dcca\update\update.ver
- C:\7329f19c2a3163410e72dcca\$shtdwn$.req
- %WINDIR%\ie7_main.log
- %TEMP%\IXP000.TMP\filelist.dat
- C:\cd3f20f2823f92e69627bb4b6f80\update\update.ver
- C:\cd3f20f2823f92e69627bb4b6f80\_sfx_.dll
- C:\cd3f20f2823f92e69627bb4b6f80\_sfx_0007._p
- C:\7329f19c2a3163410e72dcca\ticrf.rat
- C:\7329f19c2a3163410e72dcca\update\update.exe
- %WINDIR%\KB915865.cat
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP17\snapshot\_REGISTRY_MACHINE_SECURITY
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19
- %WINDIR%\$hf_mig$\KB915865\update\branches.inf
- <SYSTEM32>\SET4.tmp
- %WINDIR%\$hf_mig$\KB915865\SP2QFE\SET5.tmp
- C:\95ca09da79b9fe01d41ae7f6ed48\nlsdl.dll
- C:\95ca09da79b9fe01d41ae7f6ed48\spmsg.dll
- C:\95ca09da79b9fe01d41ae7f6ed48\spuninst.exe
- C:\95ca09da79b9fe01d41ae7f6ed48\spupdsvc.exe
- C:\95ca09da79b9fe01d41ae7f6ed48\update\nlsdownlevelmapping.cat
- C:\95ca09da79b9fe01d41ae7f6ed48\update\spcustom.dll
- C:\95ca09da79b9fe01d41ae7f6ed48\update\updspapi.dll
- C:\95ca09da79b9fe01d41ae7f6ed48\update\update.exe
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18
- C:\95ca09da79b9fe01d41ae7f6ed48\update\update.inf
- C:\95ca09da79b9fe01d41ae7f6ed48\update\update.ver
- %WINDIR%\NLSDownlevelMapping.log
- %TEMP%\Cab6.tmp
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP17\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP17\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP17\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP17\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP17\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP17\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP17\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP17\snapshot\_REGISTRY_USER_.DEFAULT
- %WINDIR%\$hf_mig$\KB915865\update\updatebr.inf
- %WINDIR%\$hf_mig$\KB915865\update\eula.txt
- %WINDIR%\$hf_mig$\KB915865\update\update.ver
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.MAP
- %WINDIR%\$hf_mig$\KB915865\update\updspapi.dll
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_.DEFAULT
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SECURITY
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SOFTWARE
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SYSTEM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SAM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\ComDb.Dat
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\domain.txt
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\$WinMgmt.CFG
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19
- C:\7329f19c2a3163410e72dcca\icrav03.rat
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.BTR
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING.VER
- <SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\KB915865.cat
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING1.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING2.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.DATA
- %WINDIR%\$hf_mig$\KB915865\update\update_SP2QFE.inf
- %WINDIR%\$hf_mig$\KB915865\spuninst.exe
- %WINDIR%\$hf_mig$\KB915865\spmsg.dll
- %WINDIR%\$hf_mig$\KB915865\update\spcustom.dll
- %WINDIR%\$hf_mig$\KB915865\update\KB915865.CAT
- %WINDIR%\$hf_mig$\KB915865\update\update.exe
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.MAP
- C:\95ca09da79b9fe01d41ae7f6ed48\update\eula.txt
- C:\7329f19c2a3163410e72dcca\tdc.ocx
- C:\7329f19c2a3163410e72dcca\inetcpl.cpl.mui
- C:\7329f19c2a3163410e72dcca\ieapfltr.dll
- C:\7329f19c2a3163410e72dcca\iedkcs32.dll
- C:\7329f19c2a3163410e72dcca\ieencode.dll
- C:\7329f19c2a3163410e72dcca\ieframe.dll
- C:\7329f19c2a3163410e72dcca\iepeers.dll
- C:\7329f19c2a3163410e72dcca\ieproxy.dll
- C:\7329f19c2a3163410e72dcca\iernonce.dll
- C:\7329f19c2a3163410e72dcca\iertutil.dll
- C:\7329f19c2a3163410e72dcca\iesetup.dll
- C:\7329f19c2a3163410e72dcca\ieui.dll
- C:\7329f19c2a3163410e72dcca\imgutil.dll
- C:\7329f19c2a3163410e72dcca\ieeula.chm
- C:\7329f19c2a3163410e72dcca\inseng.dll
- C:\7329f19c2a3163410e72dcca\jsproxy.dll
- C:\7329f19c2a3163410e72dcca\licmgr10.dll
- C:\7329f19c2a3163410e72dcca\msfeeds.dll
- C:\7329f19c2a3163410e72dcca\msfeedsbs.dll
- C:\7329f19c2a3163410e72dcca\mshtml.dll
- C:\7329f19c2a3163410e72dcca\mshtmled.dll
- C:\7329f19c2a3163410e72dcca\mshtmler.dll
- C:\7329f19c2a3163410e72dcca\msls31.dll
- C:\7329f19c2a3163410e72dcca\msrating.dll
- C:\7329f19c2a3163410e72dcca\mstime.dll
- C:\7329f19c2a3163410e72dcca\occache.dll
- C:\7329f19c2a3163410e72dcca\ieaksie.dll
- C:\7329f19c2a3163410e72dcca\ieakui.dll
- C:\7329f19c2a3163410e72dcca\ieakeng.dll
- C:\7329f19c2a3163410e72dcca\icardie.dll
- C:\7329f19c2a3163410e72dcca\hmmapi.dll
- %TEMP%\IXP000.TMP\advpack.dll
- %TEMP%\IXP000.TMP\inseng.dll
- %TEMP%\IXP000.TMP\ieakcust.dll
- %TEMP%\IXP000.TMP\iedkcs32.dll
- %TEMP%\IXP000.TMP\iesetup.cif
- %TEMP%\IXP000.TMP\BRANDING.CAB
- %TEMP%\IXP000.TMP\INSTALL.INS
- %TEMP%\IXP000.TMP\iesetup.ini
- %TEMP%\IXP000.TMP\IE7-Setup.exe
- %TEMP%\IXP000.TMP\IE7Setup.cmd
- C:\7329f19c2a3163410e72dcca\inetres.adm
- C:\7329f19c2a3163410e72dcca\pngfilt.dll
- C:\7329f19c2a3163410e72dcca\jscript.dll
- C:\7329f19c2a3163410e72dcca\ieakmmc.chm
- C:\7329f19c2a3163410e72dcca\iexplore.chm
- C:\7329f19c2a3163410e72dcca\inetcpl.cpl
- C:\7329f19c2a3163410e72dcca\ieapfltr.dat
- C:\7329f19c2a3163410e72dcca\admparse.dll
- C:\7329f19c2a3163410e72dcca\advpack.dll
- C:\7329f19c2a3163410e72dcca\browseui.dll
- C:\7329f19c2a3163410e72dcca\corpol.dll
- C:\7329f19c2a3163410e72dcca\custsat.dll
- C:\7329f19c2a3163410e72dcca\dxtmsft.dll
- C:\7329f19c2a3163410e72dcca\dxtrans.dll
- C:\7329f19c2a3163410e72dcca\extmgr.dll
- %TEMP%\IXP000.TMP\Urlmon.dll
- C:\7329f19c2a3163410e72dcca\iesupp.chm
- C:\7329f19c2a3163410e72dcca\spupdsvc.exe
- C:\7329f19c2a3163410e72dcca\winfxdocobj.exe.mui
- C:\7329f19c2a3163410e72dcca\spmsg.dll
- C:\7329f19c2a3163410e72dcca\ieakeng.dll.mui
- C:\7329f19c2a3163410e72dcca\ieaksie.dll.mui
- C:\7329f19c2a3163410e72dcca\ieakui.dll.mui
- C:\7329f19c2a3163410e72dcca\iedkcs32.dll.mui
- C:\7329f19c2a3163410e72dcca\iedw.exe.mui
- C:\7329f19c2a3163410e72dcca\ieframe.dll.mui
- C:\7329f19c2a3163410e72dcca\iepeers.dll.mui
- C:\7329f19c2a3163410e72dcca\iernonce.dll.mui
- C:\7329f19c2a3163410e72dcca\iesetup.dll.mui
- C:\7329f19c2a3163410e72dcca\ieui.dll.mui
- C:\7329f19c2a3163410e72dcca\ieunatt.exe.mui
- C:\7329f19c2a3163410e72dcca\shdocvw.dll
- C:\7329f19c2a3163410e72dcca\iexplore.exe.mui
- C:\7329f19c2a3163410e72dcca\inseng.dll.mui
- C:\7329f19c2a3163410e72dcca\licmgr10.dll.mui
- C:\7329f19c2a3163410e72dcca\msfeedsbs.dll.mui
- C:\7329f19c2a3163410e72dcca\mshta.exe.mui
- C:\7329f19c2a3163410e72dcca\mshtml.dll.mui
- C:\7329f19c2a3163410e72dcca\mshtmled.dll.mui
- C:\7329f19c2a3163410e72dcca\mshtmler.dll.mui
- C:\7329f19c2a3163410e72dcca\msrating.dll.mui
- C:\7329f19c2a3163410e72dcca\occache.dll.mui
- C:\7329f19c2a3163410e72dcca\urlmon.dll.mui
- C:\7329f19c2a3163410e72dcca\webcheck.dll.mui
- C:\7329f19c2a3163410e72dcca\icardie.dll.mui
- C:\7329f19c2a3163410e72dcca\ie4uinit.exe.mui
- C:\7329f19c2a3163410e72dcca\html.iec.mui
- C:\7329f19c2a3163410e72dcca\hmmapi.dll.mui
- C:\7329f19c2a3163410e72dcca\extmgr.dll.mui
- C:\7329f19c2a3163410e72dcca\urlmon.dll
- C:\7329f19c2a3163410e72dcca\vbscript.dll
- C:\7329f19c2a3163410e72dcca\vgx.dll
- C:\7329f19c2a3163410e72dcca\webcheck.dll
- C:\7329f19c2a3163410e72dcca\wininet.dll
- C:\7329f19c2a3163410e72dcca\ie4uinit.exe
- C:\7329f19c2a3163410e72dcca\iedw.exe
- C:\7329f19c2a3163410e72dcca\ieudinit.exe
- C:\7329f19c2a3163410e72dcca\iexplore.exe
- C:\7329f19c2a3163410e72dcca\msfeedssync.exe
- C:\7329f19c2a3163410e72dcca\mshta.exe
- C:\7329f19c2a3163410e72dcca\shlwapi.dll
- C:\7329f19c2a3163410e72dcca\wininet.dll.mui
- C:\7329f19c2a3163410e72dcca\spuninst.exe
- C:\7329f19c2a3163410e72dcca\html.iec
- C:\7329f19c2a3163410e72dcca\inetcorp.iem
- C:\7329f19c2a3163410e72dcca\inetset.iem
- C:\7329f19c2a3163410e72dcca\ieuinit.inf
- C:\7329f19c2a3163410e72dcca\occache.ini
- C:\7329f19c2a3163410e72dcca\webcheck.ini
- C:\7329f19c2a3163410e72dcca\install.ins
- C:\7329f19c2a3163410e72dcca\msfeeds.mof
- C:\7329f19c2a3163410e72dcca\msfeedsbs.mof
- C:\7329f19c2a3163410e72dcca\admparse.dll.mui
- C:\7329f19c2a3163410e72dcca\advpack.dll.mui
- C:\7329f19c2a3163410e72dcca\url.dll
- C:\7329f19c2a3163410e72dcca\winfxdocobj.exe
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP17\snapshot\_REGISTRY_MACHINE_SOFTWARE
Присваивает атрибут 'скрытый' для следующих файлов:
- <SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem3.CAT
- <SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\KB915865.cat
Удаляет следующие файлы:
- C:\cd3f20f2823f92e69627bb4b6f80\_sfx_0000._p
- <SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem3.CAT
- C:\cd3f20f2823f92e69627bb4b6f80\update\spcustom.dll
- C:\cd3f20f2823f92e69627bb4b6f80\update\updatebr.inf
- C:\cd3f20f2823f92e69627bb4b6f80\update\KB915865.CAT
- C:\cd3f20f2823f92e69627bb4b6f80\spmsg.dll
- C:\cd3f20f2823f92e69627bb4b6f80\SP2QFE\xmllite.dll
- C:\cd3f20f2823f92e69627bb4b6f80\update\updspapi.dll
- C:\cd3f20f2823f92e69627bb4b6f80\_sfx_0008._p
- C:\cd3f20f2823f92e69627bb4b6f80\update\eula.txt
- C:\cd3f20f2823f92e69627bb4b6f80\update\branches.inf
- C:\cd3f20f2823f92e69627bb4b6f80\update\update_SP2GDR.inf
- C:\cd3f20f2823f92e69627bb4b6f80\update\update_SP2QFE.inf
- C:\cd3f20f2823f92e69627bb4b6f80\spuninst.exe
- C:\cd3f20f2823f92e69627bb4b6f80\update\update.exe
- %WINDIR%\inf\oem3.PNF
- %WINDIR%\inf\oem3.inf
- %WINDIR%\_000001_.tmp.dll
- %WINDIR%\inf\_000000_.tmp.dll
- C:\cd3f20f2823f92e69627bb4b6f80\_sfx_.dll
- C:\cd3f20f2823f92e69627bb4b6f80\_sfx_0012._p
- C:\cd3f20f2823f92e69627bb4b6f80\_sfx_0011._p
- C:\cd3f20f2823f92e69627bb4b6f80\_sfx_0010._p
- C:\cd3f20f2823f92e69627bb4b6f80\_sfx_0009._p
- C:\cd3f20f2823f92e69627bb4b6f80\SP2GDR\xmllite.dll
- C:\cd3f20f2823f92e69627bb4b6f80\_sfx_0007._p
- C:\cd3f20f2823f92e69627bb4b6f80\_sfx_0006._p
- C:\cd3f20f2823f92e69627bb4b6f80\_sfx_0005._p
- C:\cd3f20f2823f92e69627bb4b6f80\_sfx_0004._p
- C:\cd3f20f2823f92e69627bb4b6f80\_sfx_0003._p
- C:\cd3f20f2823f92e69627bb4b6f80\_sfx_0002._p
- C:\cd3f20f2823f92e69627bb4b6f80\_sfx_0001._p
- C:\cd3f20f2823f92e69627bb4b6f80\update\update.ver
- %TEMP%\Cab6.tmp
Перемещает следующие системные файлы:
- %WINDIR%\inf\branches.inf в %WINDIR%\inf\_000000_.tmp.dll
Перемещает следующие файлы:
- %WINDIR%\KB915865.cat в %WINDIR%\_000001_.tmp.dll
- <SYSTEM32>\SET4.tmp в <SYSTEM32>\xmllite.dll
- %WINDIR%\$hf_mig$\KB915865\SP2QFE\SET5.tmp в %WINDIR%\$hf_mig$\KB915865\SP2QFE\xmllite.dll
Подменяет следующие файлы:
- <SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem3.CAT
- %WINDIR%\inf\oem3.inf
- %WINDIR%\inf\oem3.PNF
Сетевая активность:
Подключается к:
- 'wp#d':80
- 'download.windowsupdate.com':80
TCP:
Запросы HTTP GET:
- http://11#.#11.111.1/wpad.dat via wp#d
- http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt via download.windowsupdate.com
- http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab via download.windowsupdate.com
UDP:
- DNS ASK wp#d
- DNS ASK www.download.windowsupdate.com
Другое:
Создает и запускает на исполнение:
- '%TEMP%\IXP000.TMP\IE7-Setup.exe' /ieak-full:%TEMP%\IXP000.TMP\ /nobackup /update-no /passive /norestart
- 'C:\7329f19c2a3163410e72dcca\update\iesetup.exe' /ieak-full:%TEMP%\IXP000.TMP\ /nobackup /update-no /passive /norestart
- 'C:\7329f19c2a3163410e72dcca\update\xmllitesetup.exe' /quiet /norestart /er /nobackup /log:%WINDIR%
- 'C:\cd3f20f2823f92e69627bb4b6f80\update\update.exe' /quiet /norestart /er /nobackup /log:%WINDIR%
- 'C:\7329f19c2a3163410e72dcca\update\nlsdl.exe' /quiet /norestart /er /nobackup /log:%WINDIR%
- 'C:\95ca09da79b9fe01d41ae7f6ed48\update\update.exe' /quiet /norestart /er /nobackup /log:%WINDIR%
Запускает на исполнение:
- '<SYSTEM32>\cmd.exe' /c %TEMP%\IXP000.TMP\IE7Setup.cmd /nobackup /update-no /passive /norestart
