Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks\Driver Easy Scheduled Scan.job
Вредоносные функции:
Для обхода брандмауэра удаляет или модифицирует следующие ключи реестра:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] '%ProgramFiles%\Easeware\DriverEasy\DriverEasy.exe' = '%ProgramFiles%\Eas...
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%ProgramFiles%\Easeware\DriverEasy\DriverEasy.exe' = '%ProgramFiles%\E...
Запускает на исполнение:
- '<SYSTEM32>\netsh.exe' firewall add allowedprogram program="%ProgramFiles%\Easeware\DriverEasy\DriverEasy.exe" name="Driver Easy" mode=ENABLE profile=ALL
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\aut1.tmp
- %ProgramFiles%\Easeware\DriverEasy\is-25LNG.tmp
- %ProgramFiles%\Easeware\DriverEasy\is-UTC17.tmp
- %ProgramFiles%\Easeware\DriverEasy\is-6RL8V.tmp
- %ProgramFiles%\Easeware\DriverEasy\is-CPC41.tmp
- %ProgramFiles%\Easeware\DriverEasy\is-29HGI.tmp
- %ProgramFiles%\Easeware\DriverEasy\is-HHK9I.tmp
- %ProgramFiles%\Easeware\DriverEasy\is-MGH9Q.tmp
- %ProgramFiles%\Easeware\DriverEasy\is-H6LR6.tmp
- %ProgramFiles%\Easeware\DriverEasy\is-7NM3B.tmp
- %ProgramFiles%\Easeware\DriverEasy\is-SHF2F.tmp
- %TEMP%\is-K7MLV.tmp\icon_custom_up_hover.bmp
- %ProgramFiles%\Easeware\DriverEasy\is-21020.tmp
- %ProgramFiles%\Easeware\DriverEasy\is-B8AD7.tmp
- %ProgramFiles%\Easeware\DriverEasy\7z\is-LHODJ.tmp
- %ProgramFiles%\Easeware\DriverEasy\HardwareInfo\is-B54RU.tmp
- %ProgramFiles%\Easeware\DriverEasy\HardwareInfo\is-OFIBT.tmp
- %TEMP%\is-K7MLV.tmp\is-T3A50.tmp
- %ALLUSERSPROFILE%\Start Menu\Programs\Driver Easy\Driver Easy.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\Driver Easy\Uninstall Driver Easy.lnk
- %ALLUSERSPROFILE%\Desktop\Driver Easy.lnk
- %ProgramFiles%\Easeware\DriverEasy\unins000.msg
- %ProgramFiles%\Easeware\DriverEasy\unins000.dat
- %APPDATA%\Easeware\DriverEasy\settings.dat
- %ProgramFiles%\Easeware\DriverEasy\is-NVJF7.tmp
- %ProgramFiles%\Easeware\DriverEasy\7z\is-O1AMJ.tmp
- %TEMP%\is-K7MLV.tmp\icon_custom_up.bmp
- %TEMP%\is-K7MLV.tmp\icon_custom_down_hover.bmp
- %TEMP%\is-K7MLV.tmp\icon_custom_down.bmp
- %TEMP%\is-U0TPE.tmp\~scjvmga.tmp
- %TEMP%\is-K7MLV.tmp\botva2.dll
- %TEMP%\is-K7MLV.tmp\innocallback.dll
- %TEMP%\is-K7MLV.tmp\isxdl.dll
- %TEMP%\is-K7MLV.tmp\icon_custom.png
- %TEMP%\is-K7MLV.tmp\icon_uncustom.png
- %TEMP%\is-K7MLV.tmp\button_setup_or_next.png
- %TEMP%\is-K7MLV.tmp\background_welcome.png
- %TEMP%\is-K7MLV.tmp\background_welcome_more.png
- %TEMP%\is-K7MLV.tmp\button_browse.png
- %TEMP%\is-K7MLV.tmp\progressbar_background.png
- %CommonProgramFiles%\~scjvmga.ibo
- %TEMP%\is-K7MLV.tmp\progressbar_foreground.png
- %TEMP%\is-K7MLV.tmp\background_installing.png
- %TEMP%\is-K7MLV.tmp\background_finish.png
- %TEMP%\is-K7MLV.tmp\button_close.png
- %TEMP%\is-K7MLV.tmp\button_minimize.png
- %TEMP%\is-K7MLV.tmp\background_messagebox.png
- %TEMP%\is-K7MLV.tmp\icon-info_60x60.png
- %TEMP%\is-K7MLV.tmp\btn_install.bmp
- %TEMP%\is-K7MLV.tmp\btn_install_hover.bmp
- %TEMP%\is-K7MLV.tmp\btn_install_notclick.bmp
- %TEMP%\is-K7MLV.tmp\btn_browse.bmp
- %TEMP%\is-K7MLV.tmp\btn_browse_hover.bmp
- %TEMP%\is-K7MLV.tmp\checkbox_license.png
- %TEMP%\aut2.tmp
- %APPDATA%\Easeware\DriverEasy\license.dat
Присваивает атрибут 'скрытый' для следующих файлов:
- %CommonProgramFiles%\~scjvmga.ibo
- %TEMP%\is-K7MLV.tmp\icon_custom_down_hover.bmp
- %TEMP%\is-K7MLV.tmp\icon_custom_down.bmp
- %TEMP%\is-K7MLV.tmp\btn_browse_hover.bmp
- %TEMP%\is-K7MLV.tmp\btn_browse.bmp
- %TEMP%\is-K7MLV.tmp\btn_install_notclick.bmp
- %TEMP%\is-K7MLV.tmp\btn_install_hover.bmp
- %TEMP%\is-K7MLV.tmp\btn_install.bmp
- %TEMP%\is-K7MLV.tmp\icon-info_60x60.png
- %TEMP%\is-K7MLV.tmp\background_messagebox.png
- %TEMP%\is-K7MLV.tmp\button_minimize.png
- %TEMP%\is-K7MLV.tmp\button_close.png
- %TEMP%\is-K7MLV.tmp\icon_custom_up.bmp
- %TEMP%\is-K7MLV.tmp\background_finish.png
- %TEMP%\is-K7MLV.tmp\checkbox_license.png
- %TEMP%\is-K7MLV.tmp\progressbar_foreground.png
- %TEMP%\is-K7MLV.tmp\progressbar_background.png
- %TEMP%\is-K7MLV.tmp\button_browse.png
- %TEMP%\is-K7MLV.tmp\background_welcome_more.png
- %TEMP%\is-K7MLV.tmp\background_welcome.png
- %TEMP%\is-K7MLV.tmp\button_setup_or_next.png
- %TEMP%\is-K7MLV.tmp\icon_uncustom.png
- %TEMP%\is-K7MLV.tmp\icon_custom.png
- %TEMP%\is-K7MLV.tmp\innocallback.dll
- %TEMP%\is-K7MLV.tmp\botva2.dll
- %TEMP%\is-K7MLV.tmp\background_installing.png
- %TEMP%\is-K7MLV.tmp\icon_custom_up_hover.bmp
Удаляет следующие файлы:
- %TEMP%\aut1.tmp
- %TEMP%\is-K7MLV.tmp\progressbar_foreground.png
- %TEMP%\is-K7MLV.tmp\progressbar_background.png
- %TEMP%\is-K7MLV.tmp\isxdl.dll
- %TEMP%\is-K7MLV.tmp\innocallback.dll
- %TEMP%\is-K7MLV.tmp\icon_uncustom.png
- %TEMP%\is-K7MLV.tmp\icon_custom_up_hover.bmp
- %TEMP%\is-K7MLV.tmp\icon_custom_up.bmp
- %TEMP%\is-K7MLV.tmp\icon_custom_down_hover.bmp
- %TEMP%\is-K7MLV.tmp\icon_custom_down.bmp
- %TEMP%\is-K7MLV.tmp\icon_custom.png
- %TEMP%\is-K7MLV.tmp\icon-info_60x60.png
- %TEMP%\is-K7MLV.tmp\checkbox_license.png
- %TEMP%\is-K7MLV.tmp\button_setup_or_next.png
- %TEMP%\is-K7MLV.tmp\button_minimize.png
- %TEMP%\is-K7MLV.tmp\button_close.png
- %TEMP%\is-K7MLV.tmp\button_browse.png
- %TEMP%\is-K7MLV.tmp\btn_install_notclick.bmp
- %TEMP%\is-K7MLV.tmp\btn_install_hover.bmp
- %TEMP%\is-K7MLV.tmp\btn_install.bmp
- %TEMP%\is-K7MLV.tmp\btn_browse_hover.bmp
- %TEMP%\is-K7MLV.tmp\btn_browse.bmp
- %TEMP%\is-K7MLV.tmp\botva2.dll
- %TEMP%\is-K7MLV.tmp\background_welcome_more.png
- %TEMP%\is-K7MLV.tmp\background_welcome.png
- %TEMP%\is-K7MLV.tmp\background_messagebox.png
- %TEMP%\is-K7MLV.tmp\background_installing.png
- %TEMP%\is-K7MLV.tmp\background_finish.png
- %TEMP%\is-K7MLV.tmp\InstallDotNet.bat
- <SYSTEM32>\d3d9caps.dat
- %TEMP%\is-U0TPE.tmp\~scjvmga.tmp
- %TEMP%\aut2.tmp
Перемещает следующие файлы:
- %ProgramFiles%\Easeware\DriverEasy\is-21020.tmp в %ProgramFiles%\Easeware\DriverEasy\unins000.exe
- %ProgramFiles%\Easeware\DriverEasy\HardwareInfo\is-B54RU.tmp в %ProgramFiles%\Easeware\DriverEasy\HardwareInfo\HardwareInfo.dll
- %ProgramFiles%\Easeware\DriverEasy\7z\is-LHODJ.tmp в %ProgramFiles%\Easeware\DriverEasy\7z\7z86.dll
- %ProgramFiles%\Easeware\DriverEasy\7z\is-O1AMJ.tmp в %ProgramFiles%\Easeware\DriverEasy\7z\7z.dll
- %ProgramFiles%\Easeware\DriverEasy\is-NVJF7.tmp в %ProgramFiles%\Easeware\DriverEasy\SevenZipSharp.dll
- %ProgramFiles%\Easeware\DriverEasy\is-B8AD7.tmp в %ProgramFiles%\Easeware\DriverEasy\Map.xml
- %ProgramFiles%\Easeware\DriverEasy\is-SHF2F.tmp в %ProgramFiles%\Easeware\DriverEasy\Interop.WUApiLib.dll
- %ProgramFiles%\Easeware\DriverEasy\is-7NM3B.tmp в %ProgramFiles%\Easeware\DriverEasy\Easeware.Driver.Core.dll
- %ProgramFiles%\Easeware\DriverEasy\is-H6LR6.tmp в %ProgramFiles%\Easeware\DriverEasy\Easeware.Driver.Backup.dll
- %ProgramFiles%\Easeware\DriverEasy\is-MGH9Q.tmp в %ProgramFiles%\Easeware\DriverEasy\Easeware.ConfigLanguageFromSetup.exe.config
- %ProgramFiles%\Easeware\DriverEasy\is-HHK9I.tmp в %ProgramFiles%\Easeware\DriverEasy\Easeware.ConfigLanguageFromSetup.exe
- %ProgramFiles%\Easeware\DriverEasy\is-29HGI.tmp в %ProgramFiles%\Easeware\DriverEasy\Easeware.CheckScheduledScan.exe.config
- %ProgramFiles%\Easeware\DriverEasy\is-CPC41.tmp в %ProgramFiles%\Easeware\DriverEasy\Easeware.CheckScheduledScan.exe
- %ProgramFiles%\Easeware\DriverEasy\is-6RL8V.tmp в %ProgramFiles%\Easeware\DriverEasy\DriverEasy.exe.config
- %ProgramFiles%\Easeware\DriverEasy\is-UTC17.tmp в %ProgramFiles%\Easeware\DriverEasy\DriverEasy.exe
- %ProgramFiles%\Easeware\DriverEasy\is-25LNG.tmp в %ProgramFiles%\Easeware\DriverEasy\7zip_license.txt
- %ProgramFiles%\Easeware\DriverEasy\HardwareInfo\is-OFIBT.tmp в %ProgramFiles%\Easeware\DriverEasy\HardwareInfo\HardwareInfo64.dll
- %TEMP%\is-K7MLV.tmp\is-T3A50.tmp в %TEMP%\is-K7MLV.tmp\InstallDotNet.bat
Подменяет следующие файлы:
- <SYSTEM32>\d3d9caps.dat
Изменяет файл HOSTS.
Сетевая активность:
Подключается к:
- 'wp#d':80
- 'go#####analytics.com':443
TCP:
Запросы HTTP GET:
- http://11#.#11.111.1/wpad.dat via wp#d
UDP:
- DNS ASK wp#d
- DNS ASK www.go#####analytics.com
- DNS ASK www.dr###reasy.com
Другое:
Создает и запускает на исполнение:
- '%CommonProgramFiles%\~scjvmga.ibo' /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
- '%TEMP%\is-U0TPE.tmp\~scjvmga.tmp' /SL5="$100E0,3590243,397824,%CommonProgramFiles%\~scjvmga.ibo" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
- '%ProgramFiles%\Easeware\DriverEasy\Easeware.CheckScheduledScan.exe' -create "Driver Easy Scheduled Scan" "%ProgramFiles%\Easeware\DriverEasy\DriverEasy.exe"
- '%ProgramFiles%\Easeware\DriverEasy\Easeware.ConfigLanguageFromSetup.exe' DriverEasy en
- '%ProgramFiles%\Easeware\DriverEasy\DriverEasy.exe'
