Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'wextract_cleanup0' = 'rundll32.exe <SYSTEM32>\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"'
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\IXP000.TMP\ieakcust.dll
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\iernonce.dll.mui
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\iertutil.dll.mui
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\iesetup.dll.mui
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\ieudinit.exe.mui
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\ieui.dll.mui
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\iexplore.exe.mui
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\admparse.dll.mui
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\inetcpl.cpl.mui
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\jscript.dll.mui
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\jsdbgui.dll.mui
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\jsdebuggeride.dll.mui
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\jsprofilercore.dll.mui
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\jsprofilerui.dll.mui
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\licmgr10.dll.mui
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\ieframe.dll.mui
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\iepeers.dll.mui
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\iedvtool.dll.mui
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\iedkcs32.dll.mui
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\ieakui.dll.mui
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\inetset.iem
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\ieuinit.inf
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\occache.ini
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\webcheck.ini
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\install.ins
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\msfeeds.mof
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\msfeedsbs.dll.mui
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\inseng.dll.mui
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\msfeedsbs.mof
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\hmmapi.dll.mui
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\html.iec.mui
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\icardie.dll.mui
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\ie4uinit.exe.mui
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\ieakeng.dll.mui
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\ieaksie.dll.mui
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\inetcorp.iem
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\advpack.dll.mui
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\ie8props.propdesc
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\$shtdwn$.req
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\mshtmler.dll.mui
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\support\normnfc.nls
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\support\normnfd.nls
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\support\normnfkc.nls
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\support\normnfkd.nls
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\update\ie8.cat
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\update\iecustom.dll
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\mshta.exe.mui
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\update\sqmapi.dll
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\update\iesetup.exe
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\update\update.exe
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\update\update.inf
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\update\update.exe.manifest
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\update\eula.rtf
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\update\update.ver
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\support\xmllite.dll
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\support\normidna.nls
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\support\normaliz.dll
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\support\nlsdl.dll
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\support\idndl.dll
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\occache.dll.mui
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\urlmon.dll.mui
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\vbscript.dll.mui
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\webcheck.dll.mui
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\winfxdocobj.exe.mui
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\wininet.dll.mui
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\mshtml.dll.mui
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\html.iec
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\tdc.ocx
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\ticrf.rat
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\mshtml.tlb
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\feeddisc.wav
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\infobar.wav
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\navstart.wav
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\popupblk.wav
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\msrating.dll.mui
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\icrav03.rat
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\update\updspapi.dll
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\winfxdocobj.exe
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\xpshims.dll
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\icardie.dll
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\ieakeng.dll
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\ieaksie.dll
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\ieakui.dll
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\ieapfltr.dll
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\iecompat.dll
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\ieakmmc.chm
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\iedkcs32.dll
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\ieframe.dll
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\iepeers.dll
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\ieproxy.dll
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\iernonce.dll
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\iertutil.dll
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\iesetup.dll
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\dxtrans.dll
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\hmmapi.dll
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\dxtmsft.dll
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\corpol.dll
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\browseui.dll
- %TEMP%\IXP000.TMP\iesetup.cif
- %TEMP%\IXP000.TMP\BRANDING.CAB
- %TEMP%\IXP000.TMP\INSTALL.INS
- %TEMP%\IXP000.TMP\iesetup.ini
- %TEMP%\IXP000.TMP\IE-REDIST.EXE
- %TEMP%\IXP000.TMP\IE-Setup.cmd
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\ieui.dll
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\iedvtool.dll
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\inetres.adm
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\iesupp.chm
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\iexplore.chm
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\inetcpl.cpl
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\ieapfltr.dat
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\admparse.dll
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\advpack.dll
- %TEMP%\IXP000.TMP\iedkcs32.dll
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\ieeula.chm
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\msfeedsbs.dll
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\spuninst.exe
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\jscript.dll
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\sqmapi.dll
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\url.dll
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\urlmon.dll
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\vbscript.dll
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\vgx.dll
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\webcheck.dll
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\imgutil.dll
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\wininet.dll
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\extexport.exe
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\ie4uinit.exe
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\ieudinit.exe
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\iexplore.exe
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\msfeedssync.exe
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\mshta.exe
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\shlwapi.dll
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\spmsg.dll
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\shdocvw.dll
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\pngfilt.dll
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\pdm.dll
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\jsdebuggeride.dll
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\jsprofilercore.dll
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\jsprofilerui.dll
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\jsproxy.dll
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\licmgr10.dll
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\msdbg2.dll
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\inseng.dll
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\spupdsvc.exe
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\msfeeds.dll
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\mshtmled.dll
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\mshtmler.dll
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\msls31.dll
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\msrating.dll
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\mstime.dll
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\occache.dll
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\jsdbgui.dll
- C:\cfec07ce3e7d57cb4f2012f8bbaa6923\mshtml.dll
- %WINDIR%\ie8_main.log
Другое:
Создает и запускает на исполнение:
- '%TEMP%\IXP000.TMP\IE-REDIST.EXE' /ieak-full:%TEMP%\IXP000.TMP\
- 'C:\cfec07ce3e7d57cb4f2012f8bbaa6923\update\iesetup.exe' /ieak-full:%TEMP%\IXP000.TMP\
Запускает на исполнение:
- '<SYSTEM32>\cmd.exe' /c %TEMP%\IXP000.TMP\IE-Setup.cmd
