Техническая информация
Для обеспечения автозапуска и распространения
Модифицирует следующие ключи реестра
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'EanthologyApp' = '%CommonProgramFiles%\eaccel~1\EANTHO~1.EXE /b Startup'
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\eac292332240_00000000\regsvr32.exe
- %CommonProgramFiles%\eaccel~1\spaceblast.gif
- %CommonProgramFiles%\eaccel~1\reversi.gif
- %CommonProgramFiles%\eaccel~1\puzzlebox.gif
- %CommonProgramFiles%\eaccel~1\oodlzmatch.gif
- %CommonProgramFiles%\eaccel~1\lightsout.gif
- %CommonProgramFiles%\eaccel~1\klondike.gif
- %CommonProgramFiles%\eaccel~1\freecell.gif
- %CommonProgramFiles%\eaccel~1\fourinarow.gif
- %CommonProgramFiles%\eaccel~1\checkers.gif
- %CommonProgramFiles%\eaccel~1\wordsearch.gif
- %CommonProgramFiles%\eaccel~1\blocks.gif
- %CommonProgramFiles%\eaccel~1\oodlzx.dll
- %CommonProgramFiles%\eaccel~1\oodlz.exe
- %CommonProgramFiles%\eaccel~1\oodlz00.gif
- %CommonProgramFiles%\eaccel~1\puzzle00.htm
- %CommonProgramFiles%\eaccel~1\cards00.htm
- %CommonProgramFiles%\eaccel~1\board00.htm
- %CommonProgramFiles%\eaccel~1\ducksinarow.gif
- %TEMP%\eac292332240_00000000\na_board00.htm
- %CommonProgramFiles%\eaccel~1\oodlzrevenge.gif
- %ALLUSERSPROFILE%\start menu\programs\eanthology\eanthology manager.lnk
- %CommonProgramFiles%\eacceleration\cs_def.exe
- %CommonProgramFiles%\eacceleration\cs_t4c.exe
- %CommonProgramFiles%\eacceleration\eanthmngr.dll
- %TEMP%\eac00000000\setup.ini
- %TEMP%\eac00000000\cs_t4c.exe
- %TEMP%\eac00000000\cs_def.exe
- %TEMP%\eac00000000\eanthmngr.dll
- %CommonProgramFiles%\eaccel~1\arcade00.htm
- %CommonProgramFiles%\eaccel~1\tileslide.gif
- %CommonProgramFiles%\eaccel~1\konx_logo.gif
- %CommonProgramFiles%\eaccel~1\konx_isp.htm
- %CommonProgramFiles%\eaccel~1\konx.dll
- %CommonProgramFiles%\eaccel~1\na_puzzle00.htm
- %CommonProgramFiles%\eaccel~1\na_cards00.htm
- %CommonProgramFiles%\eaccel~1\na_board00.htm
- %CommonProgramFiles%\eaccel~1\na_arcade00.htm
- %CommonProgramFiles%\eaccel~1\bg_screen.gif
- %CommonProgramFiles%\eaccel~1\ispnum.dat
- %CommonProgramFiles%\eaccel~1\trans.gif
- %CommonProgramFiles%\eaccel~1\eanthology_updater2.exe
- %CommonProgramFiles%\eaccel~1\eanthologyapp_update.exe.chk
- %CommonProgramFiles%\eaccel~1\eanthology.exe
- %TEMP%\eac292332240_00000000\arcade00.htm
- %TEMP%\eac292332240_00000000\fourinarow.gif
- %TEMP%\eac292332240_00000000\ducksinarow.gif
- %TEMP%\eac292332240_00000000\checkers.gif
- %TEMP%\eac292332240_00000000\blocks.gif
- %TEMP%\eac292332240_00000000\oodlz00.gif
- %TEMP%\eac292332240_00000000\puzzle00.htm
- %TEMP%\eac292332240_00000000\cards00.htm
- %APPDATA%\microsoft\internet explorer\quick launch\eanthology manager.lnk
- %TEMP%\eac292332240_00000000\lightsout.gif
- %TEMP%\eac292332240_00000000\oodlzx.dll
- %TEMP%\eac292332240_00000000\oodlz.exe
- %TEMP%\eac292332240_00000000\syscheck.exe
- %TEMP%\eac292332240_00000000\eanthology.exe
- %TEMP%\eac292332240_00000000\eanthologyapp_update.exe.chk
- %TEMP%\eac292332240_00000000\setup.ini
- %TEMP%\eac292332240_00000000\license.txt
- %TEMP%\eac292332240_00000000\setup.exe
- %TEMP%\eac292332240_00000000\board00.htm
- %TEMP%\eac00000000\setup.exe
- %TEMP%\eac292332240_00000000\klondike.gif
- %TEMP%\eac292332240_00000000\reversi.gif
- %TEMP%\eac292332240_00000000\oodlzmatch.gif
- %CommonProgramFiles%\eaccel~1\license.txt
- %CommonProgramFiles%\eaccel~1\regsvr32.exe
- %TEMP%\eac292332240_00000000\eanthology_updater2.exe
- %TEMP%\eac292332240_00000000\ispnum.dat
- %TEMP%\eac292332240_00000000\konx_logo.gif
- %TEMP%\eac292332240_00000000\konx_isp.htm
- %TEMP%\eac292332240_00000000\konx.dll
- %TEMP%\eac292332240_00000000\puzzlebox.gif
- %TEMP%\eac292332240_00000000\na_puzzle00.htm
- %TEMP%\eac292332240_00000000\freecell.gif
- %TEMP%\eac292332240_00000000\na_arcade00.htm
- %TEMP%\eac292332240_00000000\bg_screen.gif
- %TEMP%\eac292332240_00000000\trans.gif
- %TEMP%\eac292332240_00000000\oodlzrevenge.gif
- %TEMP%\eac292332240_00000000\wordsearch.gif
- %TEMP%\eac292332240_00000000\tileslide.gif
- %TEMP%\eac292332240_00000000\spaceblast.gif
- %TEMP%\eac292332240_00000000\na_cards00.htm
- %CommonProgramFiles%\eaccel~1\eac_install00.dat
Удаляет следующие файлы
- %TEMP%\eac00000000\cs_def.exe
- %TEMP%\eac292332240_00000000\na_board00.htm
- %TEMP%\eac292332240_00000000\na_cards00.htm
- %TEMP%\eac292332240_00000000\na_puzzle00.htm
- %TEMP%\eac292332240_00000000\oodlz.exe
- %TEMP%\eac292332240_00000000\oodlz00.gif
- %TEMP%\eac292332240_00000000\oodlzmatch.gif
- %TEMP%\eac292332240_00000000\oodlzrevenge.gif
- %TEMP%\eac292332240_00000000\lightsout.gif
- %TEMP%\eac292332240_00000000\na_arcade00.htm
- %TEMP%\eac292332240_00000000\oodlzx.dll
- %TEMP%\eac292332240_00000000\regsvr32.exe
- %TEMP%\eac292332240_00000000\reversi.gif
- %TEMP%\eac292332240_00000000\setup.exe
- %TEMP%\eac292332240_00000000\setup.ini
- %TEMP%\eac292332240_00000000\spaceblast.gif
- %TEMP%\eac292332240_00000000\syscheck.exe
- %TEMP%\eac292332240_00000000\tileslide.gif
- %TEMP%\eac292332240_00000000\puzzle00.htm
- %TEMP%\eac292332240_00000000\puzzlebox.gif
- %TEMP%\eac292332240_00000000\license.txt
- %TEMP%\eac292332240_00000000\konx_logo.gif
- %TEMP%\eac292332240_00000000\konx_isp.htm
- %TEMP%\eac00000000\eanthmngr.dll
- %TEMP%\eac00000000\setup.exe
- %TEMP%\eac00000000\setup.ini
- %TEMP%\eac292332240_00000000\arcade00.htm
- %TEMP%\eac292332240_00000000\bg_screen.gif
- %TEMP%\eac292332240_00000000\blocks.gif
- %TEMP%\eac292332240_00000000\board00.htm
- %TEMP%\eac292332240_00000000\cards00.htm
- %TEMP%\eac00000000\cs_t4c.exe
- %TEMP%\eac292332240_00000000\checkers.gif
- %TEMP%\eac292332240_00000000\eanthology.exe
- %TEMP%\eac292332240_00000000\eanthologyapp_update.exe.chk
- %TEMP%\eac292332240_00000000\eanthology_updater2.exe
- %TEMP%\eac292332240_00000000\fourinarow.gif
- %TEMP%\eac292332240_00000000\freecell.gif
- %TEMP%\eac292332240_00000000\ispnum.dat
- %TEMP%\eac292332240_00000000\klondike.gif
- %TEMP%\eac292332240_00000000\konx.dll
- %TEMP%\eac292332240_00000000\ducksinarow.gif
- %TEMP%\eac292332240_00000000\trans.gif
- %TEMP%\eac292332240_00000000\wordsearch.gif
Перемещает следующие файлы
- %CommonProgramFiles%\eaccel~1\oodlz.exe в %ProgramFiles%\accele~1\oodlz\oodlz.exe
- %CommonProgramFiles%\eaccel~1\oodlzx.dll в %ProgramFiles%\accele~1\oodlz\oodlzx.dll
Сетевая активность
TCP
Запросы HTTP GET
- http://www.bu###nware.net/ping/?b=#######################################################################################################################################################
- http://st###ign.com/ping/?b=#######################################################################################################################################################
- http://www.bu###nware.net/ping/?b=###########################################################################################################################################################
- http://st###ign.com/ping/?b=###########################################################################################################################################################
UDP
- DNS ASK bu###nware.net
- DNS ASK st###ign.com
- DNS ASK ra###.veloz.com
Другое
Ищет следующие окна
- ClassName: 'Class_BackgroundWindow_Eanthology_Application' WindowName: ''
- ClassName: 'Class_ContolPanelWindow_Eanthology_Application' WindowName: ''
- ClassName: 'eAnthology_DownloadGuard_class' WindowName: ''
Создает и запускает на исполнение
- '%TEMP%\eac292332240_00000000\syscheck.exe'
- '%TEMP%\eac292332240_00000000\setup.exe' /Cmd <Полный путь к файлу> "<Полный путь к файлу>"
- '%TEMP%\eac292332240_00000000\eanthology.exe' /k WaitConfig
- '%TEMP%\eac292332240_00000000\eanthology.exe' /k lock
- '%CommonProgramFiles%\eaccel~1\eanthology_updater2.exe'
- '%TEMP%\eac00000000\setup.exe'
- '%CommonProgramFiles%\eaccel~1\eanthology.exe' /RegServer
- '%CommonProgramFiles%\eaccel~1\regsvr32.exe' /s %ProgramFiles%\accele~1\Oodlz\oodlzx.dll
- '%CommonProgramFiles%\eaccel~1\eanthology.exe' /k unlock
- '%CommonProgramFiles%\eaccel~1\eanthology.exe' /c %TEMP%\EAC292332240_00000000\setup.exe /Cmd <Полный путь к файлу> "<Полный путь к файлу>"
