Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'update' = '%PROGRAM_FILES%\Internet Explorer\IE Uninstall\aupdate.exe'
Вредоносные функции:
Создает и запускает на исполнение:
- %PROGRAM_FILES%\Internet Explorer\2052\u88.exe
Запускает на исполнение:
- <SYSTEM32>\regsvr32.exe /s "%PROGRAM_FILES%\Internet Explorer\2052\IEHelper.dll"
- <SYSTEM32>\regsvr32.exe /s "%PROGRAM_FILES%\Internet Explorer\2052\WebBand.dll"
- <SYSTEM32>\regsvr32.exe /s "%PROGRAM_FILES%\Internet Explorer\2052\toolbarU88.dll"
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %PROGRAM_FILES%\Internet Explorer\2052\u88.exe.tmp
- %PROGRAM_FILES%\Internet Explorer\2052\toolbarU88.dll
- %PROGRAM_FILES%\Internet Explorer\2052\toolbarU88.dll.tmp
- %PROGRAM_FILES%\Internet Explorer\2052\u88.Ico
- %PROGRAM_FILES%\Internet Explorer\2052\u88.Ico.tmp
- %PROGRAM_FILES%\Internet Explorer\2052\u88.exe
- %PROGRAM_FILES%\Internet Explorer\2052\img\Thumbs.db.tmp
- %PROGRAM_FILES%\Internet Explorer\2052\img\g.gif
- %PROGRAM_FILES%\Internet Explorer\2052\img\g.gif.tmp
- %PROGRAM_FILES%\Internet Explorer\2052\img\x.gif
- %PROGRAM_FILES%\Internet Explorer\2052\img\x.gif.tmp
- %PROGRAM_FILES%\Internet Explorer\2052\img\Thumbs.db
- %PROGRAM_FILES%\Internet Explorer\2052\u88icon.Ico.tmp
- %WINDIR%\u88icon.ico
- %HOMEPATH%\Start Menu\Programs\U88ІЖё»їміµ\unInstall.exe
- %HOMEPATH%\Start Menu\Programs\U88ІЖё»їміµ\U88.URL
- %HOMEPATH%\Favorites\U88НшЦ·µјєЅ.URL
- %HOMEPATH%\Favorites\U88Б¬ЛшјУГЛНш.URL
- %HOMEPATH%\Desktop\U88.URL
- %PROGRAM_FILES%\Internet Explorer\2052\unInstall.exe
- %PROGRAM_FILES%\Internet Explorer\2052\unInstall.exe.tmp
- %PROGRAM_FILES%\Internet Explorer\2052\u88icon.Ico
- %PROGRAM_FILES%\Internet Explorer\2052\WebBand.dll.tmp
- %PROGRAM_FILES%\Internet Explorer\2052\update.dat
- %PROGRAM_FILES%\Internet Explorer\2052\update.dat.tmp
- %PROGRAM_FILES%\Internet Explorer\2052\aupdate.exe
- %PROGRAM_FILES%\Internet Explorer\2052\aupdate.exe.tmp
- %PROGRAM_FILES%\Internet Explorer\2052\allverx.dat
- %PROGRAM_FILES%\Internet Explorer\2052\gdtest.htm.tmp
- %PROGRAM_FILES%\Internet Explorer\2052\contextmenu.htm
- %PROGRAM_FILES%\Internet Explorer\2052\contextmenu.htm.tmp
- %PROGRAM_FILES%\Internet Explorer\2052\2.css
- %PROGRAM_FILES%\Internet Explorer\2052\2.css.tmp
- %PROGRAM_FILES%\Internet Explorer\2052\setup.tmp
- %PROGRAM_FILES%\Internet Explorer\2052\allverx.dat.tmp
- %PROGRAM_FILES%\Internet Explorer\2052\3.css
- %PROGRAM_FILES%\Internet Explorer\2052\3.css.tmp
- %PROGRAM_FILES%\Internet Explorer\2052\gdtest.htm
- %PROGRAM_FILES%\Internet Explorer\2052\img\7.gif.tmp
- %PROGRAM_FILES%\Internet Explorer\2052\img\5.gif
- %PROGRAM_FILES%\Internet Explorer\2052\img\5.gif.tmp
- %PROGRAM_FILES%\Internet Explorer\2052\img\biaoti.gif
- %PROGRAM_FILES%\Internet Explorer\2052\img\biaoti.gif.tmp
- %PROGRAM_FILES%\Internet Explorer\2052\img\7.gif
- %PROGRAM_FILES%\Internet Explorer\2052\img\1.gif.tmp
- %PROGRAM_FILES%\Internet Explorer\2052\IEHelper.dll
- %PROGRAM_FILES%\Internet Explorer\2052\IEHelper.dll.tmp
- %PROGRAM_FILES%\Internet Explorer\2052\img\4.gif
- %PROGRAM_FILES%\Internet Explorer\2052\img\4.gif.tmp
- %PROGRAM_FILES%\Internet Explorer\2052\img\1.gif
Удаляет следующие файлы:
- %PROGRAM_FILES%\Internet Explorer\2052\img\x.gif.tmp
- %PROGRAM_FILES%\Internet Explorer\2052\toolbarU88.dll.tmp
- %PROGRAM_FILES%\Internet Explorer\2052\img\Thumbs.db.tmp
- %PROGRAM_FILES%\Internet Explorer\2052\img\biaoti.gif.tmp
- %PROGRAM_FILES%\Internet Explorer\2052\img\g.gif.tmp
- %PROGRAM_FILES%\Internet Explorer\2052\u88.exe.tmp
- %PROGRAM_FILES%\Internet Explorer\2052\update.dat.tmp
- %PROGRAM_FILES%\Internet Explorer\2052\WebBand.dll.tmp
- %PROGRAM_FILES%\Internet Explorer\2052\unInstall.exe.tmp
- %PROGRAM_FILES%\Internet Explorer\2052\u88.Ico.tmp
- %PROGRAM_FILES%\Internet Explorer\2052\u88icon.Ico.tmp
- %PROGRAM_FILES%\Internet Explorer\2052\aupdate.exe.tmp
- %PROGRAM_FILES%\Internet Explorer\2052\contextmenu.htm.tmp
- %PROGRAM_FILES%\Internet Explorer\2052\allverx.dat.tmp
- %PROGRAM_FILES%\Internet Explorer\2052\2.css.tmp
- %PROGRAM_FILES%\Internet Explorer\2052\3.css.tmp
- %PROGRAM_FILES%\Internet Explorer\2052\gdtest.htm.tmp
- %PROGRAM_FILES%\Internet Explorer\2052\img\5.gif.tmp
- %PROGRAM_FILES%\Internet Explorer\2052\img\7.gif.tmp
- %PROGRAM_FILES%\Internet Explorer\2052\img\4.gif.tmp
- %PROGRAM_FILES%\Internet Explorer\2052\IEHelper.dll.tmp
- %PROGRAM_FILES%\Internet Explorer\2052\img\1.gif.tmp
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'Indicator' WindowName: ''
