Trojan.DownLoader34.52155

Техническая информация

Для обеспечения автозапуска и распространения

Модифицирует следующие ключи реестра

[<HKLM>\SOFTWARE\Classes\MBSA.Report.Viewer\shell\open\command] '' = '"%ProgramFiles(x86)%\Microsoft Baseline Security Analyzer 2\mbsa.exe" "%1"'

Изменения в файловой системе

Создает следующие файлы

%TEMP%\ixp000.tmp\mbsasetup-x86-ja.msi
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\help\check53177.html
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\help\check53177fix.html
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\help\check53178.html
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\help\check53178fix.html
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\help\check53179.html
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\help\check53179fix.html
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\help\check53313.html
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\help\check53313fix.html
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\help\check53315.html
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\help\check53315fix.html
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\help\check53316fix.html
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\graphics\info.gif
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\help\mbsahelp.html
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\help\readme.html
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\css\resultdetails.css
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\css\scanner.css
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\css\coua.css
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\css\couaprint.css
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\graphics\arrow.gif
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\graphics\arrow_disabled.gif
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\graphics\barrow.gif
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\graphics\barrow_disabled.gif
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\help\check53176fix.html
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\help\check53316.html
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\help\check53176.html
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\help\check5334.html
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\help\check5331.html
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\help\check53310.html
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\help\check53310fix.html
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\help\check53311.html
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\help\check53311fix.html
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\help\check53312.html
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\help\check53312fix.html
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\help\check5331fix.html
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\help\check5333.html
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\help\check5333fix.html
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\help\check5334fix.html
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\help\check5340.html
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\help\check5335.html
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\help\check5335fix.html
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\help\check5336.html
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\help\check5336fix.html
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\help\check5337.html
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\help\check5337fix.html
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\help\check5338.html
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\help\check5338fix.html
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\help\check5339.html
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\help\check5339fix.html
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\help\check5340fix.html
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\graphics\mini_x_red.gif
C:\users\public\desktop\microsoft baseline security analyzer 2.1.lnk
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\graphics\copy.jpg
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\graphics\excl_red16.gif
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\graphics\leftcorner.gif
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\graphics\plus_blu.gif
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\graphics\progress.gif
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\graphics\progress_empty.gif
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\graphics\rightcorner.gif
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\graphics\score_1.gif
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\graphics\score_3.gif
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\graphics\spacer.gif
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\graphics\star_blu.gif
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\graphics\wait_m.cur
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\graphics\button_dimple.png
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\graphics\download.gif
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\graphics\exp_expand.gif
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\graphics\exp_collapse.gif
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\graphics\mini_star_blu.gif
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\graphics\close_1.gif
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\graphics\close_2.gif
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\graphics\close_3.gif
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\includes\dropdown.js
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\includes\object.js
%WINDIR%\installer\{55d1bf8e-ea8f-4969-82b9-b577010cfbcd}\mbsa.exe
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\graphics\excl_red.gif
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\help\check5328fix.html
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\graphics\excl_gld.gif
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\graphics\print.jpg
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\graphics\disabled_back.png
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\graphics\disabled_fwd.png
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\graphics\down_back.png
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\graphics\down_fwd.png
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\graphics\mini_chek_grn.gif
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\graphics\chek_grn.gif
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\graphics\hover_back.png
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\graphics\hover_fwd.png
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\graphics\mbsaapp.png
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\graphics\mstoolbar_ms.gif
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\graphics\blueinfo32.gif
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\graphics\banner.jpg
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\graphics\x_red.gif
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\graphics\scanmultiple24.jpg
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\graphics\scansingle24.jpg
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\graphics\up_back.png
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\graphics\up_fwd.png
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\graphics\viewreport24.jpg
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\graphics\disabled_viewreport24.jpg
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\graphics\mini_x_gold.gif
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\graphics\x_gold.gif
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\graphics\astrx.gif
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\graphics\dash.gif
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\graphics\toc_endnode.gif
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\help\check5328.html
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\help\check5319.html
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\reportheader.xsl
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\reportdetails.html
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\reportdetails.xsl
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\reportdetailswus.xsl
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\reportdetailssql.xsl
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\reportnamelist.xsl
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\reports.html
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\reports.xsl
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\scan.html
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\showreport.html
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\toolbar.html
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\mbsa2mux86.exe
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\viewerrors.html
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\viewreport.html
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\viewreport_footer.html
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\welcome.html
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\newversion.html
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\reportdetailsiezones.xsl
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\reportdetailsiezonessub.html
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\reportdetailsiezonessub.xsl
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\mbsa2rix86.exe
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\mbsa2rix64.exe
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\report.xsl
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\susmru.xsl
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\copyreportlisttxt.xsl
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\errors.xsl
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\mbsa.exe
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\mbsacli.exe
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\serversecure.dll
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\xmldb.dll
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\wusscan.dll
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\about.html
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\computermru.xsl
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\default.html
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\domainmru.xsl
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\errors.html
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\footer.html
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\printreportlist.html
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\header.html
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\ipmru.xsl
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\iprangemru.xsl
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\onereport.html
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\optionshelp.html
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\pickcomputer.html
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\pickcomputers.html
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\pickreport.html
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\printreport.html
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\printreport.xsl
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\copyreportlist.xsl
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\help\check53111.html
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\help\check5327.html
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\details.csv
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\help\check5314.html
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\help\check5314fix.html
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\help\check5315.html
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\help\check5315fix.html
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\help\check5316.html
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\help\check5316fix.html
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\help\check5317.html
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\help\check5317fix.html
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\help\check5318.html
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\help\check5318fix.html
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\help\check5319fix.html
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\checks.csv
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\help\check5321.html
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\help\check5321fix.html
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\help\check5323.html
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\help\check5323fix.html
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\help\check5324.html
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\help\check5324fix.html
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\help\check5325.html
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\help\check5325fix.html
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\help\check5326.html
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\help\check5326fix.html
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\help\check5313fix.html
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\help\check5327fix.html
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\help\check5313.html
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\help\check53110fix.html
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\noexpireok.txt
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\services.txt
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\cmddetailreport_v.xsl
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\cmderrors.xsl
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\cmdoverviewreport.xsl
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\cmdreportlist.xsl
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\help\check20001.html
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\help\check20001fix.html
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\help\check5311.html
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\help\check53110.html
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\mbsa2mux64.exe
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\help\check53117fix.html
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\help\check53111fix.html
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\help\check53112.html
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\help\check53112fix.html
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\help\check53114.html
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\help\check53114fix.html
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\help\check53115.html
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\help\check53115fix.html
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\help\check53116.html
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\help\check53116fix.html
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\help\check53117.html
%ProgramFiles(x86)%\microsoft baseline security analyzer 2\help\check5311fix.html
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\microsoft baseline security analyzer 2.1.lnk

Удаляет следующие файлы

%TEMP%\ixp000.tmp\mbsasetup-x86-ja.msi

Сетевая активность

TCP

Запросы HTTP GET

http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
http://oc##.#tartssl.com/sub/class2/code/ca/MEMwQTA%2FMD0wOzAJBgUrDgMCGgUABBQSOgrhRCSnWfKxoWTjWxhk8hga9AQU0E4PQJlsuEsZbzsouODjiAc0qrcCAhAV

UDP

DNS ASK microsoft.com
DNS ASK st####.rapidssl.com
DNS ASK oc##.#tartssl.com

Другое

Запускает на исполнение

'%WINDIR%\syswow64\msiexec.exe' /qb /i MBSASetup-x86-JA.msi
'%WINDIR%\syswow64\msiexec.exe' /Y "%ProgramFiles(x86)%\Microsoft Baseline Security Analyzer 2\serversecure.dll"
'%WINDIR%\syswow64\msiexec.exe' /Y "%ProgramFiles(x86)%\Microsoft Baseline Security Analyzer 2\xmldb.dll"

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней