Trojan.Siggen15.8677

Техническая информация

Для обеспечения автозапуска и распространения

Модифицирует следующие ключи реестра

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'COMODO Internet Security' = '%ProgramFiles%\COMODO\COMODO Internet Security\cistray.exe'
[<HKLM>\SOFTWARE\Classes\comodo\shell\open\command] '' = '"%ProgramFiles%\COMODO\COMODO Internet Security\cfpconfg.exe" --comodoUri "%1"'
[<HKLM>\SOFTWARE\Classes\kiosk\shell\open\command] '' = '"%ProgramFiles%\COMODO\COMODO Internet Security\virtkiosk.exe" -r "%1"'
[<HKLM>\SOFTWARE\Classes\safe\shell\open\command] '' = '"%ProgramFiles%\COMODO\COMODO Internet Security\virtkiosk.exe" -v "%1"'
[<HKLM>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'GrpConv' = 'grpconv -o'

Устанавливает следующие настройки сервисов

[<HKLM>\System\CurrentControlSet\Services\Schedule] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\cmdAgent] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\cmdAgent] 'ImagePath' = '"%ProgramFiles%\COMODO\COMODO Internet Security\cmdagent.exe"'
[<HKLM>\System\CurrentControlSet\Services\cmdvirth] 'ImagePath' = '"%ProgramFiles%\COMODO\COMODO Internet Security\cmdvirth.exe"'
[<HKLM>\System\CurrentControlSet\Services\IKEEXT] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\cmdGuard] 'Start' = '00000001'
[<HKLM>\System\CurrentControlSet\Services\cmdGuard] 'ImagePath' = 'system32\DRIVERS\cmdguard.sys'
[<HKLM>\System\CurrentControlSet\Services\cmderd] 'Start' = '00000001'
[<HKLM>\System\CurrentControlSet\Services\cmderd] 'ImagePath' = 'system32\DRIVERS\cmderd.sys'

Создает следующие сервисы

'cmdAgent' "%ProgramFiles%\COMODO\COMODO Internet Security\cmdagent.exe"
'cmdAgent' %ProgramFiles%\COMODO\COMODO Internet Security\cmdagent.exe
'cmdvirth' "%ProgramFiles%\COMODO\COMODO Internet Security\cmdvirth.exe"
'cmdvirth' %ProgramFiles%\COMODO\COMODO Internet Security\cmdvirth.exe
'cmdGuard' system32\DRIVERS\cmdguard.sys
'cmderd' system32\DRIVERS\cmderd.sys

Вредоносные функции

Для обхода брандмауэра удаляет или модифицирует следующие ключи реестра

[<HKLM>\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] 'EnableFirewall' = '00000000'
[<HKLM>\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'

Регистрирует фильтр файловой системы

[<HKLM>\System\CurrentControlSet\Services\cmdGuard] 'Group' = 'FSFilter Anti-Virus'

Изменения в файловой системе

Создает следующие файлы

%TEMP%\7zipsfx.000\ces_x64.msi
%ProgramFiles%\comodo\comodo internet security\translations\cmdres.english.lang.template
%ProgramFiles%\comodo\comodo internet security\translations\cmdres.estonian.lang
%ProgramFiles%\comodo\comodo internet security\translations\cmdres.french.lang
%ProgramFiles%\comodo\comodo internet security\translations\cmdres.german.lang
%ProgramFiles%\comodo\comodo internet security\translations\cmdres.greek.lang
%ProgramFiles%\comodo\comodo internet security\translations\cmdres.hungarian.lang
%ProgramFiles%\comodo\comodo internet security\translations\cmdres.italian.lang
%ProgramFiles%\comodo\comodo internet security\translations\cmdres.japanese.lang
%ProgramFiles%\comodo\comodo internet security\translations\cmdres.persian.lang
%ProgramFiles%\comodo\comodo internet security\translations\cmdres.polish.lang
%ProgramFiles%\comodo\comodo internet security\translations\cmdres.romanian.lang
%ProgramFiles%\comodo\comodo internet security\translations\cmdres.danish.lang
%ProgramFiles%\comodo\comodo internet security\translations\cmdres.dutch.lang
%ProgramFiles%\comodo\comodo internet security\translations\cmdres.russian.lang
%ProgramFiles%\comodo\comodo internet security\translations\cmdres.swedish.lang
%ProgramFiles%\comodo\comodo internet security\translations\cmdres.turkish.lang
%ProgramFiles%\comodo\comodo internet security\translations\cmdres.ukrainian.lang
%ProgramFiles%\comodo\comodo internet security\translations\cmdres.vietnamese.lang
%ProgramFiles%\comodo\comodo internet security\translations\comodoinstaller.english.lang.template
%ProgramFiles%\comodo\comodo internet security\translations\virtkiosk.arabic.lang
%ProgramFiles%\comodo\comodo internet security\translations\virtkiosk.brazilian.lang
%ProgramFiles%\comodo\comodo internet security\translations\virtkiosk.bulgarian.lang
%ProgramFiles%\comodo\comodo internet security\translations\virtkiosk.chinese.lang
%ProgramFiles%\comodo\comodo internet security\translations\virtkiosk.chinesetraditional.lang
%ProgramFiles%\comodo\comodo internet security\translations\virtkiosk.croatian.lang
%ProgramFiles%\comodo\comodo internet security\translations\cmdres.serbian.lang
%ProgramFiles%\comodo\comodo internet security\translations\cmdres.spanish.lang
%ProgramFiles%\comodo\comodo internet security\translations\cmdres.czech.lang
%ProgramFiles%\comodo\comodo internet security\translations\cmdres.croatian.lang
%ProgramFiles%\comodo\comodo internet security\translations\cmdres.chinesetraditional.lang
%ProgramFiles%\comodo\comodo internet security\translations\1030.lang
%ProgramFiles%\comodo\comodo internet security\translations\1031.lang
%ProgramFiles%\comodo\comodo internet security\translations\1032.lang
%ProgramFiles%\comodo\comodo internet security\translations\1034.lang
%ProgramFiles%\comodo\comodo internet security\translations\1036.lang
%ProgramFiles%\comodo\comodo internet security\translations\1038.lang
%ProgramFiles%\comodo\comodo internet security\translations\1040.lang
%ProgramFiles%\comodo\comodo internet security\translations\1041.lang
%ProgramFiles%\comodo\comodo internet security\translations\1043.lang
%ProgramFiles%\comodo\comodo internet security\translations\1045.lang
%ProgramFiles%\comodo\comodo internet security\translations\1046.lang
%ProgramFiles%\comodo\comodo internet security\translations\1048.lang
%ProgramFiles%\comodo\comodo internet security\translations\1029.lang
%ProgramFiles%\comodo\comodo internet security\translations\1049.lang
%ProgramFiles%\comodo\comodo internet security\translations\1053.lang
%ProgramFiles%\comodo\comodo internet security\translations\1055.lang
%ProgramFiles%\comodo\comodo internet security\translations\1058.lang
%ProgramFiles%\comodo\comodo internet security\translations\1061.lang
%ProgramFiles%\comodo\comodo internet security\translations\1065.lang
%ProgramFiles%\comodo\comodo internet security\translations\1066.lang
%ProgramFiles%\comodo\comodo internet security\translations\2052.lang
%ProgramFiles%\comodo\comodo internet security\translations\3098.lang
%ProgramFiles%\comodo\comodo internet security\translations\cmdres.arabic.lang
%ProgramFiles%\comodo\comodo internet security\translations\cmdres.brazilian.lang
%ProgramFiles%\comodo\comodo internet security\translations\cmdres.bulgarian.lang
%ProgramFiles%\comodo\comodo internet security\translations\cmdres.chinese.lang
%ProgramFiles%\comodo\comodo internet security\translations\1050.lang
%ProgramFiles%\comodo\comodo internet security\translations\virtkiosk.czech.lang
%ProgramFiles%\comodo\comodo internet security\translations\virtkiosk.dutch.lang
%ProgramFiles%\comodo\comodo internet security\translations\virtkiosk.english.lang.template
%ProgramFiles%\comodo\comodo internet security\translations\virtkiosk.estonian.lang
%ProgramFiles%\comodo\comodo internet security\cmdinstall.exe
%ProgramFiles%\comodo\comodo internet security\cmdres.dll
%ProgramFiles%\comodo\comodo internet security\cmdwrhlp.dll
%ProgramFiles%\comodo\comodo internet security\themes\default.set
%ProgramFiles%\comodo\comodo internet security\eula.rtf
%ProgramFiles%\comodo\comodo internet security\themes\ilycia.set
%ProgramFiles%\comodo\comodo internet security\incompatsw.ini
%ProgramFiles%\comodo\comodo internet security\installer_init.xml
%ProgramFiles%\comodo\comodo internet security\installer_langdata.bin
%ProgramFiles%\comodo\comodo internet security\vkthemes\kioskthemearcadia.theme
%ProgramFiles%\comodo\comodo internet security\vkthemes\kioskthemeclassic.theme
%ProgramFiles%\comodo\comodo internet security\vkthemes\kioskthememodern.theme
%ProgramFiles%\comodo\comodo internet security\themes\lycia.set
%ProgramFiles%\comodo\comodo internet security\packages.xml
%ProgramFiles%\comodo\comodo internet security\recognizer.dll
%ProgramFiles%\comodo\comodo internet security\database\signers.tvt
%ALLUSERSPROFILE%\comodo\cis\regbackup\product.dat
%ProgramFiles%\comodo\comodo internet security\comodo client - security.cfgx
%ProgramFiles%\comodo\comodo internet security\comodo client - security managed.cfgx
%WINDIR%\temp\oldbe5f.tmp
%WINDIR%\security\logs\scecomp.log
%WINDIR%\temp\oldbecd.tmp
<DRIVERS>\setcb59.tmp
<DRIVERS>\setcb7a.tmp
%WINDIR%\temp\uddde5d.tmp
%WINDIR%\temp\uddde8c.tmp
%ALLUSERSPROFILE%\comodo\cis\lmdb\cmddata-lock
%ProgramFiles%\comodo\comodo internet security\cmdcomps.dll
%ProgramFiles%\comodo\comodo internet security\cmdagent.exe
%ProgramFiles%\comodo\comodo internet security\cmdcom32.dll
%ProgramFiles%\comodo\comodo internet security\cistray.exe
%ProgramFiles%\comodo\comodo internet security\translations\virtkiosk.french.lang
%ProgramFiles%\comodo\comodo internet security\translations\virtkiosk.german.lang
%ProgramFiles%\comodo\comodo internet security\translations\virtkiosk.greek.lang
%ProgramFiles%\comodo\comodo internet security\translations\virtkiosk.hungarian.lang
%ProgramFiles%\comodo\comodo internet security\translations\virtkiosk.italian.lang
%ProgramFiles%\comodo\comodo internet security\translations\virtkiosk.japanese.lang
%ProgramFiles%\comodo\comodo internet security\translations\virtkiosk.persian.lang
%ProgramFiles%\comodo\comodo internet security\translations\virtkiosk.polish.lang
%ProgramFiles%\comodo\comodo internet security\translations\virtkiosk.romanian.lang
%ProgramFiles%\comodo\comodo internet security\translations\virtkiosk.russian.lang
%ProgramFiles%\comodo\comodo internet security\translations\virtkiosk.serbian.lang
%ProgramFiles%\comodo\comodo internet security\translations\virtkiosk.spanish.lang
%ProgramFiles%\comodo\comodo internet security\translations\virtkiosk.swedish.lang
%ProgramFiles%\comodo\comodo internet security\translations\virtkiosk.turkish.lang
%ProgramFiles%\comodo\comodo internet security\translations\virtkiosk.ukrainian.lang
%ProgramFiles%\comodo\comodo internet security\translations\virtkiosk.vietnamese.lang
%ProgramFiles%\comodo\comodo internet security\cfpver.dat
%ProgramFiles%\comodo\comodo internet security\cavshell.dll
%ProgramFiles%\comodo\comodo internet security\cavwp.exe
%ProgramFiles%\comodo\comodo internet security\cavwpps.dll
%ProgramFiles%\comodo\comodo internet security\cfpconfg.exe
%ProgramFiles%\comodo\comodo internet security\cis.exe
%ProgramFiles%\comodo\comodo internet security\cisbf.exe
%ProgramFiles%\comodo\comodo internet security\cisbfps.dll
%ProgramFiles%\comodo\comodo internet security\cisevlog.dll
%ProgramFiles%\comodo\comodo internet security\msica.dll
%ProgramFiles%\comodo\comodo internet security\cisresc.dll
%ALLUSERSPROFILE%\comodo\cis\lmdb\cmdurl-lock
%ProgramFiles%\comodo\comodo internet security\translations\1028.lang
%ProgramFiles%\comodo\comodo internet security\translations\1026.lang
%ProgramFiles%\comodo\comodo internet security\translations\1025.lang
%ProgramFiles%\comodo\comodo internet security\vddata\appmanifest.xaml
%ALLUSERSPROFILE%\comodo\installer\bfe_vista.bin
%ALLUSERSPROFILE%\comodo\installer\bfe_win7.bin
%ALLUSERSPROFILE%\comodo\installer\bfe_win8.bin
%ProgramFiles%\comodo\comodo internet security\resources\block.html
%ProgramFiles%\comodo\comodo internet security\vddata\vduserdata\bin\blpcfgokakmgnkcojhhkbfbldkacnbeo.png
%ProgramFiles%\comodo\comodo internet security\vddata\vduserdata\bin\blpcfgokakmgnkcojhhkbfbldkacnbeo.xml
%ProgramFiles%\comodo\comodo internet security\vddata\vduserdata\images\bottombar.png
%ProgramFiles%\comodo\comodo internet security\vddata\vduserdata\images\btnshadow.png
%ProgramFiles%\comodo\comodo internet security\cmdvirth.exe
%ProgramFiles%\comodo\comodo internet security\vddata\vduserdata\bin\comodo_dragon.png
%ProgramFiles%\comodo\comodo internet security\vddata\vduserdata\bin\add_app.xml
%ProgramFiles%\comodo\comodo internet security\sounds\alert.wav
%ProgramFiles%\comodo\comodo internet security\vddata\vduserdata\bin\comodo_dragon.xml
%ProgramFiles%\comodo\comodo internet security\vddata\vduserdata\bin\ejjicmeblgpmajnghnpcppodonldlgfn.png
%ProgramFiles%\comodo\comodo internet security\vddata\vduserdata\bin\ejjicmeblgpmajnghnpcppodonldlgfn.xml
%ProgramFiles%\comodo\comodo internet security\vddata\vduserdata\images\flip_in.png
%ProgramFiles%\comodo\comodo internet security\vddata\vduserdata\images\flip_out.png
%ProgramFiles%\comodo\comodo internet security\vddata\vduserdata\images\flip_press.png
%ProgramFiles%\comodo\comodo internet security\vddata\vduserdata\bin\hbdpomandigafcibbmofojjchbcdagbl.png
%ProgramFiles%\comodo\comodo internet security\vddata\vduserdata\bin\hbdpomandigafcibbmofojjchbcdagbl.xml
%ProgramFiles%\comodo\comodo internet security\vddata\vduserdata\bin\icppfcnhkcmnfdhfhphakoifcfokfdhg.png
%ProgramFiles%\comodo\comodo internet security\vddata\vduserdata\bin\icppfcnhkcmnfdhfhphakoifcfokfdhg.xml
%ProgramFiles%\comodo\comodo internet security\vddata\vduserdata\bin\internet (chromodo).png
%ProgramFiles%\comodo\comodo internet security\vddata\vduserdata\bin\internet (chromodo).xml
%ProgramFiles%\comodo\comodo internet security\vddata\vduserdata\config.xml
%ProgramFiles%\comodo\comodo internet security\vddata\vduserdata\desklist.html
%ProgramFiles%\comodo\comodo internet security\vddata\vduserdata\bin\add_app.png
%ProgramFiles%\comodo\comodo internet security\scanners\white.cav
%ProgramFiles%\comodo\comodo internet security\scanners\unpack.cav
%TEMP%\7zipsfx.000\offlineinstaller.exe
%TEMP%\7zipsfx.000\itsm_offline.mst
%TEMP%\7zipsfx.000\profile.bin
%TEMP%\7zipsfx.000\enrollment_config.ini
%TEMP%\comodo internet security dbgout.log
%ProgramFiles%\comodo\comodo internet security\scanners\bases.cav
%ProgramFiles%\comodo\comodo internet security\scanners\fixbase.exe
%ProgramFiles%\comodo\comodo internet security\scanners\common.cav
%ProgramFiles%\comodo\comodo internet security\scanners\dosmz.cav
%ProgramFiles%\comodo\comodo internet security\scanners\dunpack.cav
%ProgramFiles%\comodo\comodo internet security\scanners\extra.cav
%ProgramFiles%\comodo\comodo internet security\scanners\fileid.cav
%TEMP%\7zipsfx.000\itsm.msi
%ProgramFiles%\comodo\comodo internet security\framework.dll
%ProgramFiles%\comodo\comodo internet security\scanners\heur.cav
%ProgramFiles%\comodo\comodo internet security\scanners\mach32.dll
%ProgramFiles%\comodo\comodo internet security\scanners\mem.cav
%ProgramFiles%\comodo\comodo internet security\scanners\pe.cav
%ProgramFiles%\comodo\comodo internet security\scanners\pe32.cav
%ProgramFiles%\comodo\comodo internet security\scanners\pkann.dll
%ProgramFiles%\comodo\comodo internet security\platform.dll
%ProgramFiles%\comodo\comodo internet security\scanners\script.cav
%ProgramFiles%\comodo\comodo internet security\scanners\scrtemu.cav
%ProgramFiles%\comodo\comodo internet security\signmgr.dll
%ProgramFiles%\comodo\comodo internet security\scanners\smart.cav
%ProgramFiles%\comodo\comodo internet security\scanners\unarch.cav
%ProgramFiles%\comodo\comodo internet security\scanners\gunpack.cav
%ProgramFiles%\comodo\comodo internet security\vddata\vduserdata\bin\lbfehkoinhhcknnbdgnnmjhiladcgbol.png
%ProgramFiles%\comodo\comodo internet security\vddata\vduserdata\bin\lbfehkoinhhcknnbdgnnmjhiladcgbol.xml
%ProgramFiles%\comodo\comodo internet security\vddata\vduserdata\bin\lfbgimoladefibpklnfmkpknadbklade.png
%ProgramFiles%\comodo\comodo internet security\vddata\vduserdata\bin\lfbgimoladefibpklnfmkpknadbklade.xml
%ProgramFiles%\comodo\comodo internet security\drivers\win10\cmdguard.sys
<DRIVERS>\cmdguard.sys
%ProgramFiles%\comodo\comodo internet security\drivers\win7\cmdguard.sys
%ProgramFiles%\comodo\comodo internet security\drivers\win8\cmdguard.sys
%ProgramFiles%\comodo\comodo internet security\drivers\win10\cmdhlp.cat
%ProgramFiles%\comodo\comodo internet security\drivers\win7\cmdhlp.cat
%ProgramFiles%\comodo\comodo internet security\drivers\win8\cmdhlp.cat
%ProgramFiles%\comodo\comodo internet security\drivers\win10\cmdhlp.inf
%ProgramFiles%\comodo\comodo internet security\drivers\win7\cmdhlp.inf
%ProgramFiles%\comodo\comodo internet security\drivers\win8\cmdhlp.inf
%ProgramFiles%\comodo\comodo internet security\drivers\win10\cmdhlp.sys
<DRIVERS>\cmdhlp.sys
%ProgramFiles%\comodo\comodo internet security\drivers\win7\cmdhlp.sys
%ProgramFiles%\comodo\comodo internet security\drivers\win8\cmdhlp.sys
%WINDIR%\syswow64\cmdvrt32.dll
<SYSTEM32>\cmdvrt64.dll
%WINDIR%\syswow64\guard32.dll
<SYSTEM32>\guard64.dll
%ProgramFiles%\comodo\comodo internet security\drivers\win10\inspect.cat
%ProgramFiles%\comodo\comodo internet security\drivers\win7\inspect.cat
%ProgramFiles%\comodo\comodo internet security\drivers\win8\inspect.cat
%ProgramFiles%\comodo\comodo internet security\drivers\win10\inspect.inf
%ProgramFiles%\comodo\comodo internet security\drivers\win7\inspect.inf
%ProgramFiles%\comodo\comodo internet security\drivers\win8\inspect.inf
%ProgramFiles%\comodo\comodo internet security\drivers\win10\inspect.sys
<DRIVERS>\inspect.sys
%ProgramFiles%\comodo\comodo internet security\drivers\win7\inspect.sys
%ProgramFiles%\comodo\comodo internet security\drivers\win8\cmdguard.inf
%ProgramFiles%\comodo\comodo internet security\drivers\win10\cmdguard.inf
%ProgramFiles%\comodo\comodo internet security\drivers\win7\cmdguard.inf
%ProgramFiles%\comodo\comodo internet security\drivers\win8\cmdguard.cat
%ProgramFiles%\comodo\comodo internet security\vddata\vduserdata\bin\lneaknkopdijkpnocmklfnjbeapigfbh.png
%ProgramFiles%\comodo\comodo internet security\vddata\vduserdata\bin\lneaknkopdijkpnocmklfnjbeapigfbh.xml
%ProgramFiles%\comodo\comodo internet security\vddata\vduserdata\bin\mkojhhiphdgeliplnclnbmdiofhgnimi.png
%ProgramFiles%\comodo\comodo internet security\vddata\vduserdata\bin\mkojhhiphdgeliplnclnbmdiofhgnimi.xml
%ProgramFiles%\comodo\comodo internet security\vddata\vduserdata\bin\mmimngoggfoobjdlefbcabngfnmieonb.png
%ProgramFiles%\comodo\comodo internet security\vddata\vduserdata\bin\mmimngoggfoobjdlefbcabngfnmieonb.xml
%ProgramFiles%\comodo\comodo internet security\vddata\vduserdata\bin\onlgmecjpnejhfeofkgbfgnmdlipdejb.png
%ProgramFiles%\comodo\comodo internet security\vddata\vduserdata\bin\onlgmecjpnejhfeofkgbfgnmdlipdejb.xml
%ProgramFiles%\comodo\comodo internet security\vddata\vduserdata\images\page_dot.png
%ProgramFiles%\comodo\comodo internet security\vddata\vduserdata\images\page_dot_on.png
%ProgramFiles%\comodo\comodo internet security\vddata\vduserdata\bin\pfpeapihoiogbcmdmnibeplnikfnhoge.png
%ProgramFiles%\comodo\comodo internet security\vddata\vduserdata\bin\pfpeapihoiogbcmdmnibeplnikfnhoge.xml
%ProgramFiles%\comodo\comodo internet security\vddata\vduserdata\bin\pjkljhegncpnkpknbcohdijeoejaedia.png
%ProgramFiles%\comodo\comodo internet security\vddata\vduserdata\bin\pjkljhegncpnkpknbcohdijeoejaedia.xml
%ProgramFiles%\comodo\comodo internet security\resources\redirect.html
%ProgramFiles%\comodo\comodo internet security\vddata\vduserdata\images\remove.png
%ProgramFiles%\comodo\comodo internet security\cmdhtml.dll
%ProgramFiles%\comodo\comodo internet security\7za.dll
%ProgramFiles%\comodo\comodo internet security\virtkiosk.exe
%ProgramFiles%\comodo\comodo internet security\vddata\vkhlp.dll
<SYSTEM32>\cmdcsr.dll
%ProgramFiles%\comodo\comodo internet security\drivers\win10\cmderd.sys
<DRIVERS>\cmderd.sys
%ProgramFiles%\comodo\comodo internet security\drivers\win7\cmderd.sys
%ProgramFiles%\comodo\comodo internet security\drivers\win8\cmderd.sys
%ProgramFiles%\comodo\comodo internet security\drivers\win10\cmdguard.cat
%ProgramFiles%\comodo\comodo internet security\drivers\win7\cmdguard.cat
%ProgramFiles%\comodo\comodo internet security\drivers\win8\inspect.sys
%ALLUSERSPROFILE%\comodo\cis\lmdb\vcact-lock

Удаляет следующие файлы

<DRIVERS>\cmderd.sys
<DRIVERS>\cmdguard.sys
%WINDIR%\temp\oldbecd.tmp
%WINDIR%\temp\oldbe5f.tmp
%WINDIR%\temp\uddde5d.tmp
%WINDIR%\temp\uddde8c.tmp
%ProgramFiles%\comodo\comodo internet security\database\signers.tvt

Изменяет следующие файлы

%LOCALAPPDATA%\microsoft\windows\explorer\explorerstartuplog_runonce.etl

Подменяет следующие файлы

<DRIVERS>\cmderd.sys
<DRIVERS>\cmdguard.sys

Сетевая активность

Подключается к

'microsoft.com':80

TCP

Запросы HTTP GET

http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt

UDP

DNS ASK microsoft.com

Другое

Создает и запускает на исполнение

'%TEMP%\7zipsfx.000\offlineinstaller.exe' /fw /q /ra suppress /rm "Enter a message that the device owner will get before the reboot" /rt 300
'%WINDIR%\installer\msi5d10.tmp' -rptype 0 -descr "Installing COMODO Client - Security" -logfile "%TEMP%\COMODO Internet Security dbgout.log"
'%WINDIR%\installer\msi5d10.tmp' -rptype 0 -descr "Installing COMODO Client - Security" -logfile "%TEMP%\COMODO Internet Security dbgout.log" -working
'%ProgramFiles%\comodo\comodo internet security\cfpconfg.exe' --installCertificates
'%ProgramFiles%\comodo\comodo internet security\cisbf.exe' /RegServer
'%ProgramFiles%\comodo\comodo internet security\cfpconfg.exe' --updateHtml
'%ProgramFiles%\comodo\comodo internet security\cfpconfg.exe' --langID 1033 --createConfig "active=endpt;dplus=opt;esm=1;av=1;fw=1;cesfw=1;cesav=1;cessandbox=1;free=1;noalerts=1;cloud=1;sendstats=1;configfile=;fwstate=0;dfstate=0;avstate=0;bbstate=0;avser...
'%ProgramFiles%\comodo\comodo internet security\cfpconfg.exe' --upgradeBackuped=""
'%ProgramFiles%\comodo\comodo internet security\cfpconfg.exe' --windowsDefence fw-df-
'%ProgramFiles%\comodo\comodo internet security\cmdagent.exe'
'%ProgramFiles%\comodo\comodo internet security\cmdinstall.exe' -type local -log -camevent autotrial-expired
'%ProgramFiles%\comodo\comodo internet security\cavwp.exe' /ModeAvMonitor -Embedding
'%ProgramFiles%\comodo\comodo internet security\cmdinstall.exe' -log -type "local" -camevent "autotrial-expired"

Запускает на исполнение

'<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles%\COMODO\COMODO Internet Security\cisresc.dll"
'<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles%\COMODO\COMODO Internet Security\cisbfps.dll"
'<SYSTEM32>\runonce.exe' -r
'<SYSTEM32>\grpconv.exe' -o
'<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles%\COMODO\COMODO Internet Security\cavshell.dll"
'%WINDIR%\syswow64\msiexec.exe' /Y "%ProgramFiles%\COMODO\COMODO Internet Security\cmdcom32.dll"
'<SYSTEM32>\msiexec.exe' /Y "%ProgramFiles%\COMODO\COMODO Internet Security\cmdcomps.dll"
'<SYSTEM32>\msiexec.exe' /Y "%ProgramFiles%\COMODO\COMODO Internet Security\cavwpps.dll"

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней