Техническая информация
Вредоносные функции
Регистрирует BHO
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3B66830A-5CBF-F012-8A65-83C52B903D17}]
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\410f1012\g7pkp3.dat
- C:\users\administrator\appdata\local\torch\user data\default\extensions\dpklghdpeggcnnbncaejbglpkobflknh\2.1\lsdb.js
- C:\users\administrator\appdata\local\torch\user data\default\extensions\dpklghdpeggcnnbncaejbglpkobflknh\2.1\evieus_.js
- C:\users\administrator\appdata\local\torch\user data\default\extensions\dpklghdpeggcnnbncaejbglpkobflknh\2.1\content.js
- C:\users\administrator\appdata\local\torch\user data\default\extensions\dpklghdpeggcnnbncaejbglpkobflknh\2.1\background.html
- %LOCALAPPDATA%\google\chrome sxs\user data\default\extensions\dpklghdpeggcnnbncaejbglpkobflknh\2.1\manifest.json
- %LOCALAPPDATA%\google\chrome sxs\user data\default\extensions\dpklghdpeggcnnbncaejbglpkobflknh\2.1\lsdb.js
- %LOCALAPPDATA%\google\chrome sxs\user data\default\extensions\dpklghdpeggcnnbncaejbglpkobflknh\2.1\evieus_.js
- %LOCALAPPDATA%\google\chrome sxs\user data\default\extensions\dpklghdpeggcnnbncaejbglpkobflknh\2.1\content.js
- %LOCALAPPDATA%\google\chrome sxs\user data\default\extensions\dpklghdpeggcnnbncaejbglpkobflknh\2.1\background.html
- C:\users\homegroupuser$\appdata\local\google\chrome sxs\user data\default\extensions\dpklghdpeggcnnbncaejbglpkobflknh\2.1\manifest.json
- C:\users\homegroupuser$\appdata\local\google\chrome sxs\user data\default\extensions\dpklghdpeggcnnbncaejbglpkobflknh\2.1\lsdb.js
- C:\users\homegroupuser$\appdata\local\google\chrome sxs\user data\default\extensions\dpklghdpeggcnnbncaejbglpkobflknh\2.1\evieus_.js
- C:\users\homegroupuser$\appdata\local\google\chrome sxs\user data\default\extensions\dpklghdpeggcnnbncaejbglpkobflknh\2.1\content.js
- C:\users\administrator\appdata\local\torch\user data\default\extensions\dpklghdpeggcnnbncaejbglpkobflknh\2.1\manifest.json
- C:\users\homegroupuser$\appdata\local\google\chrome sxs\user data\default\extensions\dpklghdpeggcnnbncaejbglpkobflknh\2.1\background.html
- C:\users\guest\appdata\local\google\chrome sxs\user data\default\extensions\dpklghdpeggcnnbncaejbglpkobflknh\2.1\lsdb.js
- C:\users\guest\appdata\local\google\chrome sxs\user data\default\extensions\dpklghdpeggcnnbncaejbglpkobflknh\2.1\evieus_.js
- C:\users\guest\appdata\local\google\chrome sxs\user data\default\extensions\dpklghdpeggcnnbncaejbglpkobflknh\2.1\content.js
- C:\users\guest\appdata\local\google\chrome sxs\user data\default\extensions\dpklghdpeggcnnbncaejbglpkobflknh\2.1\background.html
- C:\users\aspnet\appdata\local\google\chrome sxs\user data\default\extensions\dpklghdpeggcnnbncaejbglpkobflknh\2.1\manifest.json
- C:\users\aspnet\appdata\local\google\chrome sxs\user data\default\extensions\dpklghdpeggcnnbncaejbglpkobflknh\2.1\lsdb.js
- C:\users\aspnet\appdata\local\google\chrome sxs\user data\default\extensions\dpklghdpeggcnnbncaejbglpkobflknh\2.1\evieus_.js
- C:\users\aspnet\appdata\local\google\chrome sxs\user data\default\extensions\dpklghdpeggcnnbncaejbglpkobflknh\2.1\content.js
- C:\users\aspnet\appdata\local\google\chrome sxs\user data\default\extensions\dpklghdpeggcnnbncaejbglpkobflknh\2.1\background.html
- C:\users\administrator\appdata\local\google\chrome sxs\user data\default\extensions\dpklghdpeggcnnbncaejbglpkobflknh\2.1\manifest.json
- C:\users\administrator\appdata\local\google\chrome sxs\user data\default\extensions\dpklghdpeggcnnbncaejbglpkobflknh\2.1\lsdb.js
- C:\users\administrator\appdata\local\google\chrome sxs\user data\default\extensions\dpklghdpeggcnnbncaejbglpkobflknh\2.1\evieus_.js
- C:\users\administrator\appdata\local\google\chrome sxs\user data\default\extensions\dpklghdpeggcnnbncaejbglpkobflknh\2.1\content.js
- C:\users\guest\appdata\local\google\chrome sxs\user data\default\extensions\dpklghdpeggcnnbncaejbglpkobflknh\2.1\manifest.json
- %LOCALAPPDATA%\torch\user data\default\extensions\dpklghdpeggcnnbncaejbglpkobflknh\2.1\content.js
- %ALLUSERSPROFILE%\saveclicker\g7pkp3.dat
- C:\users\aspnet\appdata\local\torch\user data\default\extensions\dpklghdpeggcnnbncaejbglpkobflknh\2.1\evieus_.js
- %ALLUSERSPROFILE%\saveclicker\g7pkp3.exe
- %LOCALAPPDATA%\packages\windows_ie_ac_001\ac\{3b66830a-5cbf-f012-8a65-83c52b903d17}\saveclicker.2.9.dat
- %ProgramFiles(x86)%\saveclicker\q0jz5.x64.dll
- %LOCALAPPDATA%low\{3b66830a-5cbf-f012-8a65-83c52b903d17}\saveclicker.2.9.dat
- %ProgramFiles(x86)%\saveclicker\q0jz5.dat
- %ProgramFiles(x86)%\saveclicker\q0jz5.tlb
- %ProgramFiles(x86)%\saveclicker\q0jz5.dll
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\staged\mc.crdwwb@ayi-obcu.edu\install.rdf
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\staged\mc.crdwwb@ayi-obcu.edu\content\bg.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\staged\mc.crdwwb@ayi-obcu.edu\chrome.manifest
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\staged\mc.crdwwb@ayi-obcu.edu\bootstrap.js
- %LOCALAPPDATA%\torch\user data\default\extensions\dpklghdpeggcnnbncaejbglpkobflknh\2.1\manifest.json
- %LOCALAPPDATA%\torch\user data\default\extensions\dpklghdpeggcnnbncaejbglpkobflknh\2.1\lsdb.js
- C:\users\administrator\appdata\local\google\chrome sxs\user data\default\extensions\dpklghdpeggcnnbncaejbglpkobflknh\2.1\background.html
- %LOCALAPPDATA%\torch\user data\default\extensions\dpklghdpeggcnnbncaejbglpkobflknh\2.1\evieus_.js
- %LOCALAPPDATA%\torch\user data\default\extensions\dpklghdpeggcnnbncaejbglpkobflknh\2.1\background.html
- C:\users\homegroupuser$\appdata\local\torch\user data\default\extensions\dpklghdpeggcnnbncaejbglpkobflknh\2.1\manifest.json
- C:\users\homegroupuser$\appdata\local\torch\user data\default\extensions\dpklghdpeggcnnbncaejbglpkobflknh\2.1\lsdb.js
- C:\users\homegroupuser$\appdata\local\torch\user data\default\extensions\dpklghdpeggcnnbncaejbglpkobflknh\2.1\evieus_.js
- C:\users\homegroupuser$\appdata\local\torch\user data\default\extensions\dpklghdpeggcnnbncaejbglpkobflknh\2.1\content.js
- C:\users\homegroupuser$\appdata\local\torch\user data\default\extensions\dpklghdpeggcnnbncaejbglpkobflknh\2.1\background.html
- C:\users\guest\appdata\local\torch\user data\default\extensions\dpklghdpeggcnnbncaejbglpkobflknh\2.1\manifest.json
- C:\users\guest\appdata\local\torch\user data\default\extensions\dpklghdpeggcnnbncaejbglpkobflknh\2.1\lsdb.js
- C:\users\guest\appdata\local\torch\user data\default\extensions\dpklghdpeggcnnbncaejbglpkobflknh\2.1\evieus_.js
- C:\users\guest\appdata\local\torch\user data\default\extensions\dpklghdpeggcnnbncaejbglpkobflknh\2.1\content.js
- C:\users\guest\appdata\local\torch\user data\default\extensions\dpklghdpeggcnnbncaejbglpkobflknh\2.1\background.html
- C:\users\aspnet\appdata\local\torch\user data\default\extensions\dpklghdpeggcnnbncaejbglpkobflknh\2.1\manifest.json
- C:\users\aspnet\appdata\local\torch\user data\default\extensions\dpklghdpeggcnnbncaejbglpkobflknh\2.1\lsdb.js
- C:\users\aspnet\appdata\local\torch\user data\default\extensions\dpklghdpeggcnnbncaejbglpkobflknh\2.1\background.html
- C:\users\aspnet\appdata\local\torch\user data\default\extensions\dpklghdpeggcnnbncaejbglpkobflknh\2.1\content.js
- %LOCALAPPDATA%\comodo\dragon\user data\default\extensions\dpklghdpeggcnnbncaejbglpkobflknh\2.1\manifest.json
- C:\users\homegroupuser$\appdata\local\google\chrome\user data\default\extensions\dpklghdpeggcnnbncaejbglpkobflknh\2.1\evieus_.js
- C:\users\guest\appdata\local\google\chrome\user data\default\extensions\dpklghdpeggcnnbncaejbglpkobflknh\2.1\manifest.json
- C:\users\guest\appdata\local\google\chrome\user data\default\extensions\dpklghdpeggcnnbncaejbglpkobflknh\2.1\lsdb.js
- C:\users\guest\appdata\local\google\chrome\user data\default\extensions\dpklghdpeggcnnbncaejbglpkobflknh\2.1\evieus_.js
- C:\users\guest\appdata\local\google\chrome\user data\default\extensions\dpklghdpeggcnnbncaejbglpkobflknh\2.1\content.js
- C:\users\guest\appdata\local\google\chrome\user data\default\extensions\dpklghdpeggcnnbncaejbglpkobflknh\2.1\background.html
- C:\users\aspnet\appdata\local\google\chrome\user data\default\extensions\dpklghdpeggcnnbncaejbglpkobflknh\2.1\manifest.json
- C:\users\aspnet\appdata\local\google\chrome\user data\default\extensions\dpklghdpeggcnnbncaejbglpkobflknh\2.1\lsdb.js
- C:\users\aspnet\appdata\local\google\chrome\user data\default\extensions\dpklghdpeggcnnbncaejbglpkobflknh\2.1\evieus_.js
- C:\users\aspnet\appdata\local\google\chrome\user data\default\extensions\dpklghdpeggcnnbncaejbglpkobflknh\2.1\content.js
- C:\users\aspnet\appdata\local\google\chrome\user data\default\extensions\dpklghdpeggcnnbncaejbglpkobflknh\2.1\background.html
- C:\users\administrator\appdata\local\google\chrome\user data\default\extensions\dpklghdpeggcnnbncaejbglpkobflknh\2.1\manifest.json
- C:\users\administrator\appdata\local\google\chrome\user data\default\extensions\dpklghdpeggcnnbncaejbglpkobflknh\2.1\lsdb.js
- C:\users\administrator\appdata\local\google\chrome\user data\default\extensions\dpklghdpeggcnnbncaejbglpkobflknh\2.1\evieus_.js
- C:\users\homegroupuser$\appdata\local\google\chrome\user data\default\extensions\dpklghdpeggcnnbncaejbglpkobflknh\2.1\background.html
- C:\users\administrator\appdata\local\google\chrome\user data\default\extensions\dpklghdpeggcnnbncaejbglpkobflknh\2.1\content.js
- %TEMP%\410f1012\dpklghdpeggcnnbncaejbglpkobflknh\evieus_.js
- %TEMP%\410f1012\dpklghdpeggcnnbncaejbglpkobflknh\background.html
- %TEMP%\410f1012\dpklghdpeggcnnbncaejbglpkobflknh\manifest.json
- %TEMP%\410f1012\dpklghdpeggcnnbncaejbglpkobflknh\content.js
- %TEMP%\410f1012\dpklghdpeggcnnbncaejbglpkobflknh\lsdb.js
- %TEMP%\410f1012\mc.crdwwb@ayi-obcu.edu\bootstrap.js
- %TEMP%\410f1012\mc.crdwwb@ayi-obcu.edu\chrome.manifest
- %TEMP%\410f1012\mc.crdwwb@ayi-obcu.edu\install.rdf
- %TEMP%\410f1012\mc.crdwwb@ayi-obcu.edu\content\bg.js
- %TEMP%\410f1012\q0jz5.dll
- %TEMP%\410f1012\q0jz5.tlb
- %TEMP%\410f1012\q0jz5.x64.dll
- %TEMP%\410f1012\g7pkp3.exe
- C:\users\administrator\appdata\local\google\chrome\user data\default\extensions\dpklghdpeggcnnbncaejbglpkobflknh\2.1\background.html
- C:\users\aspnet\appdata\local\comodo\dragon\user data\default\extensions\dpklghdpeggcnnbncaejbglpkobflknh\2.1\evieus_.js
- %LOCALAPPDATA%\comodo\dragon\user data\default\extensions\dpklghdpeggcnnbncaejbglpkobflknh\2.1\evieus_.js
- C:\users\homegroupuser$\appdata\local\google\chrome\user data\default\extensions\dpklghdpeggcnnbncaejbglpkobflknh\2.1\lsdb.js
- %LOCALAPPDATA%\comodo\dragon\user data\default\extensions\dpklghdpeggcnnbncaejbglpkobflknh\2.1\content.js
- %LOCALAPPDATA%\comodo\dragon\user data\default\extensions\dpklghdpeggcnnbncaejbglpkobflknh\2.1\background.html
- C:\users\homegroupuser$\appdata\local\comodo\dragon\user data\default\extensions\dpklghdpeggcnnbncaejbglpkobflknh\2.1\manifest.json
- C:\users\homegroupuser$\appdata\local\comodo\dragon\user data\default\extensions\dpklghdpeggcnnbncaejbglpkobflknh\2.1\lsdb.js
- C:\users\homegroupuser$\appdata\local\comodo\dragon\user data\default\extensions\dpklghdpeggcnnbncaejbglpkobflknh\2.1\evieus_.js
- C:\users\homegroupuser$\appdata\local\comodo\dragon\user data\default\extensions\dpklghdpeggcnnbncaejbglpkobflknh\2.1\content.js
- C:\users\homegroupuser$\appdata\local\comodo\dragon\user data\default\extensions\dpklghdpeggcnnbncaejbglpkobflknh\2.1\background.html
- C:\users\guest\appdata\local\comodo\dragon\user data\default\extensions\dpklghdpeggcnnbncaejbglpkobflknh\2.1\manifest.json
- C:\users\guest\appdata\local\comodo\dragon\user data\default\extensions\dpklghdpeggcnnbncaejbglpkobflknh\2.1\lsdb.js
- C:\users\guest\appdata\local\comodo\dragon\user data\default\extensions\dpklghdpeggcnnbncaejbglpkobflknh\2.1\evieus_.js
- C:\users\guest\appdata\local\comodo\dragon\user data\default\extensions\dpklghdpeggcnnbncaejbglpkobflknh\2.1\content.js
- C:\users\guest\appdata\local\comodo\dragon\user data\default\extensions\dpklghdpeggcnnbncaejbglpkobflknh\2.1\background.html
- C:\users\aspnet\appdata\local\comodo\dragon\user data\default\extensions\dpklghdpeggcnnbncaejbglpkobflknh\2.1\manifest.json
- %LOCALAPPDATA%\comodo\dragon\user data\default\extensions\dpklghdpeggcnnbncaejbglpkobflknh\2.1\lsdb.js
- C:\users\aspnet\appdata\local\comodo\dragon\user data\default\extensions\dpklghdpeggcnnbncaejbglpkobflknh\2.1\lsdb.js
- C:\users\aspnet\appdata\local\comodo\dragon\user data\default\extensions\dpklghdpeggcnnbncaejbglpkobflknh\2.1\content.js
- C:\users\aspnet\appdata\local\comodo\dragon\user data\default\extensions\dpklghdpeggcnnbncaejbglpkobflknh\2.1\background.html
- C:\users\administrator\appdata\local\comodo\dragon\user data\default\extensions\dpklghdpeggcnnbncaejbglpkobflknh\2.1\manifest.json
- C:\users\administrator\appdata\local\comodo\dragon\user data\default\extensions\dpklghdpeggcnnbncaejbglpkobflknh\2.1\lsdb.js
- C:\users\administrator\appdata\local\comodo\dragon\user data\default\extensions\dpklghdpeggcnnbncaejbglpkobflknh\2.1\evieus_.js
- C:\users\administrator\appdata\local\comodo\dragon\user data\default\extensions\dpklghdpeggcnnbncaejbglpkobflknh\2.1\content.js
- C:\users\administrator\appdata\local\comodo\dragon\user data\default\extensions\dpklghdpeggcnnbncaejbglpkobflknh\2.1\background.html
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\dpklghdpeggcnnbncaejbglpkobflknh\2.1\manifest.json
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\dpklghdpeggcnnbncaejbglpkobflknh\2.1\lsdb.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\dpklghdpeggcnnbncaejbglpkobflknh\2.1\evieus_.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\dpklghdpeggcnnbncaejbglpkobflknh\2.1\content.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\dpklghdpeggcnnbncaejbglpkobflknh\2.1\background.html
- C:\users\homegroupuser$\appdata\local\google\chrome\user data\default\extensions\dpklghdpeggcnnbncaejbglpkobflknh\2.1\manifest.json
- C:\users\homegroupuser$\appdata\local\google\chrome\user data\default\extensions\dpklghdpeggcnnbncaejbglpkobflknh\2.1\content.js
- %ALLUSERSPROFILE%\aeb4eed34ff857cd\{e96338dc-1468-4918-8ec2-8454bffc5025}
Удаляет следующие файлы
- %TEMP%\410f1012\g7pkp3.dat
- %TEMP%\410f1012\g7pkp3.exe
- %TEMP%\410f1012\q0jz5.x64.dll
- %TEMP%\410f1012\q0jz5.tlb
- %TEMP%\410f1012\q0jz5.dll
- %TEMP%\410f1012\mc.crdwwb@ayi-obcu.edu\content\bg.js
- %TEMP%\410f1012\mc.crdwwb@ayi-obcu.edu\install.rdf
- %TEMP%\410f1012\mc.crdwwb@ayi-obcu.edu\chrome.manifest
- %TEMP%\410f1012\mc.crdwwb@ayi-obcu.edu\bootstrap.js
- %TEMP%\410f1012\dpklghdpeggcnnbncaejbglpkobflknh\lsdb.js
- %TEMP%\410f1012\dpklghdpeggcnnbncaejbglpkobflknh\content.js
- %TEMP%\410f1012\dpklghdpeggcnnbncaejbglpkobflknh\manifest.json
- %TEMP%\410f1012\dpklghdpeggcnnbncaejbglpkobflknh\background.html
- %TEMP%\410f1012\dpklghdpeggcnnbncaejbglpkobflknh\evieus_.js
Изменяет следующие файлы
- %LOCALAPPDATA%\google\chrome\user data\default\preferences
Другое
Ищет следующие окна
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Создает и запускает на исполнение
- '%TEMP%\410f1012\g7pkp3.exe'
Запускает на исполнение
- '%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\SaveClicker\Q0jz5.x64.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles(x86)%\SaveClicker\Q0jz5.x64.dll"
