Техническая информация
Вредоносные функции:
Создает и запускает на исполнение:
- '%TEMP%\is-QST9B.tmp\AcPro.tmp' /SL5="$40092,185455,54272,%TEMP%\AcPro.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
- '%PROGRAM_FILES%\AutocompletePro\InstTracker.exe' -install -cs:true -si:7999 -ver:1.1 -dir:"%PROGRAM_FILES%\AutocompletePro"
- '%TEMP%\WFSetup.exe'
- '%TEMP%\AcPro.exe' /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
Запускает на исполнение:
- '<SYSTEM32>\regsvr32.exe' /s AutocompletePro.dll
Изменяет следующие настройки браузера Windows Internet Explorer:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '2202' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '2105' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1001' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '2301' = '00000003'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '2104' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1001' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1004' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '2103' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '2000' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1804' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1800' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1A04' = '00000003'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1806' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1609' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1201' = '00000003'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1004' = '00000003'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1406' = '00000003'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1206' = '00000003'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '120A' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1209' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1405' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1400' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1208' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1200' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '2201' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1206' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1201' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1804' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1800' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1A04' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1806' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '160A' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1407' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1406' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1609' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1607' = '00000000'
Изменения в файловой системе:
Создает следующие файлы:
- %PROGRAM_FILES%\AutocompletePro\support@predictad.com\chrome\content\is-BNSJM.tmp
- %PROGRAM_FILES%\AutocompletePro\support@predictad.com\chrome\content\is-URV0L.tmp
- %PROGRAM_FILES%\AutocompletePro\support@predictad.com\is-1VCTU.tmp
- %PROGRAM_FILES%\AutocompletePro\is-8VNRI.tmp
- %PROGRAM_FILES%\AutocompletePro\support@predictad.com\is-R41A8.tmp
- %PROGRAM_FILES%\AutocompletePro\support@predictad.com\chrome\content\is-28N2N.tmp
- %PROGRAM_FILES%\AutocompletePro\is-F2RBR.tmp
- %PROGRAM_FILES%\AutocompletePro\unins000.dat
- %PROGRAM_FILES%\AutocompletePro\is-4BJOK.tmp
- %PROGRAM_FILES%\AutocompletePro\support@predictad.com\defaults\preferences\is-JNV59.tmp
- %PROGRAM_FILES%\AutocompletePro\is-0IHRK.tmp
- %TEMP%\aut2.tmp
- %TEMP%\AcPro.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\click[1]
- %TEMP%\aut1.tmp
- %TEMP%\WFSetup.exe
- %TEMP%\is-QST9B.tmp\AcPro.tmp
- %TEMP%\is-T07Q5.tmp\IssProcLanguage.ini
- %PROGRAM_FILES%\AutocompletePro\is-H329M.tmp
- %TEMP%\is-T07Q5.tmp\IssProc.dll
- %TEMP%\is-T07Q5.tmp\_isetup\_RegDLL.tmp
- %TEMP%\is-T07Q5.tmp\_isetup\_shfoldr.dll
Удаляет следующие файлы:
- %TEMP%\is-T07Q5.tmp\_isetup\_RegDLL.tmp
- %TEMP%\is-T07Q5.tmp\IssProcLanguage.ini
- %TEMP%\is-QST9B.tmp\AcPro.tmp
- %TEMP%\is-T07Q5.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-T07Q5.tmp\IssProc.dll
- %TEMP%\aut2.tmp
- %TEMP%\aut1.tmp
- %TEMP%\AcPro.exe
- %TEMP%\WFSetup.exe
Перемещает следующие файлы:
- %PROGRAM_FILES%\AutocompletePro\support@predictad.com\defaults\preferences\is-JNV59.tmp в %PROGRAM_FILES%\AutocompletePro\support@predictad.com\defaults\preferences\predictad.js
- %PROGRAM_FILES%\AutocompletePro\support@predictad.com\chrome\content\is-28N2N.tmp в %PROGRAM_FILES%\AutocompletePro\support@predictad.com\chrome\content\options.xul
- %PROGRAM_FILES%\AutocompletePro\is-0IHRK.tmp в %PROGRAM_FILES%\AutocompletePro\InstTracker.exe
- %PROGRAM_FILES%\AutocompletePro\is-F2RBR.tmp в %PROGRAM_FILES%\AutocompletePro\TaskScheduler.dll
- %PROGRAM_FILES%\AutocompletePro\is-4BJOK.tmp в %PROGRAM_FILES%\AutocompletePro\AcRemoteUpdate.exe
- %PROGRAM_FILES%\AutocompletePro\support@predictad.com\chrome\content\is-URV0L.tmp в %PROGRAM_FILES%\AutocompletePro\support@predictad.com\chrome\content\options.js
- %PROGRAM_FILES%\AutocompletePro\is-8VNRI.tmp в %PROGRAM_FILES%\AutocompletePro\AutocompletePro.dll
- %PROGRAM_FILES%\AutocompletePro\is-H329M.tmp в %PROGRAM_FILES%\AutocompletePro\unins000.exe
- %PROGRAM_FILES%\AutocompletePro\support@predictad.com\is-R41A8.tmp в %PROGRAM_FILES%\AutocompletePro\support@predictad.com\chrome.manifest
- %PROGRAM_FILES%\AutocompletePro\support@predictad.com\chrome\content\is-BNSJM.tmp в %PROGRAM_FILES%\AutocompletePro\support@predictad.com\chrome\content\browserOverlay.xul
- %PROGRAM_FILES%\AutocompletePro\support@predictad.com\is-1VCTU.tmp в %PROGRAM_FILES%\AutocompletePro\support@predictad.com\install.rdf
Сетевая активность:
Подключается к:
- 'wp#d':80
- 'in#####.autocompletepro.com':80
- 'localhost':1035
- 'fb##c.com':80
TCP:
Запросы HTTP GET:
- in#####.autocompletepro.com/installHandler/?ac############################
- wp#d/wpad.dat
- fb##c.com/click/?s=#############################
UDP:
- DNS ASK in#####.autocompletepro.com
- DNS ASK wp#d
- DNS ASK fb##c.com
Другое:
Ищет следующие окна:
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: '' WindowName: ''
