Program.Unwanted.416

Техническая информация

Изменения в файловой системе

Создает следующие файлы

%ProgramFiles%\mozilla firefox\updated\firefox.exe
%ProgramFiles%\mozilla firefox\updated\api-ms-win-crt-process-l1-1-0.dll
%ProgramFiles%\mozilla firefox\updated\api-ms-win-crt-private-l1-1-0.dll
%ProgramFiles%\mozilla firefox\updated\api-ms-win-crt-multibyte-l1-1-0.dll
%ProgramFiles%\mozilla firefox\updated\api-ms-win-crt-math-l1-1-0.dll
%ProgramFiles%\mozilla firefox\updated\api-ms-win-crt-locale-l1-1-0.dll
%ProgramFiles%\mozilla firefox\updated\api-ms-win-crt-heap-l1-1-0.dll
%ProgramFiles%\mozilla firefox\updated\api-ms-win-crt-filesystem-l1-1-0.dll
%ProgramFiles%\mozilla firefox\updated\api-ms-win-crt-environment-l1-1-0.dll
%ProgramFiles%\mozilla firefox\updated\api-ms-win-crt-convert-l1-1-0.dll
%ProgramFiles%\mozilla firefox\updated\api-ms-win-core-timezone-l1-1-0.dll
%LOCALAPPDATA%\anvir\detectpr.dat
%ProgramFiles%\mozilla firefox\updated\api-ms-win-core-synch-l1-2-0.dll
%ProgramFiles%\mozilla firefox\updated\api-ms-win-core-processthreads-l1-1-1.dll
%ProgramFiles%\mozilla firefox\updated\api-ms-win-core-localization-l1-2-0.dll
%ProgramFiles%\mozilla firefox\updated\api-ms-win-core-file-l2-1-0.dll
%ProgramFiles%\mozilla firefox\updated\api-ms-win-core-file-l1-2-0.dll
%ProgramFiles%\mozilla firefox\updated\accessiblemarshal.dll
%ALLUSERSPROFILE%\mozilla\updates\308046b0af4a39cb\active-update.xml.tmp
%LOCALAPPDATA%\anvir\startup.dat
%APPDATA%\microsoft\crypto\rsa\s-1-5-21-3150914307-1777937420-491476919-1000\83aa4cc77f591dfc2374580bbd95f6ba_d99ef00b-ccd3-4f1d-9980-90ac453b0b47
%ProgramFiles%\mozilla firefox\updated\api-ms-win-crt-runtime-l1-1-0.dll
%ProgramFiles%\mozilla firefox\updated\api-ms-win-crt-conio-l1-1-0.dll
%ProgramFiles%\mozilla firefox\updated\api-ms-win-crt-stdio-l1-1-0.dll
%ProgramFiles%\mozilla firefox\updated\crashreporter.exe
%ProgramFiles%\mozilla firefox\updated\firefox.visualelementsmanifest.xml
%ProgramFiles%\mozilla firefox\updated\dependentlibs.list
%ProgramFiles%\mozilla firefox\updated\defaultagent_localized.ini
%ProgramFiles%\mozilla firefox\updated\defaultagent.ini
%ProgramFiles%\mozilla firefox\updated\default-browser-agent.exe
%ProgramFiles%\mozilla firefox\updated\d3dcompiler_47.dll
%TEMP%\anvir\portable.txt
%TEMP%\anvir\anvir.ini
%ProgramFiles%\mozilla firefox\updated\crashreporter.ini
%TEMP%\anvir\anvir.exe
%ProgramFiles%\mozilla firefox\updated\api-ms-win-crt-time-l1-1-0.dll
%TEMP%\anvir\anvirrunserv.exe
%TEMP%\anvir\virustotalupload.exe
%TEMP%\anvir\anvirhook65.dll
%TEMP%\anvir\msi.dll
%ProgramFiles%\mozilla firefox\updated\browser\features\pictureinpicture@mozilla.org.xpi
%ProgramFiles%\mozilla firefox\updated\browser\visualelements\privatebrowsing_70.png
%ProgramFiles%\mozilla firefox\updated\browser\visualelements\privatebrowsing_150.png
%ProgramFiles%\mozilla firefox\updated\application.ini
%ProgramFiles%\mozilla firefox\updated\api-ms-win-crt-utility-l1-1-0.dll
%ProgramFiles%\mozilla firefox\updated\api-ms-win-crt-string-l1-1-0.dll
%LOCALAPPDATA%low\sun\java\deployment\security\update.securitypack.timestamp

Изменяет следующие файлы

%ALLUSERSPROFILE%\mozilla\updates\308046b0af4a39cb\updates\0\update.log
%ProgramFiles%\mozilla firefox\updated\browser\omni.ja
%ProgramFiles%\mozilla firefox\updated\browser\features\webcompat@mozilla.org.xpi
%ProgramFiles%\mozilla firefox\updated\browser\features\webcompat-reporter@mozilla.org.xpi
%ProgramFiles%\mozilla firefox\updated\browser\features\screenshots@mozilla.org.xpi
%ProgramFiles%\mozilla firefox\updated\browser\features\formautofill@mozilla.org.xpi
%ProgramFiles%\mozilla firefox\updated\browser\crashreporter-override.ini
%ProgramFiles%\mozilla firefox\updated\browser\visualelements\visualelements_70.png
%ProgramFiles%\mozilla firefox\updated\browser\visualelements\visualelements_150.png
%ALLUSERSPROFILE%\mozilla\updates\308046b0af4a39cb\updates\0\update.status

Подменяет следующие файлы

%ALLUSERSPROFILE%\Mozilla\updates\308046B0AF4A39CB\active-update.xml

Сетевая активность

TCP

Запросы HTTP POST

http://oc##.#igicert.com/

Другие

'ja#######d-secure.oracle.com':443

UDP

DNS ASK ja#######d-secure.oracle.com

Другое

Ищет следующие окна

ClassName: 'AnVirMainFrame' WindowName: ''
ClassName: 'TrayNotifyWnd' WindowName: ''
ClassName: 'SysPager' WindowName: ''
ClassName: 'ToolbarWindow32' WindowName: ''

Создает и запускает на исполнение

'%TEMP%\anvir\anvir.exe'

Запускает на исполнение

'%WINDIR%\syswow64\cmd.exe' /c if exist <SYSTEM32>\Runscanner.exe (RunScanner.exe /ac /m+ /sd /ec /y /t 0 AnVir.exe) Else AnVir.exe (со скрытым окном)