Program.Unwanted.1244

Техническая информация

Для обеспечения автозапуска и распространения

Модифицирует следующие ключи реестра

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'Easy Driver Pro' = '%ProgramFiles(x86)%\Probit Software\Easy Driver Pro\EDPTray.exe'
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'EasySpeedCheck' = '%ProgramFiles(x86)%\Easy Speed Check\easyspeedcheck.exe'

Создает или изменяет следующие файлы

<SYSTEM32>\tasks\easy driver pro schedule

Изменения в файловой системе

Создает следующие файлы

%TEMP%\nszb396.tmp\system.dll
%TEMP%\nsuab7b.tmp\system.dll
%TEMP%\nsuab7b.tmp\inetc.dll
%TEMP%\nsuab7b.tmp\7za.exe
%ProgramFiles(x86)%\easy speed check\esc.ico
%ProgramFiles(x86)%\easy speed check\uninstall.exe
%TEMP%\nsuab7b.tmp\easyspeedcheck.data
%TEMP%\nsuab7b.tmp\nsexec.dll
%TEMP%\nszb396.tmp\easydriverpro.data
%ProgramFiles(x86)%\easy speed check\cwebpage.dll
%ProgramFiles(x86)%\easy speed check\zlib1.dll
%ProgramFiles(x86)%\easy speed check\libidn-11.dll
%ProgramFiles(x86)%\easy speed check\ssleay32.dll
%ProgramFiles(x86)%\easy speed check\libcurl.dll
%ProgramFiles(x86)%\easy speed check\libstdc++-6.dll
%ProgramFiles(x86)%\easy speed check\libeay32.dll
%ProgramFiles(x86)%\easy speed check\easyspeedcheck.exe
%APPDATA%\microsoft\windows\start menu\programs\easy driver pro on the web.lnk
%TEMP%\nszb396.tmp\easyspeedchecksetup.exe
%APPDATA%\microsoft\windows\start menu\programs\help.lnk
%APPDATA%\microsoft\windows\start menu\programs\uninstall.lnk
%APPDATA%\microsoft\windows\start menu\programs\easy driver pro.lnk
%TEMP%\nszb396.tmp\7za.exe
%ProgramFiles(x86)%\probit software\easy driver pro\easydriverpro.chm
%ProgramFiles(x86)%\probit software\easy driver pro\english.ini
%ProgramFiles(x86)%\probit software\easy driver pro\scan.gif
%ProgramFiles(x86)%\probit software\easy driver pro\file_id.diz
%ProgramFiles(x86)%\probit software\easy driver pro\homepage.url
%ProgramFiles(x86)%\probit software\easy driver pro\edp.ico
%ProgramFiles(x86)%\probit software\easy driver pro\base\program.log
%ProgramFiles(x86)%\easy speed check\libgcc_s_dw2-1.dll
%ProgramFiles(x86)%\probit software\easy driver pro\uninstall.exe
%ProgramFiles(x86)%\probit software\easy driver pro\base\exclusions.txt
%ProgramFiles(x86)%\probit software\easy driver pro\base\vendors.txt
%ProgramFiles(x86)%\probit software\easy driver pro\sqlite3.dll
%ProgramFiles(x86)%\probit software\easy driver pro\edptray.exe
%ProgramFiles(x86)%\probit software\easy driver pro\7z.dll
%ProgramFiles(x86)%\probit software\easy driver pro\easydriverpro.exe
%TEMP%\nszb396.tmp\md5dll.dll
%TEMP%\nszb396.tmp\inetc.dll
%TEMP%\nszb396.tmp\nsexec.dll
%ProgramFiles(x86)%\probit software\easy driver pro\base\program_error.log

Удаляет следующие файлы

%TEMP%\nsuab7b.tmp\7za.exe
%TEMP%\nsuab7b.tmp\easyspeedcheck.data
%TEMP%\nsuab7b.tmp\inetc.dll
%TEMP%\nsuab7b.tmp\nsexec.dll
%TEMP%\nsuab7b.tmp\system.dll
%TEMP%\nszb396.tmp\7za.exe
%TEMP%\nszb396.tmp\easydriverpro.data
%TEMP%\nszb396.tmp\easyspeedchecksetup.exe
%TEMP%\nszb396.tmp\inetc.dll
%TEMP%\nszb396.tmp\md5dll.dll
%TEMP%\nszb396.tmp\nsexec.dll
%TEMP%\nszb396.tmp\system.dll

Сетевая активность

Подключается к

'ea####iverpro.com':80
'ea####iverpro.com':443
'x.##2.us':80
'o.##2.us':80
'oc##.###tg2.amazontrust.com':80
'oc##.####ca1.amazontrust.com':80
'cr#.####ca1.amazontrust.com':80
'oc##.###03.amazontrust.com':80
'cr#.####3.amazontrust.com':80
'do######.easyspeedcheck.com':80
'se#####.smartpcupdate.com':80

TCP

Запросы HTTP GET

http://www.ea####iverpro.com/easyinstallprolib/easyinstallprolog/log-install.php?in#############################################
http://x.##2.us/x.cer
http://o.##2.us//MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D
http://oc##.###tg2.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D
http://oc##.####ca1.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEkzUBtJnwJkc3SmanzgxeYU%3D
http://do######.easydriverpro.com/easydriverpro10.0.0.data
http://cr#.####ca1.amazontrust.com/rootca1.crl
http://oc##.###03.amazontrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQqHI%2BsdmapawQncL1rpCEZZ8gTSAQUVdkYX9IczAHhWLS%2Bq9lVQgHXLgICEAbiQCoI%2Bid05GZiy%2FPr%2Fic%3D
http://cr#.####3.amazontrust.com/r2m03.crl
http://do######.easyspeedcheck.com/publishers/3/891/EasySpeedCheckSetup.exe
http://www.ea####eedcheck.com/easyinstallprolib/easyinstallprolog/log-install.php?in#############################################
http://do######.easyspeedcheck.com/easyspeedcheck_1_1_3.data
http://www.ea####eedcheck.com/easyinstallprolib/easyinstallprolog/log-install.php?in###########################################################
http://www.ea####iverpro.com/easyinstallprolib/easyinstallprolog/log-install.php?in#################################################################
http://www.ea####eedcheck.com/applib/appmsg/appmsg.php

Другие

'ea####iverpro.com':443

UDP

DNS ASK ea####iverpro.com
DNS ASK x.##2.us
DNS ASK o.##2.us
DNS ASK oc##.###tg2.amazontrust.com
DNS ASK oc##.####ca1.amazontrust.com
DNS ASK do######.easydriverpro.com
DNS ASK cr#.####ca1.amazontrust.com
DNS ASK oc##.###03.amazontrust.com
DNS ASK cr#.####3.amazontrust.com
DNS ASK do######.easyspeedcheck.com
DNS ASK ea####eedcheck.com
DNS ASK se#####.smartpcupdate.com

Другое

Ищет следующие окна

ClassName: 'EasySpeedCheckMainWindow123msfd8712ins1' WindowName: ''
ClassName: '' WindowName: 'PC Speed Maximizer Pro'
ClassName: '' WindowName: 'PC Speed Maximizer'

Создает и запускает на исполнение

'%TEMP%\nszb396.tmp\7za.exe' x -y -o"%ProgramFiles(x86)%\Probit Software\Easy Driver Pro" %TEMP%\nszB396.tmp\easydriverpro.data
'%TEMP%\nszb396.tmp\easyspeedchecksetup.exe'
'%TEMP%\nsuab7b.tmp\7za.exe' e -y -o"%ProgramFiles(x86)%\Easy Speed Check" %TEMP%\nsuAB7B.tmp\easyspeedcheck.data
'%ProgramFiles(x86)%\easy speed check\easyspeedcheck.exe'
'%ProgramFiles(x86)%\probit software\easy driver pro\easydriverpro.exe' /START

Запускает на исполнение

'%WINDIR%\syswow64\schtasks.exe' /Create /TN "Easy Driver Pro Schedule" /TR "\"%ProgramFiles(x86)%\Probit Software\Easy Driver Pro\EDPTray.exe\"" /SC ONLOGON /RL HIGHEST /F (со скрытым окном)
'%TEMP%\nsuab7b.tmp\7za.exe' e -y -o"%ProgramFiles(x86)%\Easy Speed Check" %TEMP%\nsuAB7B.tmp\easyspeedcheck.data (со скрытым окном)
'%TEMP%\nszb396.tmp\7za.exe' x -y -o"%ProgramFiles(x86)%\Probit Software\Easy Driver Pro" %TEMP%\nszB396.tmp\easydriverpro.data (со скрытым окном)