Техническая информация
Для обеспечения автозапуска и распространения
Модифицирует следующие ключи реестра
- [HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run] 'inetprot' = '"%ProgramFiles(x86)%\Surfblocker\surfblock.exe" tray'
Устанавливает следующие настройки сервисов
- [HKLM\SYSTEM\CurrentControlSet\Services\InetProtectorHelperService64] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\InetProtectorHelperService64] 'ImagePath' = '%ProgramFiles(x86)%\Surfblocker\IProtectorHelper64.exe'
- [HKLM\SYSTEM\CurrentControlSet\Services\BlumsoftiNetProtDrv] 'ImagePath' = '%ProgramFiles(x86)%\Surfblocker\blumsoftiNetProtDrv64.sys'
- [HKLM\SYSTEM\CurrentControlSet\Services\InternetProtectorService] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\InternetProtectorService] 'ImagePath' = '%ProgramFiles(x86)%\Surfblocker\IProtectorService.exe'
Создает следующие сервисы
- 'InetProtectorHelperService64' %ProgramFiles(x86)%\Surfblocker\IProtectorHelper64.exe
- 'BlumsoftiNetProtDrv' %ProgramFiles(x86)%\Surfblocker\blumsoftiNetProtDrv64.sys
- 'InternetProtectorService' %ProgramFiles(x86)%\Surfblocker\IProtectorService.exe
Вредоносные функции
Внедряет код в
следующие системные процессы:
- <SYSTEM32>\dllhost.exe
- <SYSTEM32>\conhost.exe
- <SYSTEM32>\oobe\useroobebroker.exe
- <SYSTEM32>\taskhostw.exe
- <SYSTEM32>\svchost.exe
- <SYSTEM32>\securityhealthsystray.exe
- <SYSTEM32>\runtimebroker.exe
- %WINDIR%\systemapps\microsoft.windows.search_cw5n1h2txyewy\searchapp.exe
- %WINDIR%\systemapps\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\startmenuexperiencehost.exe
- %WINDIR%\explorer.exe
- <SYSTEM32>\sihost.exe
- <SYSTEM32>\spoolsv.exe
- <SYSTEM32>\wudfhost.exe
- <SYSTEM32>\dwm.exe
- <SYSTEM32>\fontdrvhost.exe
- <SYSTEM32>\lsass.exe
- <SYSTEM32>\winlogon.exe
следующие пользовательские процессы:
- iexplore.exe
- firefox.exe
Перехватывает функции
в браузерах
- Процесс firefox.exe, модуль wsock32.dll
Изменения в файловой системе
Создает следующие файлы
- %APPDATA%\blumentalssurfblocker\killduplicate.cmd
- %APPDATA%\blumentalssurfblocker\launcher.exe
- %APPDATA%\blumentalssurfblocker\surfblocker.exe
- %TEMP%\is-qr068.tmp\surfblocker.tmp
- %TEMP%\is-jnb4j.tmp\_isetup\_setup64.tmp
- %ProgramFiles(x86)%\surfblocker\is-fmfbu.tmp
- %ProgramFiles(x86)%\surfblocker\is-de7cr.tmp
- %ProgramFiles(x86)%\surfblocker\is-ullul.tmp
- %ProgramFiles(x86)%\surfblocker\is-r3mpu.tmp
- %ProgramFiles(x86)%\surfblocker\is-6vrdj.tmp
- %ProgramFiles(x86)%\surfblocker\is-mds87.tmp
- %ProgramFiles(x86)%\surfblocker\is-dqp6h.tmp
- %ProgramFiles(x86)%\surfblocker\is-ruds9.tmp
- %ProgramFiles(x86)%\surfblocker\is-66h0b.tmp
- %ProgramFiles(x86)%\surfblocker\is-irj8v.tmp
- %ProgramFiles(x86)%\surfblocker\is-s03pb.tmp
- %ProgramFiles(x86)%\surfblocker\is-pbo5d.tmp
- %ProgramFiles(x86)%\surfblocker\is-qhf4u.tmp
- %ProgramFiles(x86)%\surfblocker\is-givis.tmp
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\surfblocker\is-1bd9s.tmp
- %ProgramFiles(x86)%\surfblocker\is-2j3j1.tmp
- %ProgramFiles(x86)%\surfblocker\lang\is-nrjg3.tmp
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\adult\is-h7ddm.tmp
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\adult\is-ltaur.tmp
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\adult\is-nmi6u.tmp
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\adult\is-u90aj.tmp
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\adult\is-ce054.tmp
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\chat\is-r35j1.tmp
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\chat\is-fb86r.tmp
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\drugs\is-512h5.tmp
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\drugs\is-c0g8u.tmp
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\gambling\is-65fl5.tmp
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\gambling\is-12psh.tmp
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\gambling\is-rtnkh.tmp
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\games\is-p99ct.tmp
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\games\is-13r80.tmp
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\malware\is-vlpln.tmp
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\malware\is-svjph.tmp
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\malware\is-vdg2a.tmp
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\malware\is-mv646.tmp
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\malware\is-fn7oq.tmp
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\malware\is-d0oo9.tmp
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\malware\is-c71ep.tmp
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\malware\is-8ontl.tmp
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\nudity\is-7j6v6.tmp
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\nudity\is-s0jr5.tmp
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\social\is-vd4c8.tmp
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\social\is-c8frt.tmp
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\violence\is-f3ddd.tmp
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\violence\is-5ftl6.tmp
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\violence\is-f45dd.tmp
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\proxy\is-rf4sl.tmp
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\proxy\is-p15o6.tmp
- %ProgramFiles(x86)%\surfblocker\data\offers\is-iq3e4.tmp
- %ProgramFiles(x86)%\surfblocker\data\offers\images\is-r4up0.tmp
- %ProgramFiles(x86)%\surfblocker\data\offers\images\is-27i1m.tmp
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\surfblocker\surfblocker.lnk
- %HOMEPATH%\desktop\surfblocker.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\surfblocker\uninstall surfblocker.lnk
- %ProgramFiles(x86)%\surfblocker\unins000.dat
Присваивает атрибут 'скрытый' для следующих файлов
- %APPDATA%\blumentalssurfblocker\killduplicate.cmd
Перемещает следующие файлы
- %ProgramFiles(x86)%\surfblocker\is-fmfbu.tmp в %ProgramFiles(x86)%\surfblocker\unins000.exe
- %ProgramFiles(x86)%\surfblocker\is-de7cr.tmp в %ProgramFiles(x86)%\surfblocker\surfblock.exe
- %ProgramFiles(x86)%\surfblocker\is-ullul.tmp в %ProgramFiles(x86)%\surfblocker\ciprotect.exe
- %ProgramFiles(x86)%\surfblocker\is-r3mpu.tmp в %ProgramFiles(x86)%\surfblocker\iprotectorservice.exe
- %ProgramFiles(x86)%\surfblocker\is-6vrdj.tmp в %ProgramFiles(x86)%\surfblocker\iprotectorhelper64.exe
- %ProgramFiles(x86)%\surfblocker\is-mds87.tmp в %ProgramFiles(x86)%\surfblocker\blumsoftinetprotdrv32.sys
- %ProgramFiles(x86)%\surfblocker\is-dqp6h.tmp в %ProgramFiles(x86)%\surfblocker\blumsoftinetprotdrv64.sys
- %ProgramFiles(x86)%\surfblocker\is-ruds9.tmp в %ProgramFiles(x86)%\surfblocker\iptrmhook32.dll
- %ProgramFiles(x86)%\surfblocker\is-66h0b.tmp в %ProgramFiles(x86)%\surfblocker\iptrmhook64.dll
- %ProgramFiles(x86)%\surfblocker\is-irj8v.tmp в %ProgramFiles(x86)%\surfblocker\wsahook32.dll
- %ProgramFiles(x86)%\surfblocker\is-s03pb.tmp в %ProgramFiles(x86)%\surfblocker\wsahook64.dll
- %ProgramFiles(x86)%\surfblocker\is-pbo5d.tmp в %ProgramFiles(x86)%\surfblocker\metro.ico
- %ProgramFiles(x86)%\surfblocker\is-qhf4u.tmp в %ProgramFiles(x86)%\surfblocker\license.txt
- %ProgramFiles(x86)%\surfblocker\is-givis.tmp в %ProgramFiles(x86)%\surfblocker\readme.txt
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\surfblocker\is-1bd9s.tmp в %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\surfblocker\blumentals software web site.url
- %ProgramFiles(x86)%\surfblocker\is-2j3j1.tmp в %ProgramFiles(x86)%\surfblocker\chkpass.dll
- %ProgramFiles(x86)%\surfblocker\lang\is-nrjg3.tmp в %ProgramFiles(x86)%\surfblocker\lang\languages.sib
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\adult\is-h7ddm.tmp в %ALLUSERSPROFILE%\blumentals\surfblocker\filters\adult\domains_adult
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\adult\is-ltaur.tmp в %ALLUSERSPROFILE%\blumentals\surfblocker\filters\adult\domains_dating
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\adult\is-nmi6u.tmp в %ALLUSERSPROFILE%\blumentals\surfblocker\filters\adult\domains_manga
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\adult\is-u90aj.tmp в %ALLUSERSPROFILE%\blumentals\surfblocker\filters\adult\domains_mixed_adult
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\adult\is-ce054.tmp в %ALLUSERSPROFILE%\blumentals\surfblocker\filters\adult\filters.ini
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\chat\is-r35j1.tmp в %ALLUSERSPROFILE%\blumentals\surfblocker\filters\chat\domains_chat
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\chat\is-fb86r.tmp в %ALLUSERSPROFILE%\blumentals\surfblocker\filters\chat\filters.ini
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\drugs\is-512h5.tmp в %ALLUSERSPROFILE%\blumentals\surfblocker\filters\drugs\domains_drogue
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\drugs\is-c0g8u.tmp в %ALLUSERSPROFILE%\blumentals\surfblocker\filters\drugs\filters.ini
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\gambling\is-65fl5.tmp в %ALLUSERSPROFILE%\blumentals\surfblocker\filters\gambling\domains_arjel
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\gambling\is-12psh.tmp в %ALLUSERSPROFILE%\blumentals\surfblocker\filters\gambling\domains_gambling
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\gambling\is-rtnkh.tmp в %ALLUSERSPROFILE%\blumentals\surfblocker\filters\gambling\filters.ini
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\games\is-p99ct.tmp в %ALLUSERSPROFILE%\blumentals\surfblocker\filters\games\domains_games
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\games\is-13r80.tmp в %ALLUSERSPROFILE%\blumentals\surfblocker\filters\games\filters.ini
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\malware\is-vlpln.tmp в %ALLUSERSPROFILE%\blumentals\surfblocker\filters\malware\domains_cryptojacking
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\malware\is-svjph.tmp в %ALLUSERSPROFILE%\blumentals\surfblocker\filters\malware\domains_ddos
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\malware\is-vdg2a.tmp в %ALLUSERSPROFILE%\blumentals\surfblocker\filters\malware\domains_hacking
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\malware\is-mv646.tmp в %ALLUSERSPROFILE%\blumentals\surfblocker\filters\malware\domains_malware
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\malware\is-fn7oq.tmp в %ALLUSERSPROFILE%\blumentals\surfblocker\filters\malware\domains_phishing
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\malware\is-d0oo9.tmp в %ALLUSERSPROFILE%\blumentals\surfblocker\filters\malware\domains_stalkerware
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\malware\is-c71ep.tmp в %ALLUSERSPROFILE%\blumentals\surfblocker\filters\malware\domains_warez
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\malware\is-8ontl.tmp в %ALLUSERSPROFILE%\blumentals\surfblocker\filters\malware\filters.ini
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\nudity\is-7j6v6.tmp в %ALLUSERSPROFILE%\blumentals\surfblocker\filters\nudity\domains_lingerie
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\nudity\is-s0jr5.tmp в %ALLUSERSPROFILE%\blumentals\surfblocker\filters\nudity\filters.ini
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\social\is-vd4c8.tmp в %ALLUSERSPROFILE%\blumentals\surfblocker\filters\social\domains_social_networks
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\social\is-c8frt.tmp в %ALLUSERSPROFILE%\blumentals\surfblocker\filters\social\filters.ini
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\violence\is-f3ddd.tmp в %ALLUSERSPROFILE%\blumentals\surfblocker\filters\violence\domains_agressif
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\violence\is-5ftl6.tmp в %ALLUSERSPROFILE%\blumentals\surfblocker\filters\violence\domains_dangerous_material
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\violence\is-f45dd.tmp в %ALLUSERSPROFILE%\blumentals\surfblocker\filters\violence\filters.ini
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\proxy\is-rf4sl.tmp в %ALLUSERSPROFILE%\blumentals\surfblocker\filters\proxy\domains_redirector
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\proxy\is-p15o6.tmp в %ALLUSERSPROFILE%\blumentals\surfblocker\filters\proxy\filters.ini
- %ProgramFiles(x86)%\surfblocker\data\offers\is-iq3e4.tmp в %ProgramFiles(x86)%\surfblocker\data\offers\special.htm
- %ProgramFiles(x86)%\surfblocker\data\offers\images\is-r4up0.tmp в %ProgramFiles(x86)%\surfblocker\data\offers\images\piggy-bank.png
- %ProgramFiles(x86)%\surfblocker\data\offers\images\is-27i1m.tmp в %ProgramFiles(x86)%\surfblocker\data\offers\images\underline.png
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\adult\domains_adult в %WINDIR%\syswow64\config\systemprofile\appdata\roaming\blumentals\surfblocker\filters\adult\domains_adult
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\adult\domains_dating в %WINDIR%\syswow64\config\systemprofile\appdata\roaming\blumentals\surfblocker\filters\adult\domains_dating
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\adult\domains_manga в %WINDIR%\syswow64\config\systemprofile\appdata\roaming\blumentals\surfblocker\filters\adult\domains_manga
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\adult\domains_mixed_adult в %WINDIR%\syswow64\config\systemprofile\appdata\roaming\blumentals\surfblocker\filters\adult\domains_mixed_adult
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\adult\filters.ini в %WINDIR%\syswow64\config\systemprofile\appdata\roaming\blumentals\surfblocker\filters\adult\filters.ini
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\chat\domains_chat в %WINDIR%\syswow64\config\systemprofile\appdata\roaming\blumentals\surfblocker\filters\chat\domains_chat
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\chat\filters.ini в %WINDIR%\syswow64\config\systemprofile\appdata\roaming\blumentals\surfblocker\filters\chat\filters.ini
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\drugs\domains_drogue в %WINDIR%\syswow64\config\systemprofile\appdata\roaming\blumentals\surfblocker\filters\drugs\domains_drogue
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\drugs\filters.ini в %WINDIR%\syswow64\config\systemprofile\appdata\roaming\blumentals\surfblocker\filters\drugs\filters.ini
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\gambling\domains_arjel в %WINDIR%\syswow64\config\systemprofile\appdata\roaming\blumentals\surfblocker\filters\gambling\domains_arjel
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\gambling\domains_gambling в %WINDIR%\syswow64\config\systemprofile\appdata\roaming\blumentals\surfblocker\filters\gambling\domains_gambling
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\gambling\filters.ini в %WINDIR%\syswow64\config\systemprofile\appdata\roaming\blumentals\surfblocker\filters\gambling\filters.ini
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\games\domains_games в %WINDIR%\syswow64\config\systemprofile\appdata\roaming\blumentals\surfblocker\filters\games\domains_games
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\games\filters.ini в %WINDIR%\syswow64\config\systemprofile\appdata\roaming\blumentals\surfblocker\filters\games\filters.ini
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\malware\domains_cryptojacking в %WINDIR%\syswow64\config\systemprofile\appdata\roaming\blumentals\surfblocker\filters\malware\domains_cryptojacking
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\malware\domains_ddos в %WINDIR%\syswow64\config\systemprofile\appdata\roaming\blumentals\surfblocker\filters\malware\domains_ddos
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\malware\domains_hacking в %WINDIR%\syswow64\config\systemprofile\appdata\roaming\blumentals\surfblocker\filters\malware\domains_hacking
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\malware\domains_malware в %WINDIR%\syswow64\config\systemprofile\appdata\roaming\blumentals\surfblocker\filters\malware\domains_malware
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\malware\domains_phishing в %WINDIR%\syswow64\config\systemprofile\appdata\roaming\blumentals\surfblocker\filters\malware\domains_phishing
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\malware\domains_stalkerware в %WINDIR%\syswow64\config\systemprofile\appdata\roaming\blumentals\surfblocker\filters\malware\domains_stalkerware
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\malware\domains_warez в %WINDIR%\syswow64\config\systemprofile\appdata\roaming\blumentals\surfblocker\filters\malware\domains_warez
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\malware\filters.ini в %WINDIR%\syswow64\config\systemprofile\appdata\roaming\blumentals\surfblocker\filters\malware\filters.ini
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\nudity\domains_lingerie в %WINDIR%\syswow64\config\systemprofile\appdata\roaming\blumentals\surfblocker\filters\nudity\domains_lingerie
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\nudity\filters.ini в %WINDIR%\syswow64\config\systemprofile\appdata\roaming\blumentals\surfblocker\filters\nudity\filters.ini
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\proxy\domains_redirector в %WINDIR%\syswow64\config\systemprofile\appdata\roaming\blumentals\surfblocker\filters\proxy\domains_redirector
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\proxy\filters.ini в %WINDIR%\syswow64\config\systemprofile\appdata\roaming\blumentals\surfblocker\filters\proxy\filters.ini
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\social\domains_social_networks в %WINDIR%\syswow64\config\systemprofile\appdata\roaming\blumentals\surfblocker\filters\social\domains_social_networks
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\social\filters.ini в %WINDIR%\syswow64\config\systemprofile\appdata\roaming\blumentals\surfblocker\filters\social\filters.ini
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\violence\domains_agressif в %WINDIR%\syswow64\config\systemprofile\appdata\roaming\blumentals\surfblocker\filters\violence\domains_agressif
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\violence\domains_dangerous_material в %WINDIR%\syswow64\config\systemprofile\appdata\roaming\blumentals\surfblocker\filters\violence\domains_dangerous_material
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\violence\filters.ini в %WINDIR%\syswow64\config\systemprofile\appdata\roaming\blumentals\surfblocker\filters\violence\filters.ini
Изменяет файл HOSTS.
Другое
Создает и запускает на исполнение
- '%APPDATA%\blumentalssurfblocker\launcher.exe'
- '%APPDATA%\blumentalssurfblocker\surfblocker.exe' /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
- '%TEMP%\is-qr068.tmp\surfblocker.tmp' /SL5="$90198,15952795,57856,%APPDATA%\BlumentalsSurfblocker\surfblocker.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
- '%ProgramFiles(x86)%\surfblocker\iprotectorhelper64.exe'
- '%ProgramFiles(x86)%\surfblocker\iprotectorservice.exe'
Запускает на исполнение
- '<SYSTEM32>\cmd.exe' /c ""%APPDATA%\BlumentalsSurfblocker\KillDuplicate.cmd" "%APPDATA%\BlumentalsSurfblocker" "<Имя файла>.exe"" (со скрытым окном)
- '%APPDATA%\blumentalssurfblocker\launcher.exe' (со скрытым окном)
- '%ProgramFiles(x86)%\surfblocker\iprotectorhelper64.exe' (со скрытым окном)
