Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Classes\BurnAwareOpen\shell\open\command] '' = '"%PROGRAM_FILES%\BurnAware Professional\burnaware.exe"'
Вредоносные функции:
Создает и запускает на исполнение:
- '%TEMP%\is-L02MS.tmp\Setup.tmp' /SL5="$100E2,8112852,187904,%ALLUSERSPROFILE%\Application Data\Setup.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
- '%ALLUSERSPROFILE%\Application Data\Setup.exe' /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
Завершает или пытается завершить
следующие пользовательские процессы:
- opera.exe
- safari.exe
- firefox.exe
- iexplore.exe
- chrome.exe
Изменения в файловой системе:
Создает следующие файлы:
- %PROGRAM_FILES%\BurnAware Professional\is-JED9U.tmp
- %PROGRAM_FILES%\BurnAware Professional\is-5URF6.tmp
- %PROGRAM_FILES%\BurnAware Professional\is-JOLQG.tmp
- %PROGRAM_FILES%\BurnAware Professional\is-N7IGH.tmp
- %PROGRAM_FILES%\BurnAware Professional\is-OA8EV.tmp
- %PROGRAM_FILES%\BurnAware Professional\is-GAQFT.tmp
- %PROGRAM_FILES%\BurnAware Professional\is-A1JUQ.tmp
- %PROGRAM_FILES%\BurnAware Professional\is-QFDBS.tmp
- %PROGRAM_FILES%\BurnAware Professional\is-DEA0O.tmp
- %PROGRAM_FILES%\BurnAware Professional\is-B6CJC.tmp
- %PROGRAM_FILES%\BurnAware Professional\is-7SJ3U.tmp
- %PROGRAM_FILES%\BurnAware Professional\is-KFFVD.tmp
- %PROGRAM_FILES%\BurnAware Professional\is-14NCO.tmp
- %PROGRAM_FILES%\BurnAware Professional\is-J91NH.tmp
- %ALLUSERSPROFILE%\Desktop\BurnAware Professional.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\BurnAware Professional\Uninstall BurnAware Professional.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\BurnAware Professional\BurnAware Professional on the Web.url
- %PROGRAM_FILES%\BurnAware Professional\msimg32.dll
- %TEMP%\aut2.tmp
- %PROGRAM_FILES%\BurnAware Professional\unins000.dat
- %ALLUSERSPROFILE%\Start Menu\Programs\BurnAware Professional\Help.lnk
- %PROGRAM_FILES%\BurnAware Professional\is-IAKL3.tmp
- %PROGRAM_FILES%\BurnAware Professional\is-OT40S.tmp
- %PROGRAM_FILES%\BurnAware Professional\is-N26MS.tmp
- %ALLUSERSPROFILE%\Start Menu\Programs\BurnAware Professional\BurnAware Professional.lnk
- %PROGRAM_FILES%\BurnAware Professional\is-M1TFG.tmp
- %PROGRAM_FILES%\BurnAware Professional\is-6R65F.tmp
- %PROGRAM_FILES%\BurnAware Professional\is-EFU2U.tmp
- %PROGRAM_FILES%\BurnAware Professional\skins\is-H2SCV.tmp
- %PROGRAM_FILES%\BurnAware Professional\skins\is-18A6D.tmp
- %PROGRAM_FILES%\BurnAware Professional\skins\is-78I4U.tmp
- %PROGRAM_FILES%\BurnAware Professional\skins\is-E3K1S.tmp
- %PROGRAM_FILES%\BurnAware Professional\skins\is-2DJ88.tmp
- %PROGRAM_FILES%\BurnAware Professional\skins\is-IQ19V.tmp
- %PROGRAM_FILES%\BurnAware Professional\skins\is-3JCP3.tmp
- %TEMP%\is-L02MS.tmp\Setup.tmp
- %ALLUSERSPROFILE%\Application Data\Setup.exe
- %TEMP%\aut1.tmp
- %PROGRAM_FILES%\BurnAware Professional\skins\is-I98MV.tmp
- %PROGRAM_FILES%\BurnAware Professional\is-N9IG7.tmp
- %TEMP%\is-001P3.tmp\_isetup\_shfoldr.dll
- %PROGRAM_FILES%\BurnAware Professional\skins\is-A13D8.tmp
- %PROGRAM_FILES%\BurnAware Professional\is-M0AEB.tmp
- %PROGRAM_FILES%\BurnAware Professional\skins\is-F7GLC.tmp
- %PROGRAM_FILES%\BurnAware Professional\skins\is-N41JR.tmp
- %PROGRAM_FILES%\BurnAware Professional\is-LA23A.tmp
- %PROGRAM_FILES%\BurnAware Professional\is-KMFFK.tmp
- %PROGRAM_FILES%\BurnAware Professional\is-IQS1B.tmp
- %PROGRAM_FILES%\BurnAware Professional\skins\is-1S93J.tmp
- %PROGRAM_FILES%\BurnAware Professional\skins\is-M0GOB.tmp
- %PROGRAM_FILES%\BurnAware Professional\skins\is-IM0DN.tmp
- %PROGRAM_FILES%\BurnAware Professional\skins\is-7KGUF.tmp
- %PROGRAM_FILES%\BurnAware Professional\skins\is-HSMK6.tmp
- %PROGRAM_FILES%\BurnAware Professional\skins\is-E9SMB.tmp
- %PROGRAM_FILES%\BurnAware Professional\skins\is-8AP4K.tmp
Присваивает атрибут 'скрытый' для следующих файлов:
- %ALLUSERSPROFILE%\Application Data\Setup.exe
Удаляет следующие файлы:
- %TEMP%\aut2.tmp
- %ALLUSERSPROFILE%\Application Data\Setup.exe
- %TEMP%\is-L02MS.tmp\Setup.tmp
- %TEMP%\aut1.tmp
- %TEMP%\is-001P3.tmp\_isetup\_shfoldr.dll
Перемещает следующие файлы:
- %PROGRAM_FILES%\BurnAware Professional\is-KFFVD.tmp в %PROGRAM_FILES%\BurnAware Professional\CopyDisc.exe
- %PROGRAM_FILES%\BurnAware Professional\is-14NCO.tmp в %PROGRAM_FILES%\BurnAware Professional\MakeISO.exe
- %PROGRAM_FILES%\BurnAware Professional\is-7SJ3U.tmp в %PROGRAM_FILES%\BurnAware Professional\DataRecovery.exe
- %PROGRAM_FILES%\BurnAware Professional\is-JOLQG.tmp в %PROGRAM_FILES%\BurnAware Professional\BurnAware.exe
- %PROGRAM_FILES%\BurnAware Professional\is-A1JUQ.tmp в %PROGRAM_FILES%\BurnAware Professional\VerifyDisc.exe
- %PROGRAM_FILES%\BurnAware Professional\is-EFU2U.tmp в %PROGRAM_FILES%\BurnAware Professional\DiscInfo.exe
- %PROGRAM_FILES%\BurnAware Professional\is-LA23A.tmp в %PROGRAM_FILES%\BurnAware Professional\DataDisc.exe
- %PROGRAM_FILES%\BurnAware Professional\is-B6CJC.tmp в %PROGRAM_FILES%\BurnAware Professional\MP3Disc.exe
- %PROGRAM_FILES%\BurnAware Professional\is-QFDBS.tmp в %PROGRAM_FILES%\BurnAware Professional\CopyImage.exe
- %PROGRAM_FILES%\BurnAware Professional\is-DEA0O.tmp в %PROGRAM_FILES%\BurnAware Professional\EraseDisc.exe
- %PROGRAM_FILES%\BurnAware Professional\is-5URF6.tmp в %PROGRAM_FILES%\BurnAware Professional\MultiBurn.exe
- %PROGRAM_FILES%\BurnAware Professional\is-OT40S.tmp в %PROGRAM_FILES%\BurnAware Professional\basswma.dll
- %PROGRAM_FILES%\BurnAware Professional\is-N26MS.tmp в %PROGRAM_FILES%\BurnAware Professional\bassflac.dll
- %PROGRAM_FILES%\BurnAware Professional\is-IAKL3.tmp в %PROGRAM_FILES%\BurnAware Professional\tags.dll
- %PROGRAM_FILES%\BurnAware Professional\is-M1TFG.tmp в %PROGRAM_FILES%\BurnAware Professional\ba7pro.dll
- %PROGRAM_FILES%\BurnAware Professional\is-6R65F.tmp в %PROGRAM_FILES%\BurnAware Professional\FoxSDKU32w.dll
- %PROGRAM_FILES%\BurnAware Professional\is-GAQFT.tmp в %PROGRAM_FILES%\BurnAware Professional\FoxPlayerU32.dll
- %PROGRAM_FILES%\BurnAware Professional\is-JED9U.tmp в %PROGRAM_FILES%\BurnAware Professional\burnaware.chm
- %PROGRAM_FILES%\BurnAware Professional\is-OA8EV.tmp в %PROGRAM_FILES%\BurnAware Professional\FoxWmaPluginU32.dll
- %PROGRAM_FILES%\BurnAware Professional\is-J91NH.tmp в %PROGRAM_FILES%\BurnAware Professional\bass.dll
- %PROGRAM_FILES%\BurnAware Professional\is-N7IGH.tmp в %PROGRAM_FILES%\BurnAware Professional\tvqdec.dll
- %PROGRAM_FILES%\BurnAware Professional\is-KMFFK.tmp в %PROGRAM_FILES%\BurnAware Professional\DVDVideo.exe
- %PROGRAM_FILES%\BurnAware Professional\skins\is-IQ19V.tmp в %PROGRAM_FILES%\BurnAware Professional\skins\Office2010_Blue.skn
- %PROGRAM_FILES%\BurnAware Professional\skins\is-H2SCV.tmp в %PROGRAM_FILES%\BurnAware Professional\skins\Office2010_Black.skn
- %PROGRAM_FILES%\BurnAware Professional\skins\is-2DJ88.tmp в %PROGRAM_FILES%\BurnAware Professional\skins\Office2010_Silver.skn
- %PROGRAM_FILES%\BurnAware Professional\skins\is-A13D8.tmp в %PROGRAM_FILES%\BurnAware Professional\skins\Office2013_Green.skn
- %PROGRAM_FILES%\BurnAware Professional\skins\is-E3K1S.tmp в %PROGRAM_FILES%\BurnAware Professional\skins\Office2013_Blue.skn
- %PROGRAM_FILES%\BurnAware Professional\skins\is-I98MV.tmp в %PROGRAM_FILES%\BurnAware Professional\skins\2010Silver.skn
- %PROGRAM_FILES%\BurnAware Professional\is-N9IG7.tmp в %PROGRAM_FILES%\BurnAware Professional\unins000.exe
- %PROGRAM_FILES%\BurnAware Professional\skins\is-3JCP3.tmp в %PROGRAM_FILES%\BurnAware Professional\skins\2010Silver_Aero.skn
- %PROGRAM_FILES%\BurnAware Professional\skins\is-18A6D.tmp в %PROGRAM_FILES%\BurnAware Professional\skins\Android_Aero.skn
- %PROGRAM_FILES%\BurnAware Professional\skins\is-78I4U.tmp в %PROGRAM_FILES%\BurnAware Professional\skins\Android.skn
- %PROGRAM_FILES%\BurnAware Professional\skins\is-7KGUF.tmp в %PROGRAM_FILES%\BurnAware Professional\skins\Office2013_Orange.skn
- %PROGRAM_FILES%\BurnAware Professional\skins\is-N41JR.tmp в %PROGRAM_FILES%\BurnAware Professional\skins\Win8.skn
- %PROGRAM_FILES%\BurnAware Professional\skins\is-1S93J.tmp в %PROGRAM_FILES%\BurnAware Professional\skins\Win7_Aero.skn
- %PROGRAM_FILES%\BurnAware Professional\skins\is-F7GLC.tmp в %PROGRAM_FILES%\BurnAware Professional\skins\Win8_Aero.skn
- %PROGRAM_FILES%\BurnAware Professional\is-IQS1B.tmp в %PROGRAM_FILES%\BurnAware Professional\BurnImage.exe
- %PROGRAM_FILES%\BurnAware Professional\is-M0AEB.tmp в %PROGRAM_FILES%\BurnAware Professional\AudioCD.exe
- %PROGRAM_FILES%\BurnAware Professional\skins\is-M0GOB.tmp в %PROGRAM_FILES%\BurnAware Professional\skins\SnowLeopard.skn
- %PROGRAM_FILES%\BurnAware Professional\skins\is-IM0DN.tmp в %PROGRAM_FILES%\BurnAware Professional\skins\Office2013_Purple.skn
- %PROGRAM_FILES%\BurnAware Professional\skins\is-8AP4K.tmp в %PROGRAM_FILES%\BurnAware Professional\skins\Ubuntu.skn
- %PROGRAM_FILES%\BurnAware Professional\skins\is-HSMK6.tmp в %PROGRAM_FILES%\BurnAware Professional\skins\Win7.skn
- %PROGRAM_FILES%\BurnAware Professional\skins\is-E9SMB.tmp в %PROGRAM_FILES%\BurnAware Professional\skins\Ubuntu_Aero.skn
Сетевая активность:
Подключается к:
- 'www.bu###ware.com':80
- 'localhost':1036
TCP:
Запросы HTTP GET:
- www.bu###ware.com/after-install.html
UDP:
- DNS ASK www.bu###ware.com
Другое:
Ищет следующие окна:
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'IEFrame' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: '' WindowName: ''
