Trojan.DownLoader11.46179

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Internet Explorer\Extensions\{9819CC0E-9669-4D01-9CD7-2C66DA43AC6C}] 'Exec' = '%PROGRAM_FILES%\IDA\ida.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Internet Download Accelerator' = '%PROGRAM_FILES%\IDA\ida.exe -autorun'
[<HKLM>\SOFTWARE\Classes\IDAFile\shell\open\command] '' = '%PROGRAM_FILES%\IDA\ida.exe "%L"'
[<HKLM>\SOFTWARE\Classes\IDAUrlsFile\shell\open\command] '' = '%PROGRAM_FILES%\IDA\ida.exe "%L"'

Вредоносные функции:

Создает и запускает на исполнение:

'%PROGRAM_FILES%\IDA\ida.exe'
'%TEMP%\is-4RPA2.tmp\Setup.tmp' /SL5="$100E2,5364005,119296,%TEMP%\Setup.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
'%TEMP%\Setup.exe' /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-

Запускает на исполнение:

'<SYSTEM32>\regsvr32.exe' /s idabar.dll
'<SYSTEM32>\regsvr32.exe' /s "%PROGRAM_FILES%\IDA\idaiehlp.dll"
'<SYSTEM32>\regsvr32.exe' /s "%PROGRAM_FILES%\IDA\idaie.dll"

Изменения в файловой системе:

Создает следующие файлы:

%PROGRAM_FILES%\IDA\Languages\is-51J0R.tmp
%PROGRAM_FILES%\IDA\Languages\is-5Q814.tmp
%PROGRAM_FILES%\IDA\Languages\is-MN91J.tmp
%PROGRAM_FILES%\IDA\Languages\is-S31KJ.tmp
%PROGRAM_FILES%\IDA\Languages\is-RHR84.tmp
%PROGRAM_FILES%\IDA\Languages\is-B3D36.tmp
%PROGRAM_FILES%\IDA\Languages\is-7S021.tmp
%PROGRAM_FILES%\IDA\Languages\is-KTLA2.tmp
%PROGRAM_FILES%\IDA\Languages\is-PTMGD.tmp
%PROGRAM_FILES%\IDA\Languages\is-SBT68.tmp
%PROGRAM_FILES%\IDA\is-PU4J0.tmp
%PROGRAM_FILES%\IDA\Languages\is-8OJGF.tmp
%PROGRAM_FILES%\IDA\Languages\is-U2ARL.tmp
%PROGRAM_FILES%\IDA\Languages\is-DFDLT.tmp
%PROGRAM_FILES%\IDA\Languages\is-QU0ML.tmp
%PROGRAM_FILES%\IDA\Languages\is-LC2PP.tmp
%PROGRAM_FILES%\IDA\Languages\is-O54A8.tmp
%PROGRAM_FILES%\IDA\Languages\is-054ER.tmp
%PROGRAM_FILES%\IDA\Languages\is-PAI3V.tmp
%PROGRAM_FILES%\IDA\Languages\is-3MIJ8.tmp
%PROGRAM_FILES%\IDA\Languages\is-U6BPC.tmp
%PROGRAM_FILES%\IDA\Languages\is-7D7CN.tmp
%PROGRAM_FILES%\IDA\Languages\is-DL5HO.tmp
%PROGRAM_FILES%\IDA\Languages\is-AGL02.tmp
%PROGRAM_FILES%\IDA\Languages\is-L73BN.tmp
%PROGRAM_FILES%\IDA\Languages\is-974BA.tmp
%PROGRAM_FILES%\IDA\Languages\is-EV2GF.tmp
%PROGRAM_FILES%\IDA\Languages\is-S68NG.tmp
%PROGRAM_FILES%\IDA\Languages\is-7NGTQ.tmp
%PROGRAM_FILES%\IDA\Languages\is-HQLSP.tmp
%PROGRAM_FILES%\IDA\Languages\is-777EV.tmp
%PROGRAM_FILES%\IDA\Languages\is-D0ME5.tmp
%PROGRAM_FILES%\IDA\Languages\is-184I5.tmp
%PROGRAM_FILES%\IDA\is-OV2AT.tmp
%APPDATA%\Internet Download Accelerator\temp\skin.dll
%APPDATA%\Internet Download Accelerator\temp\resume.bmp
%APPDATA%\Internet Download Accelerator\temp\spd_ind.bmp
%APPDATA%\Internet Download Accelerator\temp\skin_dll.cfg
%APPDATA%\Internet Download Accelerator\temp\menud.bmp
%APPDATA%\Internet Download Accelerator\temp\menu.bmp
%APPDATA%\Internet Download Accelerator\temp\messages.bmp
%APPDATA%\Internet Download Accelerator\temp\menuh.bmp
%APPDATA%\Internet Download Accelerator\temp\tb_btn.bmp
%APPDATA%\Internet Download Accelerator\temp\TB_BGRN.BMP
%APPDATA%\Internet Download Accelerator\temp\tb_btnh.bmp
%APPDATA%\Internet Download Accelerator\temp\tb_btnd.bmp
%APPDATA%\Internet Download Accelerator\temp\Standard.cfg
%APPDATA%\Internet Download Accelerator\temp\spd_indl.bmp
%APPDATA%\Internet Download Accelerator\temp\TB_BBGRN.BMP
%APPDATA%\Internet Download Accelerator\temp\states.bmp
%APPDATA%\Internet Download Accelerator\temp\folder.bmp
%HOMEPATH%\Desktop\Internet Download Accelerator.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Internet Download Accelerator\Uninstall IDA.lnk
%PROGRAM_FILES%\IDA\unins000.msg
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\Internet Download Accelerator.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Internet Download Accelerator\Internet Download Accelerator.lnk
%PROGRAM_FILES%\IDA\is-9H8QP.tmp
%ALLUSERSPROFILE%\Start Menu\Programs\Internet Download Accelerator\License.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Internet Download Accelerator\Help.lnk
%APPDATA%\Internet Download Accelerator\temp\CART_IND.BMP
%APPDATA%\Internet Download Accelerator\temp\butt_pr.bmp
%APPDATA%\Internet Download Accelerator\temp\category.bmp
%APPDATA%\Internet Download Accelerator\temp\CATCH.BMP
%HOMEPATH%\Desktop\Play!.lnk
%PROGRAM_FILES%\IDA\unins000.dat
%APPDATA%\Internet Download Accelerator\temp\buttons.bmp
%APPDATA%\Internet Download Accelerator\temp\about.bmp
%PROGRAM_FILES%\IDA\Languages\is-RD31Q.tmp
%PROGRAM_FILES%\IDA\is-MDQS1.tmp
%PROGRAM_FILES%\IDA\is-F7CGP.tmp
%PROGRAM_FILES%\IDA\is-LRJJA.tmp
%PROGRAM_FILES%\IDA\is-D1VTH.tmp
%PROGRAM_FILES%\IDA\is-JA1PV.tmp
%PROGRAM_FILES%\IDA\is-Q25K5.tmp
%PROGRAM_FILES%\IDA\is-MQN9P.tmp
%PROGRAM_FILES%\IDA\is-5BHK7.tmp
%PROGRAM_FILES%\IDA\is-TVJB2.tmp
%PROGRAM_FILES%\IDA\is-7S58V.tmp
%PROGRAM_FILES%\IDA\is-IGHNE.tmp
%PROGRAM_FILES%\IDA\is-329MO.tmp
%PROGRAM_FILES%\IDA\is-5PGGF.tmp
%PROGRAM_FILES%\IDA\is-4Q27F.tmp
%PROGRAM_FILES%\IDA\is-7MN8J.tmp
%PROGRAM_FILES%\IDA\is-76PIP.tmp
%PROGRAM_FILES%\IDA\is-SK128.tmp
%PROGRAM_FILES%\IDA\is-0RTV9.tmp
%PROGRAM_FILES%\IDA\is-4J3I9.tmp
%PROGRAM_FILES%\IDA\is-HJ2GG.tmp
%PROGRAM_FILES%\IDA\is-6TMOK.tmp
%TEMP%\Setup.exe
%TEMP%\aut1.tmp
%TEMP%\is-VB1BH.tmp\_isetup\_shfoldr.dll
%TEMP%\is-4RPA2.tmp\Setup.tmp
%PROGRAM_FILES%\IDA\is-H6FKS.tmp
%PROGRAM_FILES%\IDA\is-3PFN0.tmp
%PROGRAM_FILES%\IDA\is-UHJ84.tmp
%PROGRAM_FILES%\IDA\is-H5NQH.tmp
%PROGRAM_FILES%\IDA\is-JN7A5.tmp
%PROGRAM_FILES%\IDA\is-1TK68.tmp
%PROGRAM_FILES%\IDA\is-PL2UF.tmp
%PROGRAM_FILES%\IDA\is-JEKI0.tmp
%PROGRAM_FILES%\IDA\is-G9QQ2.tmp
%PROGRAM_FILES%\IDA\Languages\is-OFB25.tmp
%PROGRAM_FILES%\IDA\Plugins\is-807L9.tmp
%PROGRAM_FILES%\IDA\Languages\is-T10K5.tmp
%PROGRAM_FILES%\IDA\Languages\is-63B9P.tmp
%PROGRAM_FILES%\IDA\Plugins\is-7N8PG.tmp
%PROGRAM_FILES%\IDA\Plugins\is-U58VC.tmp
%PROGRAM_FILES%\IDA\Plugins\is-7IDLI.tmp
%PROGRAM_FILES%\IDA\Plugins\is-0PJNF.tmp
%PROGRAM_FILES%\IDA\Languages\is-K2QUH.tmp
%PROGRAM_FILES%\IDA\Languages\is-92PPP.tmp
%PROGRAM_FILES%\IDA\Languages\is-TFH5F.tmp
%PROGRAM_FILES%\IDA\Languages\is-QC4LL.tmp
%PROGRAM_FILES%\IDA\Languages\is-50JKJ.tmp
%PROGRAM_FILES%\IDA\Languages\is-A1NT6.tmp
%PROGRAM_FILES%\IDA\Languages\is-SS66S.tmp
%PROGRAM_FILES%\IDA\Languages\is-2LASU.tmp
%PROGRAM_FILES%\IDA\Skins\is-I7BNC.tmp
%PROGRAM_FILES%\IDA\temp\is-90BPP.tmp
%PROGRAM_FILES%\IDA\temp\is-IE6LL.tmp
%PROGRAM_FILES%\IDA\temp\is-R7N20.tmp
%PROGRAM_FILES%\IDA\temp\is-TU3CK.tmp
%PROGRAM_FILES%\IDA\temp\is-8K105.tmp
%PROGRAM_FILES%\IDA\is-C9L3H.tmp
%PROGRAM_FILES%\IDA\temp\is-0AKJG.tmp
%PROGRAM_FILES%\IDA\temp\is-HLEHG.tmp
%PROGRAM_FILES%\IDA\Sounds\is-OVRCK.tmp
%PROGRAM_FILES%\IDA\Sounds\is-B4C9R.tmp
%PROGRAM_FILES%\IDA\Skins\is-2B8L8.tmp
%PROGRAM_FILES%\IDA\Sounds\is-LSIGS.tmp
%PROGRAM_FILES%\IDA\temp\is-HR82B.tmp
%PROGRAM_FILES%\IDA\temp\is-TVM16.tmp
%PROGRAM_FILES%\IDA\Sounds\is-4MV6B.tmp
%PROGRAM_FILES%\IDA\temp\is-44U2F.tmp

Удаляет следующие файлы:

%TEMP%\is-4RPA2.tmp\Setup.tmp
%TEMP%\Setup.exe
%TEMP%\aut1.tmp
%TEMP%\is-VB1BH.tmp\_isetup\_shfoldr.dll

Перемещает следующие файлы:

%PROGRAM_FILES%\IDA\Languages\is-7D7CN.tmp в %PROGRAM_FILES%\IDA\Languages\French.lng
%PROGRAM_FILES%\IDA\Languages\is-L73BN.tmp в %PROGRAM_FILES%\IDA\Languages\German.lng
%PROGRAM_FILES%\IDA\Languages\is-AGL02.tmp в %PROGRAM_FILES%\IDA\Languages\Greek.lng
%PROGRAM_FILES%\IDA\Languages\is-TFH5F.tmp в %PROGRAM_FILES%\IDA\Languages\Danish.lng
%PROGRAM_FILES%\IDA\Languages\is-RD31Q.tmp в %PROGRAM_FILES%\IDA\Languages\Dutch.lng
%PROGRAM_FILES%\IDA\Languages\is-DL5HO.tmp в %PROGRAM_FILES%\IDA\Languages\English.lng
%PROGRAM_FILES%\IDA\Languages\is-3MIJ8.tmp в %PROGRAM_FILES%\IDA\Languages\Indonesian.lng
%PROGRAM_FILES%\IDA\Languages\is-777EV.tmp в %PROGRAM_FILES%\IDA\Languages\Irish.lng
%PROGRAM_FILES%\IDA\Languages\is-HQLSP.tmp в %PROGRAM_FILES%\IDA\Languages\Italian.lng
%PROGRAM_FILES%\IDA\Languages\is-PAI3V.tmp в %PROGRAM_FILES%\IDA\Languages\Hebrew.lng
%PROGRAM_FILES%\IDA\Languages\is-054ER.tmp в %PROGRAM_FILES%\IDA\Languages\Hindi.lng
%PROGRAM_FILES%\IDA\Languages\is-U6BPC.tmp в %PROGRAM_FILES%\IDA\Languages\Hungarian.lng
%PROGRAM_FILES%\IDA\Languages\is-63B9P.tmp в %PROGRAM_FILES%\IDA\Languages\Arabic.lng
%PROGRAM_FILES%\IDA\Languages\is-T10K5.tmp в %PROGRAM_FILES%\IDA\Languages\Belarusian.lng
%PROGRAM_FILES%\IDA\Languages\is-A1NT6.tmp в %PROGRAM_FILES%\IDA\Languages\Bosnian.lng
%PROGRAM_FILES%\IDA\Plugins\is-7IDLI.tmp в %PROGRAM_FILES%\IDA\Plugins\remotedownload.dll
%PROGRAM_FILES%\IDA\Plugins\is-807L9.tmp в %PROGRAM_FILES%\IDA\Plugins\videoserv.dll
%PROGRAM_FILES%\IDA\Languages\is-OFB25.tmp в %PROGRAM_FILES%\IDA\Languages\Albanian.lng
%PROGRAM_FILES%\IDA\Languages\is-92PPP.tmp в %PROGRAM_FILES%\IDA\Languages\Chinese(Traditional).lng
%PROGRAM_FILES%\IDA\Languages\is-K2QUH.tmp в %PROGRAM_FILES%\IDA\Languages\Croatian.lng
%PROGRAM_FILES%\IDA\Languages\is-QC4LL.tmp в %PROGRAM_FILES%\IDA\Languages\Czech.lng
%PROGRAM_FILES%\IDA\Languages\is-50JKJ.tmp в %PROGRAM_FILES%\IDA\Languages\Bulgarian.lng
%PROGRAM_FILES%\IDA\Languages\is-2LASU.tmp в %PROGRAM_FILES%\IDA\Languages\Chinese(Simplified).lng
%PROGRAM_FILES%\IDA\Languages\is-SS66S.tmp в %PROGRAM_FILES%\IDA\Languages\Chinese(Traditional) (in Simplified Chinese System).lng
%PROGRAM_FILES%\IDA\Languages\is-184I5.tmp в %PROGRAM_FILES%\IDA\Languages\Japanese.lng
%PROGRAM_FILES%\IDA\Languages\is-U2ARL.tmp в %PROGRAM_FILES%\IDA\Languages\Translit.lng
%PROGRAM_FILES%\IDA\Languages\is-LC2PP.tmp в %PROGRAM_FILES%\IDA\Languages\Turkish.lng
%PROGRAM_FILES%\IDA\Languages\is-QU0ML.tmp в %PROGRAM_FILES%\IDA\Languages\Turkish1.lng
%PROGRAM_FILES%\IDA\Languages\is-S31KJ.tmp в %PROGRAM_FILES%\IDA\Languages\Slovenian.lng
%PROGRAM_FILES%\IDA\Languages\is-MN91J.tmp в %PROGRAM_FILES%\IDA\Languages\Spanish.lng
%PROGRAM_FILES%\IDA\Languages\is-DFDLT.tmp в %PROGRAM_FILES%\IDA\Languages\Swedish.lng
%PROGRAM_FILES%\IDA\is-PU4J0.tmp в %PROGRAM_FILES%\IDA\license.txt
%PROGRAM_FILES%\IDA\is-OV2AT.tmp в %PROGRAM_FILES%\IDA\infoziplicense.txt
%PROGRAM_FILES%\IDA\is-9H8QP.tmp в %PROGRAM_FILES%\IDA\referers.txt
%PROGRAM_FILES%\IDA\Languages\is-SBT68.tmp в %PROGRAM_FILES%\IDA\Languages\Ukrainian.lng
%PROGRAM_FILES%\IDA\Languages\is-PTMGD.tmp в %PROGRAM_FILES%\IDA\Languages\Uzbek.lng
%PROGRAM_FILES%\IDA\Languages\is-8OJGF.tmp в %PROGRAM_FILES%\IDA\Languages\charsets.txt
%PROGRAM_FILES%\IDA\Languages\is-7NGTQ.tmp в %PROGRAM_FILES%\IDA\Languages\Persian.lng
%PROGRAM_FILES%\IDA\Languages\is-S68NG.tmp в %PROGRAM_FILES%\IDA\Languages\Polish.lng
%PROGRAM_FILES%\IDA\Languages\is-O54A8.tmp в %PROGRAM_FILES%\IDA\Languages\Portuguese(Brazil).lng
%PROGRAM_FILES%\IDA\Languages\is-D0ME5.tmp в %PROGRAM_FILES%\IDA\Languages\Korean.lng
%PROGRAM_FILES%\IDA\Languages\is-EV2GF.tmp в %PROGRAM_FILES%\IDA\Languages\Lithuanian.lng
%PROGRAM_FILES%\IDA\Languages\is-974BA.tmp в %PROGRAM_FILES%\IDA\Languages\Montenegrin.lng
%PROGRAM_FILES%\IDA\Languages\is-7S021.tmp в %PROGRAM_FILES%\IDA\Languages\Russian.lng
%PROGRAM_FILES%\IDA\Languages\is-5Q814.tmp в %PROGRAM_FILES%\IDA\Languages\Serbian.lng
%PROGRAM_FILES%\IDA\Languages\is-51J0R.tmp в %PROGRAM_FILES%\IDA\Languages\Slovak.lng
%PROGRAM_FILES%\IDA\Languages\is-B3D36.tmp в %PROGRAM_FILES%\IDA\Languages\Portuguese.lng
%PROGRAM_FILES%\IDA\Languages\is-RHR84.tmp в %PROGRAM_FILES%\IDA\Languages\Romanian.lng
%PROGRAM_FILES%\IDA\Languages\is-KTLA2.tmp в %PROGRAM_FILES%\IDA\Languages\Romanian_no_diacritics.lng
%PROGRAM_FILES%\IDA\Plugins\is-0PJNF.tmp в %PROGRAM_FILES%\IDA\Plugins\remotedownload.chm
%PROGRAM_FILES%\IDA\is-5BHK7.tmp в %PROGRAM_FILES%\IDA\ida-ff.xpi
%PROGRAM_FILES%\IDA\is-MQN9P.tmp в %PROGRAM_FILES%\IDA\idaremote.xpi
%PROGRAM_FILES%\IDA\is-F7CGP.tmp в %PROGRAM_FILES%\IDA\idamm.xpi
%PROGRAM_FILES%\IDA\is-SK128.tmp в %PROGRAM_FILES%\IDA\idaiehlp.dll
%PROGRAM_FILES%\IDA\is-Q25K5.tmp в %PROGRAM_FILES%\IDA\idabar.dll
%PROGRAM_FILES%\IDA\is-JA1PV.tmp в %PROGRAM_FILES%\IDA\idabar.xpi
%PROGRAM_FILES%\IDA\is-4Q27F.tmp в %PROGRAM_FILES%\IDA\unrar.dll
%PROGRAM_FILES%\IDA\is-5PGGF.tmp в %PROGRAM_FILES%\IDA\unzip32.dll
%PROGRAM_FILES%\IDA\is-76PIP.tmp в %PROGRAM_FILES%\IDA\html.htm
%PROGRAM_FILES%\IDA\is-MDQS1.tmp в %PROGRAM_FILES%\IDA\npida.dll
%PROGRAM_FILES%\IDA\is-D1VTH.tmp в %PROGRAM_FILES%\IDA\com.westbyte.ida.json
%PROGRAM_FILES%\IDA\is-LRJJA.tmp в %PROGRAM_FILES%\IDA\com.westbyte.ida.exe
%PROGRAM_FILES%\IDA\is-HJ2GG.tmp в %PROGRAM_FILES%\IDA\ida.chm
%PROGRAM_FILES%\IDA\is-1TK68.tmp в %PROGRAM_FILES%\IDA\hintf.bmp
%PROGRAM_FILES%\IDA\is-JN7A5.tmp в %PROGRAM_FILES%\IDA\nodelist.xml
%PROGRAM_FILES%\IDA\is-4J3I9.tmp в %PROGRAM_FILES%\IDA\unins000.exe
%PROGRAM_FILES%\IDA\is-0RTV9.tmp в %PROGRAM_FILES%\IDA\downloader.exe
%PROGRAM_FILES%\IDA\is-6TMOK.tmp в %PROGRAM_FILES%\IDA\ida.exe
%PROGRAM_FILES%\IDA\is-H6FKS.tmp в %PROGRAM_FILES%\IDA\idaie.htm
%PROGRAM_FILES%\IDA\is-H5NQH.tmp в %PROGRAM_FILES%\IDA\idaieall.htm
%PROGRAM_FILES%\IDA\is-UHJ84.tmp в %PROGRAM_FILES%\IDA\goback.htm
%PROGRAM_FILES%\IDA\is-JEKI0.tmp в %PROGRAM_FILES%\IDA\lvcolors.cfg
%PROGRAM_FILES%\IDA\is-PL2UF.tmp в %PROGRAM_FILES%\IDA\typeconn.cfg
%PROGRAM_FILES%\IDA\is-3PFN0.tmp в %PROGRAM_FILES%\IDA\idaie.dll
%PROGRAM_FILES%\IDA\is-7MN8J.tmp в %PROGRAM_FILES%\IDA\remdown.htm
%PROGRAM_FILES%\IDA\temp\is-44U2F.tmp в %PROGRAM_FILES%\IDA\temp\dban_id2.gif
%PROGRAM_FILES%\IDA\Sounds\is-4MV6B.tmp в %PROGRAM_FILES%\IDA\Sounds\add.wav
%PROGRAM_FILES%\IDA\Sounds\is-B4C9R.tmp в %PROGRAM_FILES%\IDA\Sounds\alldone.wav
%PROGRAM_FILES%\IDA\temp\is-R7N20.tmp в %PROGRAM_FILES%\IDA\temp\dban_b1.gif
%PROGRAM_FILES%\IDA\temp\is-TVM16.tmp в %PROGRAM_FILES%\IDA\temp\dban_b2.gif
%PROGRAM_FILES%\IDA\temp\is-HR82B.tmp в %PROGRAM_FILES%\IDA\temp\dban_id1.gif
%PROGRAM_FILES%\IDA\Skins\is-I7BNC.tmp в %PROGRAM_FILES%\IDA\Skins\Standard2.skn
%PROGRAM_FILES%\IDA\Plugins\is-U58VC.tmp в %PROGRAM_FILES%\IDA\Plugins\advscheduler.chm
%PROGRAM_FILES%\IDA\Plugins\is-7N8PG.tmp в %PROGRAM_FILES%\IDA\Plugins\advscheduler.dll
%PROGRAM_FILES%\IDA\Sounds\is-OVRCK.tmp в %PROGRAM_FILES%\IDA\Sounds\done.wav
%PROGRAM_FILES%\IDA\Sounds\is-LSIGS.tmp в %PROGRAM_FILES%\IDA\Sounds\error.wav
%PROGRAM_FILES%\IDA\Skins\is-2B8L8.tmp в %PROGRAM_FILES%\IDA\Skins\Standard.skn
%PROGRAM_FILES%\IDA\is-IGHNE.tmp в %PROGRAM_FILES%\IDA\playflvimg.jpg
%PROGRAM_FILES%\IDA\is-G9QQ2.tmp в %PROGRAM_FILES%\IDA\games.url
%PROGRAM_FILES%\IDA\is-C9L3H.tmp в %PROGRAM_FILES%\IDA\games.ico
%PROGRAM_FILES%\IDA\is-7S58V.tmp в %PROGRAM_FILES%\IDA\flvplayer.swf
%PROGRAM_FILES%\IDA\is-TVJB2.tmp в %PROGRAM_FILES%\IDA\playflv.html
%PROGRAM_FILES%\IDA\is-329MO.tmp в %PROGRAM_FILES%\IDA\swfobject.js
%PROGRAM_FILES%\IDA\temp\is-IE6LL.tmp в %PROGRAM_FILES%\IDA\temp\dban3.gif
%PROGRAM_FILES%\IDA\temp\is-90BPP.tmp в %PROGRAM_FILES%\IDA\temp\dban4.gif
%PROGRAM_FILES%\IDA\temp\is-TU3CK.tmp в %PROGRAM_FILES%\IDA\temp\dbans.lnk
%PROGRAM_FILES%\IDA\temp\is-8K105.tmp в %PROGRAM_FILES%\IDA\temp\dban0.gif
%PROGRAM_FILES%\IDA\temp\is-HLEHG.tmp в %PROGRAM_FILES%\IDA\temp\dban1.gif
%PROGRAM_FILES%\IDA\temp\is-0AKJG.tmp в %PROGRAM_FILES%\IDA\temp\dban2.gif

Сетевая активность:

Подключается к:

'www.we###yte.com':80
'localhost':1038

TCP:

Запросы HTTP GET:

www.we###yte.com/ida/start/

UDP:

DNS ASK www.we###yte.com

Другое:

Ищет следующие окна:

ClassName: 'MS_AutodialMonitor' WindowName: ''
ClassName: 'MS_WebcheckMonitor' WindowName: ''
ClassName: 'Indicator' WindowName: ''
ClassName: 'Shell_TrayWnd' WindowName: ''
ClassName: '' WindowName: ''
ClassName: 'ReBarWindow32' WindowName: ''

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней