Trojan.WebPick.3635

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Optimizer Pro' = '%PROGRAM_FILES%\Optimizer Pro 3.38\OptProLauncher.exe'

Создает или изменяет следующие файлы:

%HOMEPATH%\Start Menu\Programs\Startup\<Имя вируса>.lnk

Вредоносные функции:

Создает и запускает на исполнение:

'%TEMP%\is-GVASL.tmp\optprosetup.tmp' /SL5="$30092,5164504,115200,%TEMP%\optprosetup.exe" /VERYSILENT /MMJS /insid=18336069890896562333
'%TEMP%\optprosetup.exe' /VERYSILENT /MMJS /insid=18336069890896562333

Изменения в файловой системе:

Создает следующие файлы:

%PROGRAM_FILES%\Optimizer Pro 3.38\is-95S4M.tmp
%PROGRAM_FILES%\Optimizer Pro 3.38\is-ML3A2.tmp
%PROGRAM_FILES%\Optimizer Pro 3.38\is-MK9CG.tmp
%PROGRAM_FILES%\Optimizer Pro 3.38\is-CDQS4.tmp
%PROGRAM_FILES%\Optimizer Pro 3.38\is-5ONNC.tmp
%PROGRAM_FILES%\Optimizer Pro 3.38\is-PDK84.tmp
%PROGRAM_FILES%\Optimizer Pro 3.38\is-9CGNJ.tmp
%PROGRAM_FILES%\Optimizer Pro 3.38\is-0V5M3.tmp
%PROGRAM_FILES%\Optimizer Pro 3.38\is-B9KC3.tmp
%PROGRAM_FILES%\Optimizer Pro 3.38\is-FH26K.tmp
%ALLUSERSPROFILE%\Start Menu\Programs\Optimizer Pro v3.2\Check updates.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Optimizer Pro v3.2\Uninstall Optimizer Pro.lnk
%PROGRAM_FILES%\Optimizer Pro 3.38\unins000.dat
%PROGRAM_FILES%\Optimizer Pro 3.38\unins000.msg
%ALLUSERSPROFILE%\Start Menu\Programs\Optimizer Pro v3.2\Optimizer Pro on the Web.lnk
%HOMEPATH%\Desktop\Optimizer Pro.lnk
%PROGRAM_FILES%\Optimizer Pro 3.38\is-5VNIG.tmp
%ALLUSERSPROFILE%\Start Menu\Programs\Optimizer Pro v3.2\Help.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Optimizer Pro v3.2\Optimizer Pro.lnk
%TEMP%\is-LFK4N.tmp\itdownload.dll
%TEMP%\is-LFK4N.tmp\OptProHelper.dll
%PROGRAM_FILES%\Optimizer Pro 3.38\is-K9G0N.tmp
%TEMP%\is-LFK4N.tmp\OptProMon.dll
%TEMP%\is-LFK4N.tmp\_isetup\_shfoldr.dll
%ALLUSERSPROFILE%\Application Data\{67ef2e10-f136-fe2c-67ef-f2e10f13b843}\<Имя вируса>.dat
%ALLUSERSPROFILE%\Application Data\{67ef2e10-f136-fe2c-67ef-f2e10f13b843}\<Имя вируса>.exe
%TEMP%\is-GVASL.tmp\optprosetup.tmp
%TEMP%\optprosetup.exe
%PROGRAM_FILES%\Optimizer Pro 3.38\is-R9KQ0.tmp
%PROGRAM_FILES%\Optimizer Pro 3.38\is-QFOL3.tmp
%PROGRAM_FILES%\Optimizer Pro 3.38\is-QQD4C.tmp
%PROGRAM_FILES%\Optimizer Pro 3.38\is-DIK4B.tmp
%PROGRAM_FILES%\Optimizer Pro 3.38\is-LGQDU.tmp
%PROGRAM_FILES%\Optimizer Pro 3.38\is-49353.tmp
%PROGRAM_FILES%\Optimizer Pro 3.38\is-8VQ90.tmp
%PROGRAM_FILES%\Optimizer Pro 3.38\is-PPJQK.tmp
%PROGRAM_FILES%\Optimizer Pro 3.38\is-2RC3F.tmp
%PROGRAM_FILES%\Optimizer Pro 3.38\is-H1R97.tmp

Перемещает следующие файлы:

%PROGRAM_FILES%\Optimizer Pro 3.38\is-0V5M3.tmp в %PROGRAM_FILES%\Optimizer Pro 3.38\OptimizerPro.chm
%PROGRAM_FILES%\Optimizer Pro 3.38\is-5ONNC.tmp в %PROGRAM_FILES%\Optimizer Pro 3.38\file_id.diz
%PROGRAM_FILES%\Optimizer Pro 3.38\is-B9KC3.tmp в %PROGRAM_FILES%\Optimizer Pro 3.38\English.ini
%PROGRAM_FILES%\Optimizer Pro 3.38\is-9CGNJ.tmp в %PROGRAM_FILES%\Optimizer Pro 3.38\StartupList.txt
%PROGRAM_FILES%\Optimizer Pro 3.38\is-PDK84.tmp в %PROGRAM_FILES%\Optimizer Pro 3.38\CookiesException.txt
%PROGRAM_FILES%\Optimizer Pro 3.38\is-ML3A2.tmp в %PROGRAM_FILES%\Optimizer Pro 3.38\HomePage.url
%PROGRAM_FILES%\Optimizer Pro 3.38\is-FH26K.tmp в %PROGRAM_FILES%\Optimizer Pro 3.38\OptProHelper.dll
%PROGRAM_FILES%\Optimizer Pro 3.38\is-5VNIG.tmp в %PROGRAM_FILES%\Optimizer Pro 3.38\itdownload.dll
%PROGRAM_FILES%\Optimizer Pro 3.38\is-MK9CG.tmp в %PROGRAM_FILES%\Optimizer Pro 3.38\cancel.bmp
%PROGRAM_FILES%\Optimizer Pro 3.38\is-95S4M.tmp в %PROGRAM_FILES%\Optimizer Pro 3.38\bg_new3.bmp
%PROGRAM_FILES%\Optimizer Pro 3.38\is-CDQS4.tmp в %PROGRAM_FILES%\Optimizer Pro 3.38\bg_new4.bmp
%PROGRAM_FILES%\Optimizer Pro 3.38\is-8VQ90.tmp в %PROGRAM_FILES%\Optimizer Pro 3.38\OptProReminder.exe
%PROGRAM_FILES%\Optimizer Pro 3.38\is-H1R97.tmp в %PROGRAM_FILES%\Optimizer Pro 3.38\OptProSmartScan.exe
%PROGRAM_FILES%\Optimizer Pro 3.38\is-PPJQK.tmp в %PROGRAM_FILES%\Optimizer Pro 3.38\OptProStart.exe
%PROGRAM_FILES%\Optimizer Pro 3.38\is-K9G0N.tmp в %PROGRAM_FILES%\Optimizer Pro 3.38\unins000.exe
%PROGRAM_FILES%\Optimizer Pro 3.38\is-R9KQ0.tmp в %PROGRAM_FILES%\Optimizer Pro 3.38\OptimizerPro.exe
%PROGRAM_FILES%\Optimizer Pro 3.38\is-2RC3F.tmp в %PROGRAM_FILES%\Optimizer Pro 3.38\OptProGuard.exe
%PROGRAM_FILES%\Optimizer Pro 3.38\is-LGQDU.tmp в %PROGRAM_FILES%\Optimizer Pro 3.38\sqlite3.dll
%PROGRAM_FILES%\Optimizer Pro 3.38\is-DIK4B.tmp в %PROGRAM_FILES%\Optimizer Pro 3.38\scan.gif
%PROGRAM_FILES%\Optimizer Pro 3.38\is-QFOL3.tmp в %PROGRAM_FILES%\Optimizer Pro 3.38\OptProUninstaller.exe
%PROGRAM_FILES%\Optimizer Pro 3.38\is-49353.tmp в %PROGRAM_FILES%\Optimizer Pro 3.38\OptProSchedule.exe
%PROGRAM_FILES%\Optimizer Pro 3.38\is-QQD4C.tmp в %PROGRAM_FILES%\Optimizer Pro 3.38\OptProLauncher.exe

Сетевая активность:

Подключается к:

'op###izepro.biz':80
'op##ro.info':80
'www.bb#.com':80
'74.##5.232.51':80
'15#.#66.255.19':80

TCP:

Запросы HTTP GET:

op###izepro.biz/inst?si#################################################
op###izepro.biz/inst?hi########################################################################################################################################################

Запросы HTTP POST: