Trojan.Ormes.67

Техническая информация

Вредоносные функции:

Завершает или пытается завершить

следующие пользовательские процессы:

firefox.exe
opera.exe
chrome.exe

Изменения в файловой системе:

Создает следующие файлы:

%APPDATA%\Roaming\Opera Software\Opera Stable\Extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\1.0.3\icons\icon48.png
%APPDATA%\Roaming\Opera Software\Opera Stable\Extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\1.0.3\icons\icon32.png
%APPDATA%\Roaming\Opera Software\Opera Stable\Extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\1.0.3\icons\icon19.png
%APPDATA%\Roaming\Opera Software\Opera Stable\Extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\1.0.3\main_compiled.js
%APPDATA%\Roaming\Opera Software\Opera Stable\Extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\1.0.3\KEVhfkBCATr.js
%APPDATA%\Roaming\Opera Software\Opera Stable\Extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\1.0.3\injection.js
%APPDATA%\Roaming\Opera Software\Opera Stable\Extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\1.0.3\background.js
%APPDATA%\Roaming\Opera Software\Opera Stable\Extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\1.0.3\aTnroVftixUhL.js
<LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\1.0.3\TAqecrAyFsRj.js
%APPDATA%\Roaming\Opera Software\Opera Stable\Extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\1.0.3\icons\icon16.png
%APPDATA%\Roaming\Opera Software\Opera Stable\Extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\1.0.3\icons\icon128.png
%APPDATA%\Roaming\Opera Software\Opera Stable\Extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\1.0.3\gWqeRBCTeE.js
%APPDATA%\Roaming\Opera Software\Opera Stable\Extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\1.0.3\manifest.json
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\likenetwork@world-stream.info\chrome\pics\pic.png
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\likenetwork@world-stream.info\chrome\content\tEwhSInmdyMNMUh.js
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\likenetwork@world-stream.info\chrome\content\jGiDaZQqGCFp.js
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\likenetwork@world-stream.info\install.rdf
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\likenetwork@world-stream.info\chrome.manifest
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\likenetwork@world-stream.info\chrome\pics\pic64.png
%APPDATA%\Roaming\Opera Software\Opera Stable\Extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\1.0.3\options_css_compiled.css
%APPDATA%\Roaming\Opera Software\Opera Stable\Extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\1.0.3\options_compiled.js
%APPDATA%\Roaming\Opera Software\Opera Stable\Extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\1.0.3\options.html
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\likenetwork@world-stream.info\chrome\content\ff-overlay.xul
%APPDATA%\Roaming\Opera Software\Opera Stable\Extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\1.0.3\TAqecrAyFsRj.js
%APPDATA%\Roaming\Opera Software\Opera Stable\Extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\1.0.3\options_ui.js
<Текущая директория>\removeSAddons.bat
%TEMP%\GInstallAddons_temp\xml\opera_im2_widgets.xml
%TEMP%\GInstallAddons_temp\xml\opera_im2_widget_data.xml
<LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\1.0.3\gWqeRBCTeE.js
<LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\1.0.3\background.js
<LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\1.0.3\aTnroVftixUhL.js
%TEMP%\GInstallAddons_temp\addons\im2.oex
%TEMP%\GInstallAddons_temp\addons\im2_new.crx
%TEMP%\GInstallAddons_temp\addons\im2.crx
%TEMP%\GInstallAddons_temp\json\firefox_im2_settings.json
%TEMP%\GInstallAddons_temp\json\chrome_im2_preferences.json
%TEMP%\GInstallAddons_temp\addons\im2.xpi
<LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\1.0.3\icons\icon128.png
<LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\1.0.3\options.html
<LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\1.0.3\manifest.json
<LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\1.0.3\main_compiled.js
<LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\1.0.3\options_ui.js
<LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\1.0.3\options_css_compiled.css
<LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\1.0.3\options_compiled.js
<LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\1.0.3\icons\icon32.png
<LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\1.0.3\icons\icon19.png
<LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\1.0.3\icons\icon16.png
<LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\1.0.3\KEVhfkBCATr.js
<LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\1.0.3\injection.js
<LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb\1.0.3\icons\icon48.png