Техническая информация
Вредоносные функции:
Создает и запускает на исполнение:
- '%PROGRAM_FILES%\adware_cleanup\rkill.com' -s -l logs/rkill.log
Запускает на исполнение:
- '<SYSTEM32>\ping.exe' 127.0.0.1
Завершает или пытается завершить
следующие пользовательские процессы:
- iexplore.exe
- safari.exe
- chrome.exe
- firefox.exe
Изменения в файловой системе:
Создает следующие файлы:
- %PROGRAM_FILES%\adware_cleanup\jrt\IEwhtlst.cfg
- %PROGRAM_FILES%\adware_cleanup\jrt\iexplore.bat
- %PROGRAM_FILES%\adware_cleanup\jrt\GREP.DAT
- %PROGRAM_FILES%\adware_cleanup\jrt\firefox.bat
- %PROGRAM_FILES%\adware_cleanup\jrt\get.bat
- %PROGRAM_FILES%\adware_cleanup\jrt\IE_open_x64.reg
- %PROGRAM_FILES%\adware_cleanup\jrt\libintl3.dll
- %PROGRAM_FILES%\adware_cleanup\jrt\medfos.bat
- %PROGRAM_FILES%\adware_cleanup\jrt\libiconv2.dll
- %PROGRAM_FILES%\adware_cleanup\jrt\IE_open_x86.reg
- %PROGRAM_FILES%\adware_cleanup\jrt\IFEO.dat
- %PROGRAM_FILES%\adware_cleanup\jrt\FFprefs.dat
- %PROGRAM_FILES%\adware_cleanup\jrt\FFregkey_x64.dat
- %PROGRAM_FILES%\adware_cleanup\jrt\FFplugins.dat
- %PROGRAM_FILES%\adware_cleanup\jrt\FFextensions.dat
- %PROGRAM_FILES%\adware_cleanup\jrt\FFpluginREG.dat
- %PROGRAM_FILES%\adware_cleanup\jrt\FFregkey_x86.dat
- %PROGRAM_FILES%\adware_cleanup\jrt\FF_open_x64.reg
- %PROGRAM_FILES%\adware_cleanup\jrt\FF_open_x86.reg
- %PROGRAM_FILES%\adware_cleanup\jrt\FFXPI.dat
- %PROGRAM_FILES%\adware_cleanup\jrt\FFwhtlist.cfg
- %PROGRAM_FILES%\adware_cleanup\jrt\FFXML.dat
- %PROGRAM_FILES%\adware_cleanup\jrt\misc.bat
- %PROGRAM_FILES%\adware_cleanup\jrt\surfvox.bat
- %PROGRAM_FILES%\adware_cleanup\jrt\TDL4.bat
- %PROGRAM_FILES%\adware_cleanup\jrt\SHORTCUT.DAT
- %PROGRAM_FILES%\adware_cleanup\jrt\services.dat
- %PROGRAM_FILES%\adware_cleanup\jrt\serviceseventlog.cfg
- %PROGRAM_FILES%\adware_cleanup\jrt\WGET.DAT
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\3C83474D61E624A4F9844DF935AFE217
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\3C83474D61E624A4F9844DF935AFE217
- %PROGRAM_FILES%\adware_cleanup\logs\rkill.log
- %PROGRAM_FILES%\adware_cleanup\jrt\winlogon.reg
- %PROGRAM_FILES%\adware_cleanup\jrt\newmd5.txt
- %PROGRAM_FILES%\adware_cleanup\jrt\prelim.bat
- %PROGRAM_FILES%\adware_cleanup\jrt\regex2.dll
- %PROGRAM_FILES%\adware_cleanup\jrt\pcre3.dll
- %PROGRAM_FILES%\adware_cleanup\jrt\mws.bat
- %PROGRAM_FILES%\adware_cleanup\jrt\NIRCMD.DAT
- %PROGRAM_FILES%\adware_cleanup\jrt\runvalues.bat
- %PROGRAM_FILES%\adware_cleanup\jrt\SED.DAT
- %PROGRAM_FILES%\adware_cleanup\jrt\sednewline.txt
- %PROGRAM_FILES%\adware_cleanup\jrt\searchlnk.bat
- %PROGRAM_FILES%\adware_cleanup\jrt\runvalues_x64.cfg
- %PROGRAM_FILES%\adware_cleanup\jrt\runvalues_x86.cfg
- %PROGRAM_FILES%\adware_cleanup\jrt\FFbrowsermngr.dat
- %PROGRAM_FILES%\adware_cleanup\jrt\askservices.dat
- %PROGRAM_FILES%\adware_cleanup\jrt\badAPPINIT.dat
- %PROGRAM_FILES%\adware_cleanup\jrt\askregvalue_x86.dat
- %PROGRAM_FILES%\adware_cleanup\jrt\askregkey_x86.dat
- %PROGRAM_FILES%\adware_cleanup\jrt\askregvalue_x64.dat
- %PROGRAM_FILES%\adware_cleanup\jrt\badFOLDERS.cfg
- %PROGRAM_FILES%\adware_cleanup\jrt\badvalues.cfg
- %PROGRAM_FILES%\adware_cleanup\jrt\BHO_clsid.dat
- %PROGRAM_FILES%\adware_cleanup\jrt\badLNK.cfg
- %PROGRAM_FILES%\adware_cleanup\jrt\badFOLDERScom.cfg
- %PROGRAM_FILES%\adware_cleanup\jrt\badFOLDERSstart.cfg
- %PROGRAM_FILES%\adware_cleanup\run_jrt_batch.bat
- %PROGRAM_FILES%\adware_cleanup\run_rkill_batch.bat
- %PROGRAM_FILES%\adware_cleanup\run_cleanup.bat
- %PROGRAM_FILES%\adware_cleanup\elevate.exe
- %PROGRAM_FILES%\adware_cleanup\rkill.com
- %PROGRAM_FILES%\adware_cleanup\run_rkill_jrt.bat
- %PROGRAM_FILES%\adware_cleanup\jrt\askCLSID.dat
- %PROGRAM_FILES%\adware_cleanup\jrt\askregkey_x64.dat
- %PROGRAM_FILES%\adware_cleanup\jrt\ask.bat
- %PROGRAM_FILES%\adware_cleanup\jrt\appinit64_null.reg
- %PROGRAM_FILES%\adware_cleanup\jrt\appinit_null.reg
- %PROGRAM_FILES%\adware_cleanup\jrt\BHO_name.dat
- %PROGRAM_FILES%\adware_cleanup\jrt\delfolders.bat
- %PROGRAM_FILES%\adware_cleanup\jrt\erunt\ERDNT.E_E
- %PROGRAM_FILES%\adware_cleanup\jrt\defaultscope.cfg
- %PROGRAM_FILES%\adware_cleanup\jrt\CUT.DAT
- %PROGRAM_FILES%\adware_cleanup\jrt\datamngr_del.reg
- %PROGRAM_FILES%\adware_cleanup\jrt\erunt\ERDNTDOS.LOC
- %PROGRAM_FILES%\adware_cleanup\jrt\erunt\README.TXT
- %PROGRAM_FILES%\adware_cleanup\jrt\ev_clear.bat
- %PROGRAM_FILES%\adware_cleanup\jrt\erunt\ERUNT.LOC
- %PROGRAM_FILES%\adware_cleanup\jrt\erunt\ERDNTWIN.LOC
- %PROGRAM_FILES%\adware_cleanup\jrt\erunt\ERUNT.EXE
- %PROGRAM_FILES%\adware_cleanup\jrt\chrome.bat
- %PROGRAM_FILES%\adware_cleanup\jrt\CHRregkey_x64.cfg
- %PROGRAM_FILES%\adware_cleanup\jrt\CHOICE.DAT
- %PROGRAM_FILES%\adware_cleanup\jrt\browsermngr_keys.cfg
- %PROGRAM_FILES%\adware_cleanup\jrt\browsermngr_values.cfg
- %PROGRAM_FILES%\adware_cleanup\jrt\CHRregkey_x86.cfg
- %PROGRAM_FILES%\adware_cleanup\jrt\clean_shortcut.vbs
- %PROGRAM_FILES%\adware_cleanup\jrt\currentmd5.txt
- %PROGRAM_FILES%\adware_cleanup\jrt\CHR_open_x86.reg
- %PROGRAM_FILES%\adware_cleanup\jrt\CHR_extensions.cfg
- %PROGRAM_FILES%\adware_cleanup\jrt\CHR_open_x64.reg
Сетевая активность:
Подключается к:
- '20#.#6.232.182':80
- 'wp#d':80
TCP:
Запросы HTTP GET:
- 20#.#6.232.182/pki/crl/products/WindowsPCA.crl
- wp#d/wpad.dat
UDP:
- DNS ASK crl.microsoft.com
- DNS ASK wp#d
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'EDIT' WindowName: ''
