Adware.Conduit.13

Техническая информация

Вредоносные функции:

Создает и запускает на исполнение:

'%TEMP%\setup.exe'
'%TEMP%\setup.exe' (загружен из сети Интернет)

Запускает на исполнение:

'<SYSTEM32>\svchost.exe' -k swprv
'<SYSTEM32>\vssvc.exe'

Изменения в файловой системе:

Создает следующие файлы:

<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\6P5SDOMI\download[1].php
%TEMP%\setu5c61.rra
%PROGRAM_FILES%\InstallShield Installation Information\{74A159FA-5698-249A-A220-901E78D6B3F2}\layo8eb7.rra
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Interactive Clownfish Wallpaper\Uninstall ClownfishWallpaper.lnk
%TEMP%\{BC2B4385-ED26-419E-A18C-0071232A38AD}\{74A159FA-5698-249A-A220-901E78D6B3F2}\defa1b5c.rra
%TEMP%\{BC2B4385-ED26-419E-A18C-0071232A38AD}\{74A159FA-5698-249A-A220-901E78D6B3F2}\_IsR1c37.rra
%TEMP%\{BC2B4385-ED26-419E-A18C-0071232A38AD}\{74A159FA-5698-249A-A220-901E78D6B3F2}\difx1cf2.rra
%PROGRAM_FILES%\InstallShield Installation Information\{74A159FA-5698-249A-A220-901E78D6B3F2}\data8f72.rra
%PROGRAM_FILES%\InstallShield Installation Information\{74A159FA-5698-249A-A220-901E78D6B3F2}\setu93a7.rra
%PROGRAM_FILES%\InstallShield Installation Information\{74A159FA-5698-249A-A220-901E78D6B3F2}\setup.ini
%WINDIR%\rClo94ee.rra
%PROGRAM_FILES%\InstallShield Installation Information\{74A159FA-5698-249A-A220-901E78D6B3F2}\ISSe929e.rra
%PROGRAM_FILES%\InstallShield Installation Information\{74A159FA-5698-249A-A220-901E78D6B3F2}\data907c.rra
%PROGRAM_FILES%\InstallShield Installation Information\{74A159FA-5698-249A-A220-901E78D6B3F2}\setu9185.rra
%PROGRAM_FILES%\InstallShield Installation Information\{74A159FA-5698-249A-A220-901E78D6B3F2}\_Set9211.rra
%TEMP%\{BC2B4385-ED26-419E-A18C-0071232A38AD}\{74A159FA-5698-249A-A220-901E78D6B3F2}\isrt1adf.rra
%TEMP%\{D439E8B2-8461-4DBB-B65E-E53F64B7213D}\Disk1\setup.exe
%TEMP%\{D439E8B2-8461-4DBB-B65E-E53F64B7213D}\Disk1\setup.ini
%TEMP%\{D439E8B2-8461-4DBB-B65E-E53F64B7213D}\Disk1\_Setup.dll
%TEMP%\{D439E8B2-8461-4DBB-B65E-E53F64B7213D}\Disk1\layout.bin
%TEMP%\{D439E8B2-8461-4DBB-B65E-E53F64B7213D}\Disk1\data1.cab
%TEMP%\{D439E8B2-8461-4DBB-B65E-E53F64B7213D}\Disk1\data1.hdr
%TEMP%\{D439E8B2-8461-4DBB-B65E-E53F64B7213D}\Disk1\ISSetup.dll
%TEMP%\{D439E8B2-8461-4DBB-B65E-E53F64B7213D}\_Setup.dll
%TEMP%\{BC2B4385-ED26-419E-A18C-0071232A38AD}\{74A159FA-5698-249A-A220-901E78D6B3F2}\Font18dd.rra
%TEMP%\{BC2B4385-ED26-419E-A18C-0071232A38AD}\{74A159FA-5698-249A-A220-901E78D6B3F2}\DIFx1959.rra
%TEMP%\{BC2B4385-ED26-419E-A18C-0071232A38AD}\{74A159FA-5698-249A-A220-901E78D6B3F2}\Stri19f5.rra
%TEMP%\{BC2B4385-ED26-419E-A18C-0071232A38AD}\dotn1841.rra
%TEMP%\{D439E8B2-8461-4DBB-B65E-E53F64B7213D}\setup.ini
%TEMP%\{BC2B4385-ED26-419E-A18C-0071232A38AD}\{74A159FA-5698-249A-A220-901E78D6B3F2}\setu1515.rra
%TEMP%\{BC2B4385-ED26-419E-A18C-0071232A38AD}\core17d3.rra

Перемещает следующие файлы:

%PROGRAM_FILES%\InstallShield Installation Information\{74A159FA-5698-249A-A220-901E78D6B3F2}\data8f72.rra в %PROGRAM_FILES%\InstallShield Installation Information\{74A159FA-5698-249A-A220-901E78D6B3F2}\data1.hdr
%PROGRAM_FILES%\InstallShield Installation Information\{74A159FA-5698-249A-A220-901E78D6B3F2}\data907c.rra в %PROGRAM_FILES%\InstallShield Installation Information\{74A159FA-5698-249A-A220-901E78D6B3F2}\data1.cab
%TEMP%\setu5c61.rra в %TEMP%\setup.exe
%PROGRAM_FILES%\InstallShield Installation Information\{74A159FA-5698-249A-A220-901E78D6B3F2}\layo8eb7.rra в %PROGRAM_FILES%\InstallShield Installation Information\{74A159FA-5698-249A-A220-901E78D6B3F2}\layout.bin
%PROGRAM_FILES%\InstallShield Installation Information\{74A159FA-5698-249A-A220-901E78D6B3F2}\setu9185.rra в %PROGRAM_FILES%\InstallShield Installation Information\{74A159FA-5698-249A-A220-901E78D6B3F2}\setup.exe
%PROGRAM_FILES%\InstallShield Installation Information\{74A159FA-5698-249A-A220-901E78D6B3F2}\setu93a7.rra в %PROGRAM_FILES%\InstallShield Installation Information\{74A159FA-5698-249A-A220-901E78D6B3F2}\setup.ini
%WINDIR%\rClo94ee.rra в %WINDIR%\rClownFish.exe
%PROGRAM_FILES%\InstallShield Installation Information\{74A159FA-5698-249A-A220-901E78D6B3F2}\_Set9211.rra в %PROGRAM_FILES%\InstallShield Installation Information\{74A159FA-5698-249A-A220-901E78D6B3F2}\_Setup.dll
%PROGRAM_FILES%\InstallShield Installation Information\{74A159FA-5698-249A-A220-901E78D6B3F2}\ISSe929e.rra в %PROGRAM_FILES%\InstallShield Installation Information\{74A159FA-5698-249A-A220-901E78D6B3F2}\ISSetup.dll
%TEMP%\{BC2B4385-ED26-419E-A18C-0071232A38AD}\{74A159FA-5698-249A-A220-901E78D6B3F2}\difx1cf2.rra в %TEMP%\{BC2B4385-ED26-419E-A18C-0071232A38AD}\{74A159FA-5698-249A-A220-901E78D6B3F2}\difxapi.dll
%TEMP%\{BC2B4385-ED26-419E-A18C-0071232A38AD}\dotn1841.rra в %TEMP%\{BC2B4385-ED26-419E-A18C-0071232A38AD}\dotnetinstaller.exe
%TEMP%\{BC2B4385-ED26-419E-A18C-0071232A38AD}\{74A159FA-5698-249A-A220-901E78D6B3F2}\Font18dd.rra в %TEMP%\{BC2B4385-ED26-419E-A18C-0071232A38AD}\{74A159FA-5698-249A-A220-901E78D6B3F2}\FontData.ini
%TEMP%\{BC2B4385-ED26-419E-A18C-0071232A38AD}\{74A159FA-5698-249A-A220-901E78D6B3F2}\setu1515.rra в %TEMP%\{BC2B4385-ED26-419E-A18C-0071232A38AD}\{74A159FA-5698-249A-A220-901E78D6B3F2}\setup.inx
%TEMP%\{BC2B4385-ED26-419E-A18C-0071232A38AD}\core17d3.rra в %TEMP%\{BC2B4385-ED26-419E-A18C-0071232A38AD}\corecomp.ini
%TEMP%\{BC2B4385-ED26-419E-A18C-0071232A38AD}\{74A159FA-5698-249A-A220-901E78D6B3F2}\DIFx1959.rra в %TEMP%\{BC2B4385-ED26-419E-A18C-0071232A38AD}\{74A159FA-5698-249A-A220-901E78D6B3F2}\DIFxData.ini
%TEMP%\{BC2B4385-ED26-419E-A18C-0071232A38AD}\{74A159FA-5698-249A-A220-901E78D6B3F2}\defa1b5c.rra в %TEMP%\{BC2B4385-ED26-419E-A18C-0071232A38AD}\{74A159FA-5698-249A-A220-901E78D6B3F2}\default.pal
%TEMP%\{BC2B4385-ED26-419E-A18C-0071232A38AD}\{74A159FA-5698-249A-A220-901E78D6B3F2}\_IsR1c37.rra в %TEMP%\{BC2B4385-ED26-419E-A18C-0071232A38AD}\{74A159FA-5698-249A-A220-901E78D6B3F2}\_IsRes.dll
%TEMP%\{BC2B4385-ED26-419E-A18C-0071232A38AD}\{74A159FA-5698-249A-A220-901E78D6B3F2}\Stri19f5.rra в %TEMP%\{BC2B4385-ED26-419E-A18C-0071232A38AD}\{74A159FA-5698-249A-A220-901E78D6B3F2}\StringTable-0009-English.ips
%TEMP%\{BC2B4385-ED26-419E-A18C-0071232A38AD}\{74A159FA-5698-249A-A220-901E78D6B3F2}\isrt1adf.rra в %TEMP%\{BC2B4385-ED26-419E-A18C-0071232A38AD}\{74A159FA-5698-249A-A220-901E78D6B3F2}\isrt.dll