Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'wextract_cleanup0' = 'rundll32.exe <SYSTEM32>\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'ApplyGroupPolicy' = '<SYSTEM32>\KUGroupPolicy.EXE'
Вредоносные функции:
Запускает на исполнение:
- '%TEMP%\IXP000.TMP\IE-REDIST.EXE' /ieak-full:%TEMP%\IXP000.TMP\ /update-no /passive /forcerestart
- 'C:\28041066a0f00d0a69\update\iesetup.exe' /ieak-full:%TEMP%\IXP000.TMP\ /update-no /passive /forcerestart
- '<SYSTEM32>\logonui.exe' /status /shutdown
- '<SYSTEM32>\taskkill.exe' /F /IM iexplore.exe /T
- '<SYSTEM32>\tskill.exe' iexplore.exe /A
- '<SYSTEM32>\cmd.exe' /c %TEMP%\IXP000.TMP\IE-Setup.cmd /update-no /passive /forcerestart
Завершает или пытается завершить
следующие пользовательские процессы:
- iexplore.exe
Пытается завершить работу операционной системы Windows.
Изменения в файловой системе:
Создает следующие файлы:
- C:\28041066a0f00d0a69\iertutil.dll.mui
- C:\28041066a0f00d0a69\iernonce.dll.mui
- C:\28041066a0f00d0a69\iesetup.dll.mui
- C:\28041066a0f00d0a69\ieui.dll.mui
- C:\28041066a0f00d0a69\ieudinit.exe.mui
- C:\28041066a0f00d0a69\iedkcs32.dll.mui
- C:\28041066a0f00d0a69\ieakui.dll.mui
- C:\28041066a0f00d0a69\iedvtool.dll.mui
- C:\28041066a0f00d0a69\iepeers.dll.mui
- C:\28041066a0f00d0a69\ieframe.dll.mui
- C:\28041066a0f00d0a69\jsprofilercore.dll.mui
- C:\28041066a0f00d0a69\jsdebuggeride.dll.mui
- C:\28041066a0f00d0a69\jsprofilerui.dll.mui
- C:\28041066a0f00d0a69\msfeedsbs.dll.mui
- C:\28041066a0f00d0a69\licmgr10.dll.mui
- C:\28041066a0f00d0a69\inetcpl.cpl.mui
- C:\28041066a0f00d0a69\iexplore.exe.mui
- C:\28041066a0f00d0a69\inseng.dll.mui
- C:\28041066a0f00d0a69\jsdbgui.dll.mui
- C:\28041066a0f00d0a69\jscript.dll.mui
- C:\28041066a0f00d0a69\ieuinit.inf
- C:\28041066a0f00d0a69\inetset.iem
- C:\28041066a0f00d0a69\occache.ini
- C:\28041066a0f00d0a69\install.ins
- C:\28041066a0f00d0a69\webcheck.ini
- C:\28041066a0f00d0a69\spupdsvc.exe
- C:\28041066a0f00d0a69\spuninst.exe
- C:\28041066a0f00d0a69\winfxdocobj.exe
- C:\28041066a0f00d0a69\inetcorp.iem
- C:\28041066a0f00d0a69\html.iec
- C:\28041066a0f00d0a69\icardie.dll.mui
- C:\28041066a0f00d0a69\html.iec.mui
- C:\28041066a0f00d0a69\ie4uinit.exe.mui
- C:\28041066a0f00d0a69\ieaksie.dll.mui
- C:\28041066a0f00d0a69\ieakeng.dll.mui
- C:\28041066a0f00d0a69\msfeedsbs.mof
- C:\28041066a0f00d0a69\msfeeds.mof
- C:\28041066a0f00d0a69\admparse.dll.mui
- C:\28041066a0f00d0a69\hmmapi.dll.mui
- C:\28041066a0f00d0a69\advpack.dll.mui
- C:\28041066a0f00d0a69\mshta.exe.mui
- C:\28041066a0f00d0a69\support\normnfkd.nls
- C:\28041066a0f00d0a69\support\normnfkc.nls
- C:\28041066a0f00d0a69\update\ie8.cat
- C:\28041066a0f00d0a69\update\sqmapi.dll
- C:\28041066a0f00d0a69\update\iecustom.dll
- C:\28041066a0f00d0a69\support\xmllite.dll
- C:\28041066a0f00d0a69\support\normaliz.dll
- C:\28041066a0f00d0a69\support\normidna.nls
- C:\28041066a0f00d0a69\support\normnfd.nls
- C:\28041066a0f00d0a69\support\normnfc.nls
- C:\28041066a0f00d0a69\update\update.ver
- C:\28041066a0f00d0a69\update\eula.rtf
- C:\28041066a0f00d0a69\$shtdwn$.req
- %TEMP%\IXP000.TMP\filelist.dat
- %WINDIR%\ie8_main.log
- C:\28041066a0f00d0a69\update\iesetup.exe
- C:\28041066a0f00d0a69\update\updspapi.dll
- C:\28041066a0f00d0a69\update\update.exe
- C:\28041066a0f00d0a69\update\update.exe.manifest
- C:\28041066a0f00d0a69\update\update.inf
- C:\28041066a0f00d0a69\webcheck.dll.mui
- C:\28041066a0f00d0a69\vbscript.dll.mui
- C:\28041066a0f00d0a69\winfxdocobj.exe.mui
- C:\28041066a0f00d0a69\tdc.ocx
- C:\28041066a0f00d0a69\wininet.dll.mui
- C:\28041066a0f00d0a69\mshtmler.dll.mui
- C:\28041066a0f00d0a69\mshtml.dll.mui
- C:\28041066a0f00d0a69\msrating.dll.mui
- C:\28041066a0f00d0a69\urlmon.dll.mui
- C:\28041066a0f00d0a69\occache.dll.mui
- C:\28041066a0f00d0a69\navstart.wav
- C:\28041066a0f00d0a69\infobar.wav
- C:\28041066a0f00d0a69\popupblk.wav
- C:\28041066a0f00d0a69\support\nlsdl.dll
- C:\28041066a0f00d0a69\support\idndl.dll
- C:\28041066a0f00d0a69\icrav03.rat
- C:\28041066a0f00d0a69\ie8props.propdesc
- C:\28041066a0f00d0a69\ticrf.rat
- C:\28041066a0f00d0a69\feeddisc.wav
- C:\28041066a0f00d0a69\mshtml.tlb
- C:\28041066a0f00d0a69\dxtrans.dll
- C:\28041066a0f00d0a69\dxtmsft.dll
- C:\28041066a0f00d0a69\hmmapi.dll
- C:\28041066a0f00d0a69\ieakeng.dll
- C:\28041066a0f00d0a69\icardie.dll
- C:\28041066a0f00d0a69\admparse.dll
- C:\28041066a0f00d0a69\ieapfltr.dat
- C:\28041066a0f00d0a69\advpack.dll
- C:\28041066a0f00d0a69\corpol.dll
- C:\28041066a0f00d0a69\browseui.dll
- C:\28041066a0f00d0a69\ieframe.dll
- C:\28041066a0f00d0a69\iedvtool.dll
- C:\28041066a0f00d0a69\iepeers.dll
- C:\28041066a0f00d0a69\iernonce.dll
- C:\28041066a0f00d0a69\ieproxy.dll
- C:\28041066a0f00d0a69\ieakui.dll
- C:\28041066a0f00d0a69\ieaksie.dll
- C:\28041066a0f00d0a69\ieapfltr.dll
- C:\28041066a0f00d0a69\iedkcs32.dll
- C:\28041066a0f00d0a69\iecompat.dll
- %TEMP%\IXP000.TMP\ieakcust.dll
- C:\Temp\IE8\~GLH0002.TMP
- %TEMP%\IXP000.TMP\iedkcs32.dll
- %TEMP%\IXP000.TMP\BRANDING.CAB
- %TEMP%\IXP000.TMP\iesetup.cif
- %TEMP%\GLK2.tmp
- %TEMP%\GLC1.tmp
- %TEMP%\GLW3.tmp
- <SYSTEM32>\~GLH0001.TMP
- %TEMP%\~GLH0000.TMP
- C:\28041066a0f00d0a69\ieeula.chm
- C:\28041066a0f00d0a69\ieakmmc.chm
- C:\28041066a0f00d0a69\iesupp.chm
- C:\28041066a0f00d0a69\inetcpl.cpl
- C:\28041066a0f00d0a69\iexplore.chm
- %TEMP%\IXP000.TMP\iesetup.ini
- %TEMP%\IXP000.TMP\INSTALL.INS
- %TEMP%\IXP000.TMP\IE-REDIST.EXE
- C:\28041066a0f00d0a69\inetres.adm
- %TEMP%\IXP000.TMP\IE-Setup.cmd
- C:\28041066a0f00d0a69\iertutil.dll
- C:\28041066a0f00d0a69\sqmapi.dll
- C:\28041066a0f00d0a69\spmsg.dll
- C:\28041066a0f00d0a69\url.dll
- C:\28041066a0f00d0a69\vbscript.dll
- C:\28041066a0f00d0a69\urlmon.dll
- C:\28041066a0f00d0a69\pdm.dll
- C:\28041066a0f00d0a69\occache.dll
- C:\28041066a0f00d0a69\pngfilt.dll
- C:\28041066a0f00d0a69\shlwapi.dll
- C:\28041066a0f00d0a69\shdocvw.dll
- C:\28041066a0f00d0a69\ieudinit.exe
- C:\28041066a0f00d0a69\ie4uinit.exe
- C:\28041066a0f00d0a69\iexplore.exe
- C:\28041066a0f00d0a69\mshta.exe
- C:\28041066a0f00d0a69\msfeedssync.exe
- C:\28041066a0f00d0a69\webcheck.dll
- C:\28041066a0f00d0a69\vgx.dll
- C:\28041066a0f00d0a69\wininet.dll
- C:\28041066a0f00d0a69\extexport.exe
- C:\28041066a0f00d0a69\xpshims.dll
- C:\28041066a0f00d0a69\jsdebuggeride.dll
- C:\28041066a0f00d0a69\jsdbgui.dll
- C:\28041066a0f00d0a69\jsprofilercore.dll
- C:\28041066a0f00d0a69\jsproxy.dll
- C:\28041066a0f00d0a69\jsprofilerui.dll
- C:\28041066a0f00d0a69\ieui.dll
- C:\28041066a0f00d0a69\iesetup.dll
- C:\28041066a0f00d0a69\imgutil.dll
- C:\28041066a0f00d0a69\jscript.dll
- C:\28041066a0f00d0a69\inseng.dll
- C:\28041066a0f00d0a69\mshtmler.dll
- C:\28041066a0f00d0a69\mshtmled.dll
- C:\28041066a0f00d0a69\msls31.dll
- C:\28041066a0f00d0a69\mstime.dll
- C:\28041066a0f00d0a69\msrating.dll
- C:\28041066a0f00d0a69\msdbg2.dll
- C:\28041066a0f00d0a69\licmgr10.dll
- C:\28041066a0f00d0a69\msfeeds.dll
- C:\28041066a0f00d0a69\mshtml.dll
- C:\28041066a0f00d0a69\msfeedsbs.dll
Удаляет следующие файлы:
- C:\28041066a0f00d0a69\pdm.dll
- C:\28041066a0f00d0a69\pngfilt.dll
- C:\28041066a0f00d0a69\mstime.dll
- C:\28041066a0f00d0a69\occache.dll
- C:\28041066a0f00d0a69\shdocvw.dll
- C:\28041066a0f00d0a69\sqmapi.dll
- C:\28041066a0f00d0a69\url.dll
- C:\28041066a0f00d0a69\shlwapi.dll
- C:\28041066a0f00d0a69\spmsg.dll
- C:\28041066a0f00d0a69\msfeeds.dll
- C:\28041066a0f00d0a69\msfeedsbs.dll
- C:\28041066a0f00d0a69\licmgr10.dll
- C:\28041066a0f00d0a69\msdbg2.dll
- C:\28041066a0f00d0a69\mshtml.dll
- C:\28041066a0f00d0a69\msls31.dll
- C:\28041066a0f00d0a69\msrating.dll
- C:\28041066a0f00d0a69\mshtmled.dll
- C:\28041066a0f00d0a69\mshtmler.dll
- C:\28041066a0f00d0a69\mshta.exe
- C:\28041066a0f00d0a69\spuninst.exe
- C:\28041066a0f00d0a69\iexplore.exe
- C:\28041066a0f00d0a69\msfeedssync.exe
- C:\28041066a0f00d0a69\spupdsvc.exe
- C:\28041066a0f00d0a69\inetcorp.iem
- C:\28041066a0f00d0a69\inetset.iem
- C:\28041066a0f00d0a69\winfxdocobj.exe
- C:\28041066a0f00d0a69\html.iec
- C:\28041066a0f00d0a69\vgx.dll
- C:\28041066a0f00d0a69\webcheck.dll
- C:\28041066a0f00d0a69\urlmon.dll
- C:\28041066a0f00d0a69\vbscript.dll
- C:\28041066a0f00d0a69\wininet.dll
- C:\28041066a0f00d0a69\ie4uinit.exe
- C:\28041066a0f00d0a69\ieudinit.exe
- C:\28041066a0f00d0a69\xpshims.dll
- C:\28041066a0f00d0a69\extexport.exe
- C:\28041066a0f00d0a69\jsproxy.dll
- C:\28041066a0f00d0a69\dxtmsft.dll
- C:\28041066a0f00d0a69\dxtrans.dll
- C:\28041066a0f00d0a69\browseui.dll
- C:\28041066a0f00d0a69\corpol.dll
- C:\28041066a0f00d0a69\hmmapi.dll
- C:\28041066a0f00d0a69\ieaksie.dll
- C:\28041066a0f00d0a69\ieakui.dll
- C:\28041066a0f00d0a69\icardie.dll
- C:\28041066a0f00d0a69\ieakeng.dll
- C:\28041066a0f00d0a69\ieeula.chm
- C:\28041066a0f00d0a69\iesupp.chm
- C:\28041066a0f00d0a69\inetres.adm
- C:\28041066a0f00d0a69\ieakmmc.chm
- C:\28041066a0f00d0a69\iexplore.chm
- C:\28041066a0f00d0a69\admparse.dll
- C:\28041066a0f00d0a69\advpack.dll
- C:\28041066a0f00d0a69\inetcpl.cpl
- C:\28041066a0f00d0a69\ieapfltr.dat
- C:\28041066a0f00d0a69\imgutil.dll
- C:\28041066a0f00d0a69\inseng.dll
- C:\28041066a0f00d0a69\iesetup.dll
- C:\28041066a0f00d0a69\ieui.dll
- C:\28041066a0f00d0a69\jscript.dll
- C:\28041066a0f00d0a69\jsprofilercore.dll
- C:\28041066a0f00d0a69\jsprofilerui.dll
- C:\28041066a0f00d0a69\jsdbgui.dll
- C:\28041066a0f00d0a69\jsdebuggeride.dll
- C:\28041066a0f00d0a69\iedkcs32.dll
- C:\28041066a0f00d0a69\iedvtool.dll
- C:\28041066a0f00d0a69\ieapfltr.dll
- C:\28041066a0f00d0a69\iecompat.dll
- C:\28041066a0f00d0a69\ieframe.dll
- C:\28041066a0f00d0a69\iernonce.dll
- C:\28041066a0f00d0a69\iertutil.dll
- C:\28041066a0f00d0a69\iepeers.dll
- C:\28041066a0f00d0a69\ieproxy.dll
- C:\28041066a0f00d0a69\mshtml.tlb
- C:\28041066a0f00d0a69\feeddisc.wav
- C:\28041066a0f00d0a69\icrav03.rat
- C:\28041066a0f00d0a69\ticrf.rat
- C:\28041066a0f00d0a69\infobar.wav
- C:\28041066a0f00d0a69\support\idndl.dll
- C:\28041066a0f00d0a69\support\nlsdl.dll
- C:\28041066a0f00d0a69\navstart.wav
- C:\28041066a0f00d0a69\popupblk.wav
- C:\28041066a0f00d0a69\urlmon.dll.mui
- C:\28041066a0f00d0a69\vbscript.dll.mui
- C:\28041066a0f00d0a69\msrating.dll.mui
- C:\28041066a0f00d0a69\occache.dll.mui
- C:\28041066a0f00d0a69\webcheck.dll.mui
- C:\28041066a0f00d0a69\tdc.ocx
- C:\28041066a0f00d0a69\ie8props.propdesc
- C:\28041066a0f00d0a69\winfxdocobj.exe.mui
- C:\28041066a0f00d0a69\wininet.dll.mui
- C:\28041066a0f00d0a69\update\iesetup.exe
- C:\28041066a0f00d0a69\update\update.exe
- C:\28041066a0f00d0a69\update\sqmapi.dll
- C:\28041066a0f00d0a69\update\updspapi.dll
- C:\28041066a0f00d0a69\update\update.inf
- C:\28041066a0f00d0a69\update\update.ver
- %TEMP%\GLW3.tmp
- C:\28041066a0f00d0a69\update\update.exe.manifest
- C:\28041066a0f00d0a69\update\eula.rtf
- C:\28041066a0f00d0a69\support\normidna.nls
- C:\28041066a0f00d0a69\support\normnfc.nls
- C:\28041066a0f00d0a69\support\normaliz.dll
- C:\28041066a0f00d0a69\support\xmllite.dll
- C:\28041066a0f00d0a69\support\normnfd.nls
- C:\28041066a0f00d0a69\update\ie8.cat
- C:\28041066a0f00d0a69\update\iecustom.dll
- C:\28041066a0f00d0a69\support\normnfkc.nls
- C:\28041066a0f00d0a69\support\normnfkd.nls
- C:\28041066a0f00d0a69\mshtmler.dll.mui
- C:\28041066a0f00d0a69\ie4uinit.exe.mui
- C:\28041066a0f00d0a69\ieakeng.dll.mui
- C:\28041066a0f00d0a69\html.iec.mui
- C:\28041066a0f00d0a69\icardie.dll.mui
- C:\28041066a0f00d0a69\ieaksie.dll.mui
- C:\28041066a0f00d0a69\iedvtool.dll.mui
- C:\28041066a0f00d0a69\ieframe.dll.mui
- C:\28041066a0f00d0a69\ieakui.dll.mui
- C:\28041066a0f00d0a69\iedkcs32.dll.mui
- C:\28041066a0f00d0a69\webcheck.ini
- C:\28041066a0f00d0a69\install.ins
- C:\28041066a0f00d0a69\ieuinit.inf
- C:\28041066a0f00d0a69\occache.ini
- C:\28041066a0f00d0a69\msfeeds.mof
- C:\28041066a0f00d0a69\advpack.dll.mui
- C:\28041066a0f00d0a69\hmmapi.dll.mui
- C:\28041066a0f00d0a69\msfeedsbs.mof
- C:\28041066a0f00d0a69\admparse.dll.mui
- C:\28041066a0f00d0a69\jsdebuggeride.dll.mui
- C:\28041066a0f00d0a69\jsprofilercore.dll.mui
- C:\28041066a0f00d0a69\jscript.dll.mui
- C:\28041066a0f00d0a69\jsdbgui.dll.mui
- C:\28041066a0f00d0a69\jsprofilerui.dll.mui
- C:\28041066a0f00d0a69\mshta.exe.mui
- C:\28041066a0f00d0a69\mshtml.dll.mui
- C:\28041066a0f00d0a69\licmgr10.dll.mui
- C:\28041066a0f00d0a69\msfeedsbs.dll.mui
- C:\28041066a0f00d0a69\iertutil.dll.mui
- C:\28041066a0f00d0a69\iesetup.dll.mui
- C:\28041066a0f00d0a69\iepeers.dll.mui
- C:\28041066a0f00d0a69\iernonce.dll.mui
- C:\28041066a0f00d0a69\ieudinit.exe.mui
- C:\28041066a0f00d0a69\inetcpl.cpl.mui
- C:\28041066a0f00d0a69\inseng.dll.mui
- C:\28041066a0f00d0a69\ieui.dll.mui
- C:\28041066a0f00d0a69\iexplore.exe.mui
Перемещает следующие файлы:
- C:\Temp\IE8\~GLH0002.TMP в C:\Temp\IE8\IE8-Setup-Full.exe
- <SYSTEM32>\~GLH0001.TMP в <SYSTEM32>\KUGroupPolicy.EXE
- %TEMP%\~GLH0000.TMP в %TEMP%\GLF5.tmp
Другое:
Ищет следующие окна:
- ClassName: 'StatusWindowClass' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
