Adware.BGuard.35

Техническая информация

Вредоносные функции:

Создает и запускает на исполнение:

'%TEMP%\install_helper.exe' /browser=IE /guid={FF103732-4528-4322-AA8B-F7849AB7776B}
'%APPDATA%\7Go\install_helper.exe' /browser=CH /path="%APPDATA%\7Go\7Go.crx" /id=gjajpkikblccgefaibcafkfbanllpefi
'%TEMP%\7go.exe' /S
'%PROGRAM_FILES%\7Go Games\BackgroundHost.exe' /RegServer

Запускает на исполнение:

'<SYSTEM32>\regsvr32.exe' /s "%PROGRAM_FILES%\7Go Games\ScriptHost.dll"
'<SYSTEM32>\regsvr32.exe' /s "%PROGRAM_FILES%\7Go Games\ButtonSite.dll"
'<SYSTEM32>\regsvr32.exe' /s "%PROGRAM_FILES%\7Go Games\AddonsFramework.Typelib.dll"
'<SYSTEM32>\taskkill.exe' /F /IM PropertySync.exe
'<SYSTEM32>\taskkill.exe' /F /IM BackgroundHost.exe
'<SYSTEM32>\taskkill.exe' /F /IM BackgroundHost64.exe

Завершает или пытается завершить

следующие пользовательские процессы:

firefox.exe

Изменения в файловой системе:

Создает следующие файлы:

%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\Extensions\7go@7go.com\chrome\content\framework.js
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\Extensions\7go@7go.com\chrome\content\framework.png
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\Extensions\7go@7go.com\chrome\content\content.js
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\Extensions\7go@7go.com\chrome\content\button.xml
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\Extensions\7go@7go.com\chrome\content\config.js
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\Extensions\7go@7go.com\chrome\content\icon16.ico
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\Extensions\7go@7go.com\chrome\content\icon16.png
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\Extensions\7go@7go.com\chrome\content\icon128.png
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\Extensions\7go@7go.com\chrome\content\framework.xul
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\Extensions\7go@7go.com\chrome\content\icon128.ico
%APPDATA%\7Go\7go.crx
%APPDATA%\7Go\install_helper.exe
%TEMP%\install_helper.exe
%PROGRAM_FILES%\7Go Games\uninstall.exe
%TEMP%\nst3.tmp\System.dll
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\Extensions\7go@7go.com\chrome\content\background.html
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\Extensions\7go@7go.com\chrome\content\bg.js
%TEMP%\nsp5.tmp\nsisunz.dll
%TEMP%\che4.tmp
%TEMP%\7go.xpi
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\Extensions\7go@7go.com\chrome\content\options.xul
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\Extensions\7go@7go.com\chrome\content\settings.json
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\Extensions\7go@7go.com\chrome\content\mz\content.js
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\Extensions\7go@7go.com\chrome\content\jquery-1.9.1.min.js
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\Extensions\7go@7go.com\chrome\content\mz\background.js
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions.sqlite-journal
%PROGRAM_FILES%\7Go Games\uninst.exe
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\Extensions\7go@7go.com\install.rdf
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\Extensions\7go@7go.com\chrome\skin\framework.css
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\Extensions\7go@7go.com\chrome.manifest
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\Extensions\7go@7go.com\chrome\content\icon24.png
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\Extensions\7go@7go.com\chrome\content\icon32.ico
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\Extensions\7go@7go.com\chrome\content\icon24.ico
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\Extensions\7go@7go.com\chrome\content\icon18.ico
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\Extensions\7go@7go.com\chrome\content\icon18.png
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\Extensions\7go@7go.com\chrome\content\icon64.ico
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\Extensions\7go@7go.com\chrome\content\icon64.png
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\Extensions\7go@7go.com\chrome\content\icon48.png
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\Extensions\7go@7go.com\chrome\content\icon32.png
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\Extensions\7go@7go.com\chrome\content\icon48.ico
%PROGRAM_FILES%\7Go Games\ScriptHost.dll
%PROGRAM_FILES%\7Go Games\ScriptHost64.dll
%PROGRAM_FILES%\7Go Games\ButtonSite64.dll
%PROGRAM_FILES%\7Go Games\BackgroundHost64.exe
%PROGRAM_FILES%\7Go Games\ButtonSite.dll
%PROGRAM_FILES%\7Go Games\content.js
%PROGRAM_FILES%\7Go Games\icon128.ico
%PROGRAM_FILES%\7Go Games\config.xml
%PROGRAM_FILES%\7Go Games\background.html
%PROGRAM_FILES%\7Go Games\bg.js
%TEMP%\7go.exe
%TEMP%\nst3.tmp\help_page.ini
%HOMEPATH%\Desktop\7Go Games.lnk
%TEMP%\DeskTopIcon.ico
%APPDATA%\7Go\DeskTopIcon.ico
%PROGRAM_FILES%\7Go Games\AddonsFramework.Typelib64.dll
%PROGRAM_FILES%\7Go Games\BackgroundHost.exe
%PROGRAM_FILES%\7Go Games\AddonsFramework.Typelib.dll
%TEMP%\nst3.tmp\ie9install.bmp
%TEMP%\nst3.tmp\UAC.dll
%PROGRAM_FILES%\7Go Games\jquery-1.9.1.min.js
%PROGRAM_FILES%\7Go Games\json2.min.js
%PROGRAM_FILES%\7Go Games\icon64.png
%PROGRAM_FILES%\7Go Games\icon48.png
%PROGRAM_FILES%\7Go Games\icon64.ico
%PROGRAM_FILES%\7Go Games\mz\background.js
%PROGRAM_FILES%\7Go Games\mz\content.js
%PROGRAM_FILES%\7Go Games\updaterWrapper.js
%PROGRAM_FILES%\7Go Games\options.htm
%PROGRAM_FILES%\7Go Games\updater.js
%PROGRAM_FILES%\7Go Games\icon18.ico
%PROGRAM_FILES%\7Go Games\icon18.png
%PROGRAM_FILES%\7Go Games\icon16.png
%PROGRAM_FILES%\7Go Games\icon128.png
%PROGRAM_FILES%\7Go Games\icon16.ico
%PROGRAM_FILES%\7Go Games\icon32.png
%PROGRAM_FILES%\7Go Games\icon48.ico
%PROGRAM_FILES%\7Go Games\icon32.ico
%PROGRAM_FILES%\7Go Games\icon24.ico
%PROGRAM_FILES%\7Go Games\icon24.png