Adware.BGuard.33

Техническая информация

Вредоносные функции:

Создает и запускает на исполнение:

'%TEMP%\install_helper.exe' /browser=IE /guid={93488930-185C-4CED-AFEB-0FD4930F8423}
'%APPDATA%\SeeSimilar02\install_helper.exe' /browser=CH /path="%APPDATA%\SeeSimilar02\SeeSimilar02.crx" /id=fegpgkakakkgjlnfdfoghgoohkbcejpm
'%TEMP%\seesimilar02.exe' /S
'%PROGRAM_FILES%\SeeSimilar02\BackgroundHost.exe' /RegServer

Запускает на исполнение:

'<SYSTEM32>\regsvr32.exe' /s "%PROGRAM_FILES%\SeeSimilar02\ScriptHost.dll"
'<SYSTEM32>\regsvr32.exe' /s "%PROGRAM_FILES%\SeeSimilar02\ButtonSite.dll"
'<SYSTEM32>\regsvr32.exe' /s "%PROGRAM_FILES%\SeeSimilar02\AddonsFramework.Typelib.dll"
'<SYSTEM32>\taskkill.exe' /F /IM PropertySync.exe
'<SYSTEM32>\taskkill.exe' /F /IM BackgroundHost.exe
'<SYSTEM32>\taskkill.exe' /F /IM BackgroundHost64.exe

Завершает или пытается завершить

следующие пользовательские процессы:

firefox.exe

Изменения в файловой системе:

Создает следующие файлы:

%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\Extensions\seesimilar02@SeeSimilar.com\chrome\content\content.js
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\Extensions\seesimilar02@SeeSimilar.com\chrome\content\config.js
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\Extensions\seesimilar02@SeeSimilar.com\chrome\content\button.xml
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\Extensions\seesimilar02@SeeSimilar.com\chrome\content\framework.js
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\Extensions\seesimilar02@SeeSimilar.com\chrome\content\i128.png
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\Extensions\seesimilar02@SeeSimilar.com\chrome\content\framework.xul
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\Extensions\seesimilar02@SeeSimilar.com\chrome\content\framework.png
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\Extensions\seesimilar02@SeeSimilar.com\chrome\content\background.html
%APPDATA%\SeeSimilar02\seesimilar02.crx
%TEMP%\install_helper.exe
%TEMP%\nsp3.tmp\System.dll
%APPDATA%\SeeSimilar02\install_helper.exe
%TEMP%\nsx5.tmp\nsisunz.dll
%TEMP%\seesimilar02.xpi
%TEMP%\che4.tmp
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\Extensions\seesimilar02@SeeSimilar.com\chrome\skin\framework.css
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\Extensions\seesimilar02@SeeSimilar.com\chrome\content\settings.json
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\Extensions\seesimilar02@SeeSimilar.com\chrome\content\seesimilar02.rdf
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\Extensions\seesimilar02@SeeSimilar.com\chrome.manifest
%PROGRAM_FILES%\SeeSimilar02\uninst.exe
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions.sqlite-journal
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\Extensions\seesimilar02@SeeSimilar.com\install.rdf
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\Extensions\seesimilar02@SeeSimilar.com\chrome\content\seesimilar.rdf
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\Extensions\seesimilar02@SeeSimilar.com\chrome\content\i48.png
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\Extensions\seesimilar02@SeeSimilar.com\chrome\content\i32.png
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\Extensions\seesimilar02@SeeSimilar.com\chrome\content\i16.png
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\Extensions\seesimilar02@SeeSimilar.com\chrome\content\jquery-1.9.1.min.js
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\Extensions\seesimilar02@SeeSimilar.com\chrome\content\options.xul
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\Extensions\seesimilar02@SeeSimilar.com\chrome\content\mz\content.js
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\Extensions\seesimilar02@SeeSimilar.com\chrome\content\mz\background.js
%PROGRAM_FILES%\SeeSimilar02\BackgroundHostPS.dll
%PROGRAM_FILES%\SeeSimilar02\BackgroundHost64.exe
%PROGRAM_FILES%\SeeSimilar02\BackgroundHost.exe
%PROGRAM_FILES%\SeeSimilar02\ButtonSite.dll
%PROGRAM_FILES%\SeeSimilar02\background.html
%PROGRAM_FILES%\SeeSimilar02\ScriptHost.dll
%PROGRAM_FILES%\SeeSimilar02\ButtonSite64.dll
%PROGRAM_FILES%\SeeSimilar02\AddonsFramework.Typelib.dll
%HOMEPATH%\Desktop\SeeSimilar02.lnk
%APPDATA%\SeeSimilar02\DeskTopIcon.ico
%TEMP%\DeskTopIcon.ico
%TEMP%\seesimilar02.exe
%TEMP%\nsp3.tmp\UAC.dll
%TEMP%\nsp3.tmp\ie9install.bmp
%TEMP%\nsp3.tmp\help_page.ini
%PROGRAM_FILES%\SeeSimilar02\updater.js
%PROGRAM_FILES%\SeeSimilar02\seesimilar02.rdf
%PROGRAM_FILES%\SeeSimilar02\seesimilar.rdf
%PROGRAM_FILES%\SeeSimilar02\updaterWrapper.js
%PROGRAM_FILES%\SeeSimilar02\uninstall.exe
%PROGRAM_FILES%\SeeSimilar02\mz\content.js
%PROGRAM_FILES%\SeeSimilar02\mz\background.js
%PROGRAM_FILES%\SeeSimilar02\json2.min.js
%PROGRAM_FILES%\SeeSimilar02\i128.png
%PROGRAM_FILES%\SeeSimilar02\content.js
%PROGRAM_FILES%\SeeSimilar02\config.xml
%PROGRAM_FILES%\SeeSimilar02\i16.png
%PROGRAM_FILES%\SeeSimilar02\jquery-1.9.1.min.js
%PROGRAM_FILES%\SeeSimilar02\i48.png
%PROGRAM_FILES%\SeeSimilar02\i32.png