Adware.MyWebSearch.59

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'HomeworkSimplified Search Scope Monitor' = '"%PROGRAM_FILES%\HomeworkSimplified_7e\bar\1.bin\7esrchmn.exe" /m=2 /w /h'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'HomeworkSimplified_7e Browser Plugin Loader' = '%PROGRAM_FILES%\HomeworkSimplified_7e\bar\1.bin\7ebrmon.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'HomeworkSimplified' = 'rundll32 %PROGRAM_FILES%\HomeworkSimplified_7e\bar\1.bin\7ebar.dll,S'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'HomeworkSimplified Home Page Guard 32 bit' = '"%PROGRAM_FILES%\HomeworkSimplified_7e\bar\1.bin\AppIntegrator.exe"'

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\HomeworkSimplified_7eService] 'Start' = '00000002'

Вредоносные функции:

Создает и запускает на исполнение:

'%PROGRAM_FILES%\HomeworkSimplified_7e\bar\1.bin\7eSrchMn.exe' /m=2 /w /h /r
'%PROGRAM_FILES%\HomeworkSimplified_7e\bar\1.bin\7ebrmon.exe'
'%PROGRAM_FILES%\HomeworkSimplified_7e\bar\1.bin\7ehighin.exe' 7etpinst.dll,#5
'%PROGRAM_FILES%\HomeworkSimplified_7e\bar\1.bin\7ebarsvc.exe' -remove
'%PROGRAM_FILES%\HomeworkSimplified_7e\bar\1.bin\7ebarsvc.exe' -install
'%PROGRAM_FILES%\HomeworkSimplified_7e\bar\1.bin\7ebarsvc.exe'

Запускает на исполнение:

'<SYSTEM32>\ntvdm.exe' -f -i3
'<SYSTEM32>\ntvdm.exe' -f -i2
'<SYSTEM32>\ntvdm.exe' -f -i1

Изменения в файловой системе:

Создает следующие файлы:

%PROGRAM_FILES%\HomeworkSimplified_7e\bar\1.bin\7emlbtn.dll
%PROGRAM_FILES%\HomeworkSimplified_7e\bar\1.bin\7ePlugin.dll
%PROGRAM_FILES%\HomeworkSimplified_7e\bar\1.bin\7eieovr.dll
%PROGRAM_FILES%\HomeworkSimplified_7e\bar\1.bin\7emedint.exe
%PROGRAM_FILES%\HomeworkSimplified_7e\bar\1.bin\7ereghk.dll
%PROGRAM_FILES%\HomeworkSimplified_7e\bar\1.bin\7eregiet.dll
%PROGRAM_FILES%\HomeworkSimplified_7e\bar\1.bin\7eradio.dll
%PROGRAM_FILES%\HomeworkSimplified_7e\bar\1.bin\7eregfft.dll
%PROGRAM_FILES%\HomeworkSimplified_7e\bar\1.bin\7eidle.dll
%PROGRAM_FILES%\HomeworkSimplified_7e\bar\1.bin\7efeedmg.dll
%PROGRAM_FILES%\HomeworkSimplified_7e\bar\1.bin\7ehighin.exe
%PROGRAM_FILES%\HomeworkSimplified_7e\bar\1.bin\T8EXTEX.DLL
%PROGRAM_FILES%\HomeworkSimplified_7e\bar\1.bin\T8EXTPEX.DLL
%PROGRAM_FILES%\HomeworkSimplified_7e\bar\1.bin\7ehtmlmu.dll
%PROGRAM_FILES%\HomeworkSimplified_7e\bar\1.bin\7ehttpct.dll
%PROGRAM_FILES%\HomeworkSimplified_7e\bar\1.bin\7ehkstub.dll
%PROGRAM_FILES%\HomeworkSimplified_7e\bar\1.bin\T8HTML.DLL
%WINDIR%\Temp\scs1.tmp
%WINDIR%\Temp\scs2.tmp
%PROGRAM_FILES%\HomeworkSimplified_7e\bar\1.bin\UNIFIEDLOGGING.DLL
%PROGRAM_FILES%\HomeworkSimplified_7e\bar\1.bin\VERIFY.DLL
%WINDIR%\Temp\scs5.tmp
%WINDIR%\Temp\scs6.tmp
%WINDIR%\Temp\scs3.tmp
%WINDIR%\Temp\scs4.tmp
%PROGRAM_FILES%\HomeworkSimplified_7e\bar\1.bin\TPIMANAGERCONSOLE.EXE
%PROGRAM_FILES%\HomeworkSimplified_7e\bar\1.bin\7eskplay.exe
%PROGRAM_FILES%\HomeworkSimplified_7e\bar\1.bin\7eSrcAs.dll
%PROGRAM_FILES%\HomeworkSimplified_7e\bar\1.bin\7escript.dll
%PROGRAM_FILES%\HomeworkSimplified_7e\bar\1.bin\7eskin.dll
%PROGRAM_FILES%\HomeworkSimplified_7e\bar\1.bin\T8TICKER.DLL
%PROGRAM_FILES%\HomeworkSimplified_7e\bar\1.bin\7etpinst.dll
%PROGRAM_FILES%\HomeworkSimplified_7e\bar\1.bin\7eSrchMn.exe
%PROGRAM_FILES%\HomeworkSimplified_7e\bar\1.bin\7esrchmr.dll
%PROGRAM_FILES%\HomeworkSimplified_7e\bar\1.bin\7edlghk64.dll
%PROGRAM_FILES%\HomeworkSimplified_7e\bar\1.bin\ASSISTMONITOR.DLL
%PROGRAM_FILES%\HomeworkSimplified_7e\bar\1.bin\ASSISTMONITOR64.DLL
%PROGRAM_FILES%\HomeworkSimplified_7e\bar\1.bin\APPINTEGRATORSTUB.DLL
%PROGRAM_FILES%\HomeworkSimplified_7e\bar\1.bin\AppIntegratorStub64.dll
%PROGRAM_FILES%\HomeworkSimplified_7e\bar\1.bin\CREXT.DLL
%PROGRAM_FILES%\HomeworkSimplified_7e\bar\1.bin\CrExtP7e.exe
%PROGRAM_FILES%\HomeworkSimplified_7e\bar\1.bin\BOOTSTRAP.JS
%PROGRAM_FILES%\HomeworkSimplified_7e\bar\1.bin\CHROME.MANIFEST
%PROGRAM_FILES%\HomeworkSimplified_7e\bar\1.bin\AppIntegrator64.exe
%PROGRAM_FILES%\HomeworkSimplified_7e\bar\1.bin\T8RES.DLL
%PROGRAM_FILES%\HomeworkSimplified_7e\bar\1.bin\assists\ie_default_search_provider\ARBITER.DLL
%PROGRAM_FILES%\HomeworkSimplified_7e\bar\1.bin\7ebarsvc.exe
%PROGRAM_FILES%\HomeworkSimplified_7e\bar\1.bin\T8EPMSUP.DLL
%PROGRAM_FILES%\HomeworkSimplified_7e\bar\1.bin\assists\ie_default_search_provider\CONFIG.XML
%PROGRAM_FILES%\HomeworkSimplified_7e\bar\1.bin\APPINTEGRATOR.EXE
%PROGRAM_FILES%\HomeworkSimplified_7e\bar\1.bin\assists\ie_default_search_provider\ARBITER64.DLL
%PROGRAM_FILES%\HomeworkSimplified_7e\bar\1.bin\assists\ie_default_search_provider\ASSIST.EXE
%PROGRAM_FILES%\HomeworkSimplified_7e\bar\1.bin\7ebrmon.exe
%PROGRAM_FILES%\HomeworkSimplified_7e\bar\1.bin\7ebrmon64.exe
%PROGRAM_FILES%\HomeworkSimplified_7e\bar\1.bin\7ebar.dll
%PROGRAM_FILES%\HomeworkSimplified_7e\bar\1.bin\7ebprtct.dll
%PROGRAM_FILES%\HomeworkSimplified_7e\bar\1.bin\7edatact.dll
%PROGRAM_FILES%\HomeworkSimplified_7e\bar\1.bin\7edlghk.dll
%PROGRAM_FILES%\HomeworkSimplified_7e\bar\1.bin\7ebrstub.dll
%PROGRAM_FILES%\HomeworkSimplified_7e\bar\1.bin\7ebrstub64.dll
%PROGRAM_FILES%\HomeworkSimplified_7e\bar\1.bin\7eauxstb64.dll
%PROGRAM_FILES%\HomeworkSimplified_7e\bar\1.bin\FF-NativeMessagingDispatcher.dll
%PROGRAM_FILES%\HomeworkSimplified_7e\bar\1.bin\Hpg64.dll
%PROGRAM_FILES%\HomeworkSimplified_7e\bar\1.bin\DPNMNGR.DLL
%PROGRAM_FILES%\HomeworkSimplified_7e\bar\1.bin\EXEMANAGER.DLL
%PROGRAM_FILES%\HomeworkSimplified_7e\bar\1.bin\NP7eStub.dll
%PROGRAM_FILES%\HomeworkSimplified_7e\bar\1.bin\7eauxstb.dll
%PROGRAM_FILES%\HomeworkSimplified_7e\bar\1.bin\INSTALL.RDF
%PROGRAM_FILES%\HomeworkSimplified_7e\bar\1.bin\LOGO.BMP