Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'PenWes' = '%PROGRAM_FILES%\PenWes\penwes.exe'
Вредоносные функции:
Создает и запускает на исполнение:
- '%PROGRAM_FILES%\PenWes\Penwes.exe'
- '%TEMP%\nsk2.tmp\shopsave_current.exe' /S
- '%PROGRAM_FILES%\ShopSave Toolbar\2.0\KangoEngine.exe' /RegServer
- '%TEMP%\nsk2.tmp\PenWesSetup.exe' /S /AffID=
- '%TEMP%\nsu4.tmp\ns5.tmp' "%PROGRAM_FILES%\PenWes\SetupPenWes.exe"
- '%PROGRAM_FILES%\PenWes\SetupPenWes.exe'
Запускает на исполнение:
- '<SYSTEM32>\regsvr32.exe' /s "%PROGRAM_FILES%\ShopSave Toolbar\2.0\KangoBHO64.dll"
Изменения в файловой системе:
Создает следующие файлы:
- %PROGRAM_FILES%\ShopSave Toolbar\2.0\kango\userscript_engine.js
- %PROGRAM_FILES%\ShopSave Toolbar\2.0\kango\utils.js
- %PROGRAM_FILES%\ShopSave Toolbar\2.0\kango\updater.js
- %PROGRAM_FILES%\ShopSave Toolbar\2.0\kango\userscript_client.js
- %PROGRAM_FILES%\ShopSave Toolbar\2.0\kango\xhr.js
- %PROGRAM_FILES%\ShopSave Toolbar\2.0\kango-ui\context_menu_item_handler.html
- %PROGRAM_FILES%\ShopSave Toolbar\2.0\kango-ui\kango_api.js
- %PROGRAM_FILES%\ShopSave Toolbar\2.0\kango-ui\browser_button.js
- %PROGRAM_FILES%\ShopSave Toolbar\2.0\kango-ui\context_menu.js
- %PROGRAM_FILES%\ShopSave Toolbar\2.0\kango\kango.js
- %PROGRAM_FILES%\ShopSave Toolbar\2.0\kango\lang.js
- %PROGRAM_FILES%\ShopSave Toolbar\2.0\kango\io.js
- %PROGRAM_FILES%\ShopSave Toolbar\2.0\kango\json2.js
- %PROGRAM_FILES%\ShopSave Toolbar\2.0\kango\legacy.js
- %PROGRAM_FILES%\ShopSave Toolbar\2.0\kango\storage.js
- %PROGRAM_FILES%\ShopSave Toolbar\2.0\kango\timer.js
- %PROGRAM_FILES%\ShopSave Toolbar\2.0\kango\message_target.js
- %PROGRAM_FILES%\ShopSave Toolbar\2.0\kango\messaging.js
- %PROGRAM_FILES%\ShopSave Toolbar\2.0\kango-ui\notification.html
- %PROGRAM_FILES%\ShopSave Toolbar\2.0\kango-ui\theme\bubble\tail-top.png
- %PROGRAM_FILES%\ShopSave Toolbar\2.0\kango-ui\theme\bubble\top-left.png
- %PROGRAM_FILES%\ShopSave Toolbar\2.0\kango-ui\theme\bubble\tail-left.png
- %PROGRAM_FILES%\ShopSave Toolbar\2.0\kango-ui\theme\bubble\tail-right.png
- %PROGRAM_FILES%\ShopSave Toolbar\2.0\kango-ui\theme\bubble\top-middle.png
- %TEMP%\nsk2.tmp\registry.dll
- %TEMP%\nsk2.tmp\manlib.dll
- %PROGRAM_FILES%\ShopSave Toolbar\2.0\kango-ui\theme\bubble\top-right.png
- %PROGRAM_FILES%\ShopSave Toolbar\2.0\Uninstall.exe
- %PROGRAM_FILES%\ShopSave Toolbar\2.0\kango-ui\ui_base.js
- %PROGRAM_FILES%\ShopSave Toolbar\2.0\kango-ui\theme\bubble\bottom-left.png
- %PROGRAM_FILES%\ShopSave Toolbar\2.0\kango-ui\notifications.js
- %PROGRAM_FILES%\ShopSave Toolbar\2.0\kango-ui\options.js
- %PROGRAM_FILES%\ShopSave Toolbar\2.0\kango-ui\theme\bubble\bottom-middle.png
- %PROGRAM_FILES%\ShopSave Toolbar\2.0\kango-ui\theme\bubble\middle-right.png
- %PROGRAM_FILES%\ShopSave Toolbar\2.0\kango-ui\theme\bubble\tail-bottom.png
- %PROGRAM_FILES%\ShopSave Toolbar\2.0\kango-ui\theme\bubble\bottom-right.png
- %PROGRAM_FILES%\ShopSave Toolbar\2.0\kango-ui\theme\bubble\middle-left.png
- %PROGRAM_FILES%\ShopSave Toolbar\2.0\kango\invoke_async.js
- %PROGRAM_FILES%\ShopSave Toolbar\2.0\KangoBHO.dll
- %PROGRAM_FILES%\ShopSave Toolbar\2.0\KangoBHO64.dll
- %TEMP%\nsk2.tmp\shopsave_current.exe
- %TEMP%\nsp7.tmp\nsProcess2.dll
- %PROGRAM_FILES%\ShopSave Toolbar\2.0\KangoEngine.exe
- %PROGRAM_FILES%\ShopSave Toolbar\2.0\config.xml
- %PROGRAM_FILES%\ShopSave Toolbar\2.0\extension_info.json
- %PROGRAM_FILES%\ShopSave Toolbar\2.0\background.html
- %PROGRAM_FILES%\ShopSave Toolbar\2.0\config.js
- %PROGRAM_FILES%\PenWes\SetupPenWes.exe
- %PROGRAM_FILES%\PenWes\PenWesService.exe
- %TEMP%\nsk2.tmp\PenWesSetup.exe
- %PROGRAM_FILES%\PenWes\Penwes.exe
- %PROGRAM_FILES%\PenWes\atlogon.exe
- %ALLUSERSPROFILE%\Application Data\Penwes\cache.dat
- %PROGRAM_FILES%\PenWes\uninstall.exe
- %PROGRAM_FILES%\PenWes\license_it.txt
- %ALLUSERSPROFILE%\Application Data\Penwes\definitions.dat
- %PROGRAM_FILES%\ShopSave Toolbar\2.0\jquery.min.js
- %PROGRAM_FILES%\ShopSave Toolbar\2.0\kango\backgroundscript_engine.js
- %PROGRAM_FILES%\ShopSave Toolbar\2.0\kango\base.js
- %PROGRAM_FILES%\ShopSave Toolbar\2.0\icons\logo32.png
- %PROGRAM_FILES%\ShopSave Toolbar\2.0\icons\logo_new_sm.png
- %PROGRAM_FILES%\ShopSave Toolbar\2.0\kango\browser.js
- %PROGRAM_FILES%\ShopSave Toolbar\2.0\kango\i18n.js
- %PROGRAM_FILES%\ShopSave Toolbar\2.0\kango\initialize.js
- %PROGRAM_FILES%\ShopSave Toolbar\2.0\kango\console.js
- %PROGRAM_FILES%\ShopSave Toolbar\2.0\kango\global.js
- %PROGRAM_FILES%\ShopSave Toolbar\2.0\readme.txt
- %PROGRAM_FILES%\ShopSave Toolbar\2.0\icons\button.png
- %PROGRAM_FILES%\ShopSave Toolbar\2.0\main.js
- %PROGRAM_FILES%\ShopSave Toolbar\2.0\page.js
- %PROGRAM_FILES%\ShopSave Toolbar\2.0\icons\convert.sh
- %PROGRAM_FILES%\ShopSave Toolbar\2.0\icons\icon32.png
- %PROGRAM_FILES%\ShopSave Toolbar\2.0\icons\icon48.png
- %PROGRAM_FILES%\ShopSave Toolbar\2.0\icons\icon100.png
- %PROGRAM_FILES%\ShopSave Toolbar\2.0\icons\icon128.png
Удаляет следующие файлы:
- %TEMP%\nsk2.tmp\PenWesSetup.exe
- %TEMP%\nsk2.tmp\registry.dll
- %TEMP%\nsk2.tmp\shopsave_current.exe
- %TEMP%\nsk2.tmp\manlib.dll
- %PROGRAM_FILES%\PenWes\atlogon.exe
- %PROGRAM_FILES%\PenWes\SetupPenWes.exe
- %TEMP%\nsp7.tmp\nsProcess2.dll
Другое:
Ищет следующие окна:
- ClassName: 'TApplication' WindowName: 'penwes'
