Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'DATAMNGR' = ''
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] 'LoadAppInit_DLLs' = '00000001'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] 'AppInit_DLLs' = '%PROGRAM_FILES%\FantastiGames Toolbar\Datamngr\datamngr.dll %PROGRAM_FILES%\FantastiGames Toolbar\Datamngr\IEBHO.dll '
Вредоносные функции:
Создает и запускает на исполнение:
- %TEMP%\FantastiGames_DM\FantastiGamesMediaBar.exe /S /NOADDREMOVE /ExtraSearchParam=systemid=0&appid=0 /D=%PROGRAM_FILES%\FANTAS~1\Datamngr\ToolBar
Запускает на исполнение:
- <SYSTEM32>\regsvr32.exe /s %PROGRAM_FILES%\FantastiGames Toolbar\Datamngr\DnsBHO.dll
- <SYSTEM32>\regsvr32.exe /s %PROGRAM_FILES%\FantastiGames Toolbar\Datamngr\BROWSE~1.DLL
- <SYSTEM32>\rundll32.exe %TEMP%\INSTAL~1.DLL,_KillProcessesByName DataMngrUI,
- <SYSTEM32>\rundll32.exe %TEMP%\INSTAL~1.DLL,_KillProcessesByName DATAMN~1,
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\FantastiGames_DM\ext\FirefoxExtension\components\DataMngrHlpFF7.dll
- %TEMP%\FantastiGames_DM\ext\FirefoxExtension\components\DataMngrHlpFF8.dll
- %TEMP%\FantastiGames_DM\ext\FirefoxExtension\components\DataMngrHlpFF6.dll
- %TEMP%\FantastiGames_DM\ext\FirefoxExtension\components\DataMngrHlpFF4.dll
- %TEMP%\FantastiGames_DM\ext\FirefoxExtension\components\DataMngrHlpFF5.dll
- %TEMP%\FantastiGames_DM\ext\FirefoxExtension\components\DataMngrHlpFF9.dll
- %TEMP%\FantastiGames_DM\x64\IEBHO.dll
- %TEMP%\FantastiGames_DM\InstallHelper.dll
- %TEMP%\FantastiGames_DM\IEBHO.dll
- %TEMP%\FantastiGames_DM\DnsBHO.dll
- %TEMP%\FantastiGames_DM\x64\DnsBHO.dll
- %TEMP%\FantastiGames_DM\ext\FirefoxExtension\components\DataMngrHlpFF3.dll
- %TEMP%\FantastiGames_DM\DataMngr.dll
- %TEMP%\FantastiGames_DM\x64\DataMngr.dll
- %TEMP%\FantastiGames_DM\x64\BrowserConnection.dll
- %TEMP%\FantastiGames_DM\FantastiGamesMediaBar.exe
- %TEMP%\FantastiGames_DM\BrowserConnection.dll
- %TEMP%\FantastiGames_DM\ext\FirefoxExtension\components\DataMngrHlpFF10.dll
- %TEMP%\FantastiGames_DM\ext\FirefoxExtension\components\DataMngrHlpFF14.dll
- %TEMP%\FantastiGames_DM\ext\FirefoxExtension\components\DataMngrHlpFF15.dll
- %TEMP%\FantastiGames_DM\ext\FirefoxExtension\components\DataMngrHlpFF13.dll
- %TEMP%\FantastiGames_DM\ext\FirefoxExtension\components\DataMngrHlpFF11.dll
- %TEMP%\FantastiGames_DM\ext\FirefoxExtension\components\DataMngrHlpFF12.dll
- %TEMP%\FantastiGames_DM\SR\SRAssetsHelper.dll
- %TEMP%\nsk6.tmp\CountryLocaleXML.xml
- %TEMP%\nsk6.tmp\xml.dll
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\geoip[1].php
- %PROGRAM_FILES%\FantastiGames Toolbar\Datamngr\datamngr.dll
- %PROGRAM_FILES%\FantastiGames Toolbar\Datamngr\datamngrUI.exe
- %TEMP%\playgames-oldToolbarGuid.xml
- %PROGRAM_FILES%\FantastiGames Toolbar\Datamngr\ToolBar\fantastigamesband.dll
- %WINDIR%\wininit.ini
- %PROGRAM_FILES%\FantastiGames Toolbar\Datamngr\ToolBar\toolbar.xml
- %PROGRAM_FILES%\FantastiGames Toolbar\Datamngr\installhelper.dll
- %PROGRAM_FILES%\FantastiGames Toolbar\Datamngr\ToolBar\manifest.xml
- %PROGRAM_FILES%\FantastiGames Toolbar\Datamngr\DnsBHO.dll
- %TEMP%\nst5.tmp
- %TEMP%\nsi2.tmp\Timeout.dll
- %TEMP%\installhelper.dll
- %TEMP%\SRAssetsHelper.dll
- %TEMP%\nsk6.tmp\System.dll
- %PROGRAM_FILES%\FantastiGames Toolbar\Datamngr\IEBHO.dll
- %PROGRAM_FILES%\FantastiGames Toolbar\Datamngr\BrowserConnection.dll
- %TEMP%\nsk6.tmp\InetLoad.dll
- %TEMP%\nsk6.tmp\UAC.dll
- %TEMP%\playgames-manifest.xml
- %TEMP%\FantastiGames_DM\x64\DataMngrUI.exe
- %TEMP%\FantastiGames_DM\ext\FirefoxExtension\chrome.manifest
- %TEMP%\FantastiGames_DM\ext\ChromeExtension\config\skin\new-tab.html
- %TEMP%\FantastiGames_DM\ext\ChromeExtension\config\skin\images\imesh_logo_128.png
- %TEMP%\FantastiGames_DM\ext\ChromeExtension\config\skin\images\fav_youtube.png
- %TEMP%\FantastiGames_DM\ext\ChromeExtension\config\skin\images\IDR_WEBSTORE_ICON.png
- %TEMP%\FantastiGames_DM\ext\ChromeExtension\OurLocalPage.html
- %TEMP%\FantastiGames_DM\ext\FirefoxExtension\content\DataMngr.js
- %TEMP%\FantastiGames_DM\ext\ChromeExtension\lib\default-config.js
- %TEMP%\FantastiGames_DM\ext\ChromeExtension\lib\constant.js
- %TEMP%\FantastiGames_DM\ext\ChromeExtension\config\skin\css\new-tab.css
- %TEMP%\FantastiGames_DM\ext\ChromeExtension\lib\analytics.js
- %TEMP%\FantastiGames_DM\ext\ChromeExtension\config\skin\images\fav_ftalk.png
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\installp[1].php
- %TEMP%\nsg3.tmp
- %TEMP%\nsi2.tmp\inetc.dll
- %TEMP%\nsi2.tmp\System.dll
- %TEMP%\FantastiGames.ini
- %TEMP%\FantastiGames_DM\files.7z
- %TEMP%\FantastiGames_DM\ext\ChromeExtension\config\skin\images\fav_facebook.png
- %TEMP%\FantastiGames_DM\ext\ChromeExtension\config\skin\images\fav_fantastigames.png
- %TEMP%\FantastiGames_DM\ext\ChromeExtension\config\skin\images\fav_ebay.png
- %TEMP%\nsi2.tmp\nsis7z.dll
- %TEMP%\FantastiGames_DM\ext\ChromeExtension\config\skin\images\fav_amazon.png
- %TEMP%\FantastiGames_DM\ext\FirefoxExtension\content\DnsBHO.js
- %TEMP%\FantastiGames_DM\SR\Settings.xml.alt
- %TEMP%\FantastiGames_DM\Settings.xml.alt
- %TEMP%\FantastiGames_DM\SR\Search_Results.xml.alt
- %TEMP%\FantastiGames_DM\SR\install.rdf.alt
- %TEMP%\FantastiGames_DM\install.rdf.alt
- %TEMP%\FantastiGames_DM\ext\ChromeExtension\manifest.json
- %TEMP%\FantastiGames_DM\ext\FirefoxExtension\content\overlay.xul
- %TEMP%\FantastiGames_DM\DataMngrUI.exe
- %TEMP%\FantastiGames_DM\ext\FirefoxExtension\components\DataMngrHlp.xpt
- %TEMP%\FantastiGames_DM\ext\ChromeExtension\lib\default-config.js___
- %TEMP%\FantastiGames_DM\ext\ChromeExtension\config\skin\images\imesh_logo_128.png__
- %TEMP%\FantastiGames_DM\SR\chrome.manifest.alt
- %TEMP%\FantastiGames_DM\ext\ChromeExtension\lib\new-tab.js
- %TEMP%\FantastiGames_DM\ext\FirefoxExtension\content\NewTabBHO.js
- %TEMP%\FantastiGames_DM\ext\ChromeExtension\lib\localStorage.js
- %TEMP%\FantastiGames_DM\ext\FirefoxExtension\content\Error404BHO.js
- %TEMP%\FantastiGames_DM\ext\ChromeExtension\lib\jquery.js
- %TEMP%\FantastiGames_DM\ext\FirefoxExtension\content\overlay.js
- %TEMP%\FantastiGames_DM\ext\FirefoxExtension\content\SearchBHO.js
- %TEMP%\FantastiGames_DM\ext\FirefoxExtension\content\SettingManager.js
- %TEMP%\FantastiGames_DM\ext\FirefoxExtension\content\RequestPreserver.js
- %TEMP%\FantastiGames_DM\ext\ChromeExtension\lib\preferences.js
- %TEMP%\FantastiGames_DM\ext\FirefoxExtension\content\RelatedSearch.js
Удаляет следующие файлы:
- %TEMP%\nsk6.tmp\System.dll
- %TEMP%\nsk6.tmp\InetLoad.dll
- %TEMP%\nsk6.tmp\xml.dll
- %TEMP%\nsk6.tmp\UAC.dll
- %TEMP%\playgames-oldToolbarGuid.xml
- %TEMP%\FantastiGames_DM\files.7z
- %TEMP%\nsk6.tmp\CountryLocaleXML.xml
- %PROGRAM_FILES%\FantastiGames Toolbar\Datamngr\datamngrUI.exe
Сетевая активность:
Подключается к:
- 'se###h.vmn.net':80
- 'www.ml##at.com':80
TCP:
Запросы HTTP GET:
- se###h.vmn.net/newtab/geoip.php
- www.ml##at.com/statistics/installp.php?co#############################################
UDP:
- DNS ASK se###h.vmn.net
- DNS ASK www.ml##at.com
Другое:
Ищет следующие окна:
- ClassName: '#32770' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
