Adware.Dodoor.344

Adware.Dodoor.344

Добавлен в вирусную базу Dr.Web: 2011-11-03

Описание добавлено: 2024-08-04

Technical Information

To ensure autorun and distribution

Creates or modifies the following files

%WINDIR%\system.ini

Modifies file system

Creates the following files

%TEMP%\nsqd23d.tmp
%TEMP%\etilqs_5yqiqqgafvmmycg
%TEMP%\etilqs_byvroosahbfxmcm
%TEMP%\etilqs_a2phx3altihaxjk
%TEMP%\etilqs_8c40n0vzetj8zw7
%TEMP%\etilqs_xlkvnz4qdxo6tje
%TEMP%\etilqs_suxjajjitfcxjju
%TEMP%\etilqs_gsh0vwklneomwpn
%TEMP%\etilqs_r8hinesekponepi
%WINDIR%\windows7\print32.dll
%TEMP%\etilqs_shidcicpw3lizjq
%TEMP%\nsle467.tmp\system.dll
%TEMP%\148.exe
%HOMEPATH%\favorites\ВЎВѕ123chaВЎВїВЈВєГ®ВЄГГёГµВѕВЅВЁГ©ГЁГГёГµВѕГіГҐВ»ВЇГ¬ГЎВ№В©ГґВґВ¶ВЇГЎВ¦_ВјВЇВєГЇВґВ«Г¦Г¦ГЄГ ВЅГ§ВЎВўqqГіГ®ГЇВ·ВµГЁГЁГЁГЈГҐГГёГўГ§ГіГ®ГЇВ·ГЁВ«В№ВҐГўГґ.url
%HOMEPATH%\favorites\В№Г©Г¦В±339Г®ВЄГ¤ГєГ¬ГЎВ№В©Г—Г®Г°ГўГ—Г®ГЁВ«В№Г©Г¦В±ГЁГ«ГЈГҐВ»Г№ВґВЎГ¶ВЄГЄВ¶ВЎВЈ.url
%HOMEPATH%\favorites\ВЎГЇВЎГЇВЎГЇВЎГЇВЎГЇГЄГ§Г¶Г°В№ГєГЁГ«ВѕГВЅГёГ Вґ-ГґГєГЇГџГ°ВЎГіГ®ГЇВ·-ГЇГІВІВјГЄВІГЁГіГ°В¬Г—ГіВЎГЇВЎГЇВЎГЇВЎГЇВЎГЇ.url
%HOMEPATH%\favorites\В¦Г В¦Г В¦Г ГІВЅГ±В§В№ГҐВјВ®ВЎВ¶ГІВЅГ—ГєВЅГ°ВјГёВЎВ·ГґГєГЇГџГґГ¤В¶ГЎВ¦Г В¦Г В¦Г .url
%HOMEPATH%\favorites\ВЁqВЎГ®ВЁrВїВЄГ°Г¤Г°В¦В»В°ГГёВЁqВЎГ®ВЁrВ°Г©Г¤ГЈВїВЄГ°Г¤ГЈВїГІВ»Г¬Г¬ВЁqВЎГ®ВЁr.url
%TEMP%\nsve14a.tmp\system.dll
%TEMP%\taskmgr.exe
%TEMP%\msn055.exe
%TEMP%\nsve456.tmp
%TEMP%\etilqs_xhdb0mqelojwbyf

Deletes the following files

%TEMP%\nsle467.tmp\system.dll
%TEMP%\148.exe
%TEMP%\nsve14a.tmp\system.dll

Network activity

Connects to

'google.com':80
'ya###.opera.com':80
'bl#####st.rkn.gov.ru':80
'fa###ook.com':80
're###.opera.com':80
'si#####ck2.opera.com':80
'en.###ipedia.org':443
'en.###ipedia.org':80
'au######te.geo.opera.com':443
'am##on.com':443
'se####.yahoo.com':443
'bing.com':80
'au######te.geo.opera.com':80
'am##on.com':80
'du###uckgo.com':443
'se####.yahoo.com':80
'sd#####es.operacdn.com':443
'microsoft.com':80

TCP

HTTP GET requests

http://www.google.com/favicon.ico
http://re###.opera.com/speeddials/partner/wikipedia_org_us
http://re###.opera.com/speeddials/partner/youtube
http://re###.opera.com/speeddials/partner/product
http://re###.opera.com/speeddials/partner/booking_com_us
http://re###.opera.com/speeddials/partner/twitter_us
http://re###.opera.com/speeddials/partner/yahoo
http://re###.opera.com/speeddials/partner/ebay_us
http://re###.opera.com/speeddials/partner/amazon_us
http://ya###.opera.com/favicon.ico
http://www.fa###ook.com/campaign/landing.php?ca#########################
http://re###.opera.com/speeddials/partner/facebook
http://si#####ck2.opera.com/?ho##################################################
http://re###.opera.com/www.opera.com/firstrun/
http://si#####ck2.opera.com/?ho###################################################
http://en.###ipedia.org/favicon.ico
http://www.bing.com/s/a/bing_p.ico
http://au######te.geo.opera.com/geolocation/
http://www.am##on.com/favicon.ico
http://se####.yahoo.com/favicon.ico
http://re###.opera.com/favicon.ico
http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt

Other

'du###uckgo.com':443
'se####.yahoo.com':443
'am##on.com':443
'au######te.geo.opera.com':443
'en.###ipedia.org':443
'ya###.opera.com':443
'sd#####es.operacdn.com':443
'op##a.com':443

UDP

DNS ASK google.com
DNS ASK op##a.com
DNS ASK ya###.opera.com
DNS ASK bl#####st.rkn.gov.ru
DNS ASK fa###ook.com
DNS ASK 12##ha.org
DNS ASK re###.opera.com
DNS ASK sd#####es.operacdn.com
DNS ASK si#####ck2.opera.com
DNS ASK bing.com
DNS ASK bi##.#ikimedia.org
DNS ASK au######te.geo.opera.com
DNS ASK du###uckgo.com
DNS ASK am##on.com
DNS ASK se####.yahoo.com
DNS ASK en.###ipedia.org
DNS ASK microsoft.com

Miscellaneous

Searches for the following windows

ClassName: 'Opera_MessageWindow' WindowName: '%APPDATA%\Opera Software\Opera Stable'

Creates and executes the following

'%TEMP%\msn055.exe'
'%TEMP%\taskmgr.exe'
'%TEMP%\148.exe' 7855

Executes the following

'%ProgramFiles(x86)%\opera\launcher.exe' -noautoupdate -- "http://www.123cha.org/123cha.html"
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2940.11.1019965813\1496731164" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe' --type=utility --channel="2940.4.1887569103\2097394216" --lang=en-US --no-sandbox --enable-proprietary-media-types-playback /prefetch:-645351001 /crash-reporter-parent-id=2992
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2940.10.1905057053\1170474323" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2940.9.463726144\1477708127" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2940.8.1489000755\1345335752" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2940.7.363713972\953057584" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2940.6.1068102067\1420090529" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2940.5.1099406859\455477878" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2940.4.1887569103\2097394216" --lang=en-US --no-sandbox --enable-proprietary-media-types-playback /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=renderer --alt-high-dpi-setting=96 --disable-direct-npapi-requests --enable-deferred-image-decoding --lang=en-US --enable-proprietary-media-types-playback --extension-process --enable-we...
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=renderer --alt-high-dpi-setting=96 --disable-direct-npapi-requests --enable-deferred-image-decoding --lang=en-US --enable-proprietary-media-types-playback --disable-client-side-phishing-...
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=gpu-process --channel="2940.0.1506809267\1366346339" --enable-proprietary-media-types-playback --supports-dual-gpus=false --gpu-driver-bug-workarounds=1,19,42 --gpu-vendor-id=0x0000 --gp...
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe' -noautoupdate --ran-launcher -- http://www.123cha.org/123cha.html /crash-reporter-parent-id=2940
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' -noautoupdate --ran-launcher -- http://www.123cha.org/123cha.html
'%WINDIR%\syswow64\regsvr32.exe' "%WINDIR%\Windows7\Print32.dll" /s
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2940.12.1449702703\283687305" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="2940.15.1134497352\933836313" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней