PUA_BaiduRJDownloader.GC
Win32/Baidu.O potentially unwanted application (NOD32); W32/Malicious_Behavior.VEX (Fortinet)
Windows
Malware-Typ:
Potentially Unwanted Application
Zerstrerisch?:
Nein
Verschlsselt?:
In the wild::
Ja
Überblick
Wird möglicherweise manuell von einem Benutzer installiert.
Technische Details
Übertragungsdetails
Wird möglicherweise manuell von einem Benutzer installiert.
Installation
Schleust die folgenden Dateien ein:
- %All Users Profile%\Application Data\Baidu\BaiduRJDownloader\Config\106.dat
- %All Users Profile%\Application Data\Baidu\BaiduRJDownloader\Config\4402.dat
- %All Users Profile%\Baidu\Common\Global.db
- %Application Data%\Baidu\BaiduRJDownloader\rpt.dat
- %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\ActivityAssistant.exe
- %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\AppAdTip.exe
- %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\AppOpenAsTip.exe
- %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\AppUpdateTips.exe
- %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\AppUpdater.exe
- %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\BDHYServer.exe
- %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\BDKitUtils.dll
- %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\BDMNetGetInfo.dll
- %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\BaseDll.dll
- %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\BugReport.exe
- %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\DriverManager.dll
- %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\HYSoftIcons\10002_10272.png
- %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\HYSoftIcons\10002_10547.png
- %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\HYSoftIcons\10002_10644.png
- %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\HYSoftIcons\10002_10849.png
- %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\HYSoftIcons\10002_11043.png
- %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\HYSoftIcons\10002_11339.png
- %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\HYSoftIcons\10002_11383.png
- %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\HYSoftIcons\10002_11390.png
- %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\HYSoftIcons\10002_11838.png
- %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\HYSoftIcons\10002_11843.png
- %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\HYSoftIcons\10002_12035.png
- %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\HYSoftIcons\10002_12276.png
- %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\HYSoftIcons\10002_12282.png
- %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\HYSoftIcons\10002_12350.png
- %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\HYSoftIcons\10002_12616.png
- %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\HYSoftIcons\10002_12812.png
- %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\HYSoftIcons\10002_12856.png
- %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\HYSoftIcons\10002_12882.png
- %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\HYSoftIcons\10002_12934.png
- %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\HYSoftIcons\10002_12993.png
- %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\HYSoftIcons\10002_13406.png
- %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\HYSoftIcons\10002_13442.png
- %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\HYSoftIcons\10002_13478.png
- %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\HYSoftIcons\10002_13598.png
- %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\HYSoftIcons\10002_13874.png
- %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\HYSoftIcons\10002_14000.png
- %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\HYSoftIcons\10002_14497.png
- %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\HYSoftIcons\10002_14744.png
- %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\HYSoftIcons\10002_14754.png
- %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\HYSoftIcons\10002_15192.png
- %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\HYSoftIcons\10002_15501.png
- %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\HYSoftIcons\10002_15752.png
- %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\HYSoftIcons\10002_16490.png
- %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\HYSoftIcons\10002_16988.png
- %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\HYSoftIcons\10002_17183.png
- %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\HYSoftIcons\10002_17519.png
- %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\HYSoftIcons\10002_17588.png
- %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\HYSoftIcons\10002_19130.png
- %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\HYSoftIcons\10002_19227.png
- %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\HYSoftIcons\10002_19412.png
- %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\HYSoftIcons\10002_20621.png
- %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\HYSoftIcons\10002_21211.png
- %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\HYSoftIcons\10002_23980.png
- %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\HYSoftIcons\10002_24655.png
- %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\HYSoftIcons\10002_28108.png
- %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\HYSoftIcons\10002_28111.png
- %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\HYSoftIcons\10002_35858.png
- %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\HYSoftIcons\10002_38200.png
- %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\HYSoftIcons\10002_40694.png
- %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\HYSoftIcons\10002_40805.png
- %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\HYSoftIcons\10002_40898.png
- %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\HYSoftIcons\10002_41065.png
- %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\HYSoftIcons\10002_41100.png
- %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\HYSoftIcons\10002_41143.png
- %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\HYSoftIcons\10002_41153.png
- %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\Microsoft.VC80.ATL\Microsoft.VC80.ATL.manifest
- %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\Microsoft.VC80.ATL\atl80.dll
- %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\Microsoft.VC80.CRT\Microsoft.VC80.CRT.manifest
- %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\Microsoft.VC80.CRT\msvcm80.dll
- %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\Microsoft.VC80.CRT\msvcp80.dll
- %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\Microsoft.VC80.CRT\msvcr80.dll
- %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\ProtocolDll.dll
- %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\ReportDll.dll
- %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\ReportRecordDll.dll
- %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\UtilsDll.dll
- %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\bddlsvc.exe
- %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\bdrcdl.exe
- %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\config.xml
- %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\dl.dll
- %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\drivers\BDArKit.sys
- %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\ieBDSoftHelperPlug.dll
- %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\mindownload.ico
- %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\skin\adtipsui.rdb
- %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\skin\color_adtips.clr
- %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\skin\color_desc.clr
- %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\skin\color_openastips.clr
- %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\skin\color_tips.clr
- %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\skin\color_uninst.clr
- %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\skin\color_updatetips.clr
- %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\skin\font_adtips.f
- %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\skin\font_desc.f
- %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\skin\font_openastips.f
- %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\skin\font_tips.f
- %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\skin\font_uninst.f
- %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\skin\font_updatetips.f
- %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\skin\haiyanui.rdb
- %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\skin\openastipsui.rdb
- %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\skin\text_adtips.str
- %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\skin\text_cn.str
- %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\skin\text_openastips.str
- %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\skin\text_tips.str
- %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\skin\text_uninst.str
- %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\skin\text_updatetips.str
- %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\skin\tipsui.rdb
- %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\skin\uninstui.rdb
- %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\skin\updatetipsui.rdb
- %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\skin_engine.dll
- %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\uninstaller.exe
- %Program Files%\baidu\rj\favicon.ico
- %System%\config\systemprofile\AppData\Roaming\Baidu\BaiduRJDownloader\rpt.dat
- %System%\drivers\BDArKit.sys
- %User Temp%\nsd{random characters}.tmp
- %User Temp%\nsx{random characters}.tmp\InstallHelper.dll
- %System%\Tasks\BDDL Server
(Hinweis: %Application Data% ist der Ordner 'Anwendungsdaten' für den aktuellen Benutzer, normalerweise C:\Windows\Profile\{Benutzername}\Anwendungsdaten unter Windows 98 und ME, C:\WINNT\Profile\{Benutzername}\Anwendungsdaten unter Windows NT und C:\Dokumente und Einstellungen\{Benutzername}\Lokale Einstellungen\Anwendungsdaten unter Windows 2000, XP und Server 2003.. %Program Files%ist der Standardordner 'Programme', normalerweise C:\Programme.. %System% ist der Windows Systemordner. Er lautet in der Regel C:\Windows\System unter Windows 98 und ME, C:\WINNT\System32 unter Windows NT und 2000 sowie C:\Windows\System32 unter Windows XP und Server 2003.. %User Temp% ist der Ordner 'Temp' des aktuellen Benutzers, normalerweise C:\Dokumente und Einstellungen\{Benutzername}\Lokale Einstellungen\Temp unter Windows 2000, XP und Server 2003.)
Erstellt die folgenden Ordner:
- %All Users Profile%\Application Data\Baidu
- %All Users Profile%\Application Data\Baidu\BaiduRJDownloader
- %All Users Profile%\Application Data\Baidu\BaiduRJDownloader\Config
- %All Users Profile%\Baidu
- %All Users Profile%\Baidu\Common
- %Program Files%\baidu
- %Program Files%\baidu\BaiduRJDownloader
- %Program Files%\baidu\BaiduRJDownloader\2.0.0.289
- %Program Files%\baidu\rj
- %User Temp%\nsx{random characters}.tmp
(Hinweis: %Program Files%ist der Standardordner 'Programme', normalerweise C:\Programme.. %User Temp% ist der Ordner 'Temp' des aktuellen Benutzers, normalerweise C:\Dokumente und Einstellungen\{Benutzername}\Lokale Einstellungen\Temp unter Windows 2000, XP und Server 2003.)
Andere Systemänderungen
Fügt die folgenden Registrierungseinträge hinzu:
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AppID\{0031830A-A9D3-4f64-B6E8-3D55B68F4F9B}
(Default) = ieCommonPlugin
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
AppID\ieCommonPlugin.DLL
AppID = {0031830A-A9D3-4f64-B6E8-3D55B68F4F9B}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
ieBDSoftHelperPlug.Implement.1
(Default) = ieBDSoftHelperPlug Implement Class
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
ieBDSoftHelperPlug.Implement.1\CLSID
(Default) = {D3C9CF85-72D2-4d22-B16A-0B682403AB84}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
ieBDSoftHelperPlug.Implement
(Default) = ieBDSoftHelperPlug Implement Class
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
ieBDSoftHelperPlug.Implement\CLSID
(Default) = {D3C9CF85-72D2-4d22-B16A-0B682403AB84}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
ieBDSoftHelperPlug.Implement\CurVer
(Default) = ieBDSoftHelperPlug.Implement.1
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{D3C9CF85-72D2-4d22-B16A-0B682403AB84}
(Default) = ieBDSoftHelperPlug Implement Class
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{D3C9CF85-72D2-4d22-B16A-0B682403AB84}\ProgID
(Default) = ieBDSoftHelperPlug.Implement.1
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{D3C9CF85-72D2-4d22-B16A-0B682403AB84}\VersionIndependentProgID
(Default) = ieBDSoftHelperPlug.Implement
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{D3C9CF85-72D2-4d22-B16A-0B682403AB84}\InprocServer32
(Default) = %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\ieBDSoftHelperPlug.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{D3C9CF85-72D2-4d22-B16A-0B682403AB84}\InprocServer32
ThreadingModel = Apartment
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{D3C9CF85-72D2-4d22-B16A-0B682403AB84}\TypeLib
(Default) = {5FA67120-F0AC-4a6e-B806-AECC0D13D9EF}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
TypeLib\{5FA67120-F0AC-4A6E-B806-AECC0D13D9EF}\1.0
(Default) = ieCommonPlugin 1.0 Type Library
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
TypeLib\{5FA67120-F0AC-4A6E-B806-AECC0D13D9EF}\1.0\
FLAGS
(Default) = 0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
TypeLib\{5FA67120-F0AC-4A6E-B806-AECC0D13D9EF}\1.0\
0\win32
(Default) = %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\ieBDSoftHelperPlug.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
TypeLib\{5FA67120-F0AC-4A6E-B806-AECC0D13D9EF}\1.0\
HELPDIR
(Default) =
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{06AD210F-5953-4201-BB4F-81756DB68DF0}
(Default) = IImplement
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{06AD210F-5953-4201-BB4F-81756DB68DF0}\ProxyStubClsid
(Default) = {00020424-0000-0000-C000-000000000046}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{06AD210F-5953-4201-BB4F-81756DB68DF0}\ProxyStubClsid32
(Default) = {00020424-0000-0000-C000-000000000046}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{06AD210F-5953-4201-BB4F-81756DB68DF0}\TypeLib
(Default) = {5FA67120-F0AC-4A6E-B806-AECC0D13D9EF}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Interface\{06AD210F-5953-4201-BB4F-81756DB68DF0}\TypeLib
Version = 1.0
HKEY_LOCAL_MACHINE\SOFTWARE\baidu\
BaiduRJDownloader
InstallDir = %Program Files%\baidu\BaiduRJDownloader\2.0.0.289
HKEY_LOCAL_MACHINE\SOFTWARE\baidu\
BaiduRJDownloader
Version = 2.0.0.289
HKEY_LOCAL_MACHINE\SOFTWARE\baidu\
BaiduRJDownloader
IEPluginPath = %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\ieBDSoftHelperPlug.dll
HKEY_LOCAL_MACHINE\SOFTWARE\baidu\
BaiduRJDownloader
SupplyID = 10002
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
*\shell\dlhelper
(Default) = {hex values}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
*\shell\dlhelper
icon = %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\bdrcdl.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
*\shell\dlhelper\
command
(Default) = "%Program Files%\baidu\BaiduRJDownloader\2.0.0.289\BDHYServer.exe" "%1"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
BaiduRJDownloader
DisplayName = {hex values} 2.0.0.289
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
BaiduRJDownloader
UninstallString = %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\uninstaller.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
BaiduRJDownloader
Publisher = Beijing baidu Netcom science and technology co.ltd
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
BaiduRJDownloader
DisplayVersion = 2.0.0.289
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
BaiduRJDownloader
DisplayIcon = %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\mindownload.ico
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Internet Explorer\Low Rights\ElevationPolicy\
{849EE4F0-6AEA-41c9-8A21-5F700C3BBDD5}
AppName = bdrcdl.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Internet Explorer\Low Rights\ElevationPolicy\
{849EE4F0-6AEA-41c9-8A21-5F700C3BBDD5}
AppPath = %Program Files%\baidu\BaiduRJDownloader\2.0.0.289
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Internet Explorer\Low Rights\ElevationPolicy\
{849EE4F0-6AEA-41c9-8A21-5F700C3BBDD5}
Policy = 3
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\GroupOrderList
bddriver = {hex values}
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\ServiceGroupOrder
List = {hex values}
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\bd0001
Type = 1
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\bd0001
Start = 1
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\bd0001
ErrorControl = 0
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\bd0001
DisplayName = bd0001
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\bd0001
Description = bd0001
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\bd0001
ImagePath = system32\DRIVERS\bd0001.sys
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\bd0001
Group = bddriver
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\bd0001
Tag = 1
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\bd0004
Type = 1
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\bd0004
Start = 1
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\bd0004
ErrorControl = 0
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\bd0004
DisplayName = bd0004
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\bd0004
Description = bd0004
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\bd0004
ImagePath = system32\DRIVERS\bd0004.sys
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\bd0004
Group = bddriver
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\bd0004
Tag = 2
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\bd0004
InstallDir_gj = %Program Files%\baidu\BaiduRJDownloader\2.0.0.289
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\BDArKit
Type = 1
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\BDArKit
Start = 2
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\BDArKit
ErrorControl = 0
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\BDArKit
DisplayName = BDArKit
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\BDArKit
Description = BDArKit
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\BDArKit
ImagePath = system32\DRIVERS\BDArKit.sys
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\BDArKit
Group = bddriver
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\BDArKit
Tag = 4
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\BDMWrench
Type = 1
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\BDMWrench
Start = 1
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\BDMWrench
ErrorControl = 0
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\BDMWrench
DisplayName = BDMWrench
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\BDMWrench
Description = BDMWrench
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\BDMWrench
ImagePath = system32\DRIVERS\BDMWrench.sys
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\BDMWrench
Group = bddriver
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\BDMWrench
Tag = 5
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\bd0004
ImagePath = \??\%System%\DRIVERS\bd0004.sys
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\BDArKit
ImagePath = \??\%System%\DRIVERS\BDArKit.sys
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\BDMWrench
ImagePath = \??\%System%\DRIVERS\BDMWrench.sys
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\bddlsvc
Type = 272
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\bddlsvc
Start = 2
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\bddlsvc
ErrorControl = 1
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\bddlsvc
ImagePath = "%Program Files%\baidu\BaiduRJDownloader\2.0.0.289\bddlsvc.exe" -r
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\bddlsvc
DisplayName = BDHY Service
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\bddlsvc
Group = COM Infrastructure
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\bddlsvc
ObjectName = LocalSystem
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\bddlsvc
Description = {hex values}
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\bddlsvc
Type = 16
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Unknown\shell\opendlg\
command
(Default) = %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\BDHYServer.exe 1 2 "%1"
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Unknown\shell\openas\
command
(Default) = %Program Files%\baidu\BaiduRJDownloader\2.0.0.289\BDHYServer.exe 1 3 "%1"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Schedule\
TaskCache\Tasks\{3B021AA0-FBE7-48E6-BF25-33255F64DDB7}
Path = \BDDL Server
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Schedule\
TaskCache\Tasks\{3B021AA0-FBE7-48E6-BF25-33255F64DDB7}
Hash = {hex value}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Schedule\
TaskCache\Tree\BDDL Server
Id = {3B021AA0-FBE7-48E6-BF25-33255F64DDB7}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Schedule\
TaskCache\Tree\BDDL Server
Index = 3
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Schedule\
TaskCache\Tasks\{3B021AA0-FBE7-48E6-BF25-33255F64DDB7}
Triggers = {hex values}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Schedule\
TaskCache\Tasks\{3B021AA0-FBE7-48E6-BF25-33255F64DDB7}
DynamicInfo = {hex values}
Lösungen
Step 1
Für Windows ME und XP Benutzer: Stellen Sie vor einer Suche sicher, dass die Systemwiederherstellung deaktiviert ist, damit der gesamte Computer durchsucht werden kann.
Step 3
Dateien erkennen und deaktivieren, die als PUA_BaiduRJDownloader.GC entdeckt wurden
- Für Windows 98 und ME Benutzer: Der Windows Task-Manager zeigt möglicherweise nicht alle aktiven Prozesse an. Verwenden Sie in diesem Fall einen Prozess-Viewer eines Drittanbieters, vorzugsweise Process Explorer, um die Malware-/Grayware-/Spyware-Datei zu beenden. Dieses Tool können Sie hier. herunterladen.
- Wenn die entdeckte Datei im Windows Task-Manager oder Process Explorer angezeigt wird, aber nicht gelöscht werden kann, starten Sie Ihren Computer im abgesicherten Modus neu. Klicken Sie auf diesen Link, um alle erforderlichen Schritte anzuzeigen.
- Wenn die entdeckte Datei nicht im Windows Task-Manager oder im Process Explorer angezeigt wird, fahren Sie mit den nächsten Schritten fort.
Step 4
PUA_BaiduRJDownloader.GC über die eigene Option zum Deinstallieren entfernen
Step 5
Durchsuchen Sie Ihren Computer mit Ihrem Trend Micro Produkt, und löschen Sie Dateien, die als PUA_BaiduRJDownloader.GC entdeckt werden. Falls die entdeckten Dateien bereits von Ihrem Trend Micro Produkt gesäubert, gelöscht oder in Quarantäne verschoben wurden, sind keine weiteren Schritte erforderlich. Dateien in Quarantäne können einfach gelöscht werden. Auf dieser Knowledge-Base-Seite finden Sie weitere Informationen.
Nehmen Sie an unserer Umfrage teil