ADWARE.WIN32.INSTALLCORE.BA
Win32/InstallCore.Gen.A potentially unwanted (ESET-NOD32)
Windows
Tipo de malware
Adware
Destructivo?
No
Cifrado
In the Wild:
Sí
Resumen y descripción
Detalles técnicos
Instalación
Infiltra los archivos siguientes:
- %User Temp%\is-0HI89.tmp\f5b1884598413730f6ef6ee2a65314cbe2ba53ea.tmp
- %User Temp%\is-L9GLG.tmp\_isetup\_shfoldr.dll
- %Program Files%\Tenod\Sakicili.exe
- %Program Files%\Tenod\unins000.dat
- %Program Files%\Tenod\is-BH7S7.tmp
- %Program Files%\Tenod\is-H7A93.tmp
- %Program Files%\Tenod\is-BM61K.tmp
- %Program Files%\Tenod\is-I37LK.tmp
- %Program Files%\Tenod\is-0J9NR.tmp
- %Program Files%\Tenod\is-DJTQ3.tmp
- %Program Files%\Tenod\is-Q7QPL.tmp
- %Program Files%\Tenod\is-3RESM.tmp
- %Program Files%\Tenod\is-4RB66.tmp
- %Program Files%\Tenod\unins000.exe
- %Program Files%\Tenod\Loherabipari.pages
- %Program Files%\Tenod\Sakicili.exe
- %Program Files%\Tenod\Copam.doc
- %Program Files%\Tenod\Lekohatopole.wav
- %Program Files%\Tenod\Cohetamo
- %Program Files%\Tenod\Monatabora.com
- %Program Files%\Tenod\Hepug.txt
- %Program Files%\Tenod\Betukotup.t
Crea las carpetas siguientes:
- %User Temp%\is-0HI89.tmp
- %User Temp%\is-L9GLG.tmp
- %User Temp%\is-L9GLG.tmp\_isetup
- %Program Files%\Tenod
(Nota: %User Temp% es la carpeta Temp del usuario activo, que en el caso de Windows 2000, XP y Server 2003 suele estar en C:\Documents and Settings\{nombre de usuario}\Local Settings\Temp).
. %Program Files% es la carpeta Archivos de programa predeterminada, que suele estar en C:\Archivos de programa).)Otras modificaciones del sistema
Agrega las siguientes entradas de registro:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Tenod_is1
Inno Setup: Setup Version = 5.5.4 (a)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Tenod_is1
Inno Setup: App Path = %Program Files%\Tenod
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Tenod_is1
InstallLocation = %Program Files%\Tenod\
KEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Tenod_is1
Inno Setup: Icon Group = Tenod
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Tenod_is1
DisplayName = Tenod version 3.4
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Tenod_is1
DisplayIcon = %Program Files%\Tenod\Habegemoc.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Tenod_is1
UninstallString = "%Program Files%\Tenod\unins000.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Tenod_is1
QuietUninstallString = "%Program Files%\Tenod\unins000.exe" /SILENT
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Tenod_is1
DisplayVersion = 3.4
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Tenod_is1
NoModify = 1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Tenod_is1
NoRepair = 1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Tenod_is1
InstallDate = {Installation Date}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Tenod_is1
MajorVersion = 3
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Tenod_is1
MinorVersion = 4
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Tenod_is1
EstimatedSize = 861