Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'BabylonToolbar' = '"%ProgramFiles%\BabylonToolbar\BabylonToolbar\1.4.19.19\BabylonToolbarsrv.exe" /md I'
Malicious functions:
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system:
Creates the following files:
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\flgs\.svn\prop-base\pt.png.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\flgs\.svn\prop-base\pl.png.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\flgs\.svn\prop-base\no.png.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\flgs\.svn\prop-base\ro.png.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\flgs\.svn\prop-base\se.png.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\flgs\.svn\prop-base\sa.png.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\flgs\.svn\prop-base\ru.png.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\flgs\.svn\prop-base\il.png.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\flgs\.svn\prop-base\he.png.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\flgs\.svn\prop-base\gr.png.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\flgs\.svn\prop-base\it.png.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\flgs\.svn\prop-base\nl.png.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\flgs\.svn\prop-base\jp.png.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\flgs\.svn\prop-base\ja.png.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\flgs\.svn\text-base\de.png.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\flgs\.svn\text-base\cz.png.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\flgs\.svn\text-base\cn.png.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\flgs\.svn\text-base\eg.png.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\flgs\.svn\text-base\fr.png.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\flgs\.svn\text-base\es.png.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\flgs\.svn\text-base\en.png.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\flgs\.svn\prop-base\ua.png.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\flgs\.svn\prop-base\tr.png.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\flgs\.svn\prop-base\sv.png.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\flgs\.svn\prop-base\us.png.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\flgs\.svn\text-base\bg.png.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\flgs\.svn\text-base\ae.png.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\flgs\.svn\text-base\Thumbs.db.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\flgs\ru.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\flgs\ro.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\flgs\pt.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\flgs\sa.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\flgs\tr.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\flgs\sv.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\flgs\se.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\flgs\ja.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\flgs\it.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\flgs\il.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\flgs\jp.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\flgs\pl.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\flgs\no.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\flgs\nl.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\flgs\.svn\prop-base\de.png.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\flgs\.svn\prop-base\cz.png.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\flgs\.svn\prop-base\cn.png.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\flgs\.svn\prop-base\eg.png.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\flgs\.svn\prop-base\fr.png.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\flgs\.svn\prop-base\es.png.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\flgs\.svn\prop-base\en.png.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\flgs\.svn\all-wcprops
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\flgs\us.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\flgs\ua.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\flgs\.svn\entries
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\flgs\.svn\prop-base\bg.png.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\flgs\.svn\prop-base\ae.png.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\flgs\.svn\prop-base\Thumbs.db.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\mnRadio\.svn\text-base\lines.gif.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\mnRadio\.svn\text-base\chooseStation.png.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\mnRadio\.svn\text-base\bg.png.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\mnRadio\.svn\text-base\pauseBtn.png.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\defaults\.svn\all-wcprops
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\mnRadio\.svn\text-base\rd_strp.png.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\mnRadio\.svn\text-base\playBtn.png.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\mnRadio\.svn\prop-base\lines.gif.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\mnRadio\.svn\prop-base\chooseStation.png.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\mnRadio\.svn\prop-base\bg.png.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\mnRadio\.svn\prop-base\pauseBtn.png.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\mnRadio\.svn\text-base\Thumbs.db.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\mnRadio\.svn\prop-base\rd_strp.png.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\mnRadio\.svn\prop-base\playBtn.png.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\components\FFHst.dll
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\instlgc.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\defaults\preferences\.svn\text-base\vssver.scc.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\components\FFHst.xpt
- %ProgramFiles%\BabylonToolbar\BabylonToolbar\1.4.19.19\uninstall.exe
- %ProgramFiles%\Mozilla Firefox\searchplugins\babylon.xml
- %ProgramFiles%\BabylonToolbar\BabylonToolbar\1.4.19.19\BabylonToolbar.crx
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\defaults\preferences\vssver.scc
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\defaults\preferences\instlPref.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\defaults\.svn\entries
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\defaults\preferences\.svn\all-wcprops
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\defaults\preferences\.svn\text-base\instlPref.js.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\defaults\preferences\.svn\prop-base\vssver.scc.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\defaults\preferences\.svn\entries
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\flgs\.svn\text-base\pt.png.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\flgs\.svn\text-base\pl.png.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\flgs\.svn\text-base\no.png.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\flgs\.svn\text-base\ro.png.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\flgs\.svn\text-base\se.png.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\flgs\.svn\text-base\sa.png.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\flgs\.svn\text-base\ru.png.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\flgs\.svn\text-base\il.png.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\flgs\.svn\text-base\he.png.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\flgs\.svn\text-base\gr.png.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\flgs\.svn\text-base\it.png.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\flgs\.svn\text-base\nl.png.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\flgs\.svn\text-base\jp.png.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\flgs\.svn\text-base\ja.png.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\mnRadio\playBtn.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\mnRadio\pauseBtn.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\mnRadio\lines.gif
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\mnRadio\rd_strp.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\mnRadio\.svn\prop-base\Thumbs.db.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\mnRadio\.svn\entries
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\mnRadio\.svn\all-wcprops
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\flgs\.svn\text-base\ua.png.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\flgs\.svn\text-base\tr.png.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\flgs\.svn\text-base\sv.png.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\flgs\.svn\text-base\us.png.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\mnRadio\chooseStation.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\mnRadio\bg.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\mnRadio\Thumbs.db
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\flgs\he.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\arwDwn.gif
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\09.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\.svn\text-base\vssver.scc.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\bbyln.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\greenCard.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\games.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\buy.gif
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\.svn\text-base\bbylnDef.js.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\.svn\text-base\babylon.xul.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\.svn\text-base\babylon.css.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\.svn\text-base\btnInf.js.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\.svn\text-base\tmplt.js.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\.svn\text-base\rd.htm.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\.svn\text-base\mtrprt.js.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\search.PNG
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\radio.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\privecy_16_hot.gif
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\stat.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\toolbar_icons_games.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\toolbarIcons_casino.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\tellafriend.gif
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\icons.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\home.gif
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\help_16.gif
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\languages.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\mj.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\lottery.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\logo.PNG
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\.svn\all-wcprops
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\vssver.scc
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\install.rdf
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\.svn\entries
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\.svn\text-base\install.rdf.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\.svn\text-base\chrome.manifest.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\.svn\prop-base\vssver.scc.svn-base
- %ProgramFiles%\BabylonToolbar\BabylonToolbar\1.4.19.19\BabylonToolbarApp.dll
- %ProgramFiles%\BabylonToolbar\BabylonToolbar\1.4.19.19\bh\BabylonToolbar.dll
- %TEMP%\<File name>.exe
- %ProgramFiles%\BabylonToolbar\BabylonToolbar\1.4.19.19\BabylonToolbarEng.dll
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\chrome.manifest
- %ProgramFiles%\BabylonToolbar\BabylonToolbar\1.4.19.19\BabylonToolbarsrv.exe
- %ProgramFiles%\BabylonToolbar\BabylonToolbar\1.4.19.19\BabylonToolbarTlbr.dll
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\vssver.scc
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\tmplt.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\rd.htm
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\.svn\all-wcprops
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\.svn\text-base\PPCB.js.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\.svn\prop-base\vssver.scc.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\.svn\entries
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\babylon.css
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\PPCB.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\.svn\text-base\vssver.scc.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\babylon.xul
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\mtrprt.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\btnInf.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\bbylnDef.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\.svn\text-base\privecy_16_hot.gif.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\.svn\text-base\mj.png.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\.svn\text-base\lottery.png.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\.svn\text-base\radio.png.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\.svn\text-base\tellafriend.gif.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\.svn\text-base\stat.png.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\.svn\text-base\search.PNG.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\.svn\text-base\help_16.gif.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\.svn\text-base\greenCard.png.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\.svn\text-base\games.png.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\.svn\text-base\home.gif.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\.svn\text-base\logo.PNG.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\.svn\text-base\languages.png.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\.svn\text-base\icons.png.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\flgs\eg.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\flgs\de.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\flgs\cz.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\flgs\en.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\flgs\gr.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\flgs\fr.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\flgs\es.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\flgs\Thumbs.db
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\.svn\text-base\vssver.scc.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\.svn\text-base\translate.PNG.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\flgs\ae.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\flgs\cn.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\flgs\ch.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\flgs\bg.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\.svn\prop-base\greenCard.png.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\.svn\prop-base\games.png.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\.svn\prop-base\buy.gif.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\.svn\prop-base\help_16.gif.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\.svn\prop-base\languages.png.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\.svn\prop-base\icons.png.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\.svn\prop-base\home.gif.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\.svn\all-wcprops
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\vssver.scc
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\translate.PNG
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\.svn\entries
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\.svn\prop-base\bbyln.png.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\.svn\prop-base\arwDwn.gif.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\.svn\prop-base\09.png.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\.svn\prop-base\vssver.scc.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\.svn\prop-base\translate.PNG.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\.svn\prop-base\tellafriend.gif.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\.svn\text-base\09.png.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\.svn\text-base\buy.gif.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\.svn\text-base\bbyln.png.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\.svn\text-base\arwDwn.gif.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\.svn\prop-base\mj.png.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\.svn\prop-base\lottery.png.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\.svn\prop-base\logo.PNG.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\.svn\prop-base\privecy_16_hot.gif.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\.svn\prop-base\stat.png.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\.svn\prop-base\search.PNG.svn-base
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\ffxtlbr@babylon.com\content\imgs\.svn\prop-base\radio.png.svn-base
Deletes the following files:
- %TEMP%\nsp2.tmp\UserInfo.dll
- %TEMP%\nsp2.tmp\System.dll
Network activity:
Connects to:
- 'li##.spiapi.com':80
TCP:
HTTP GET requests:
- http://li##.spiapi.com/track/pixel?a=###########################################################################################################
UDP:
- DNS ASK li##.spiapi.com
Miscellaneous:
Creates and executes the following:
- '%ProgramFiles%\BabylonToolbar\BabylonToolbar\1.4.19.19\BabylonToolbarsrv.exe' /RegServer
- '%TEMP%\<File name>.exe' /babTrack="affID=17483" /srcExt=ss /babExt=babExt /instlref=sst /aflt=ppcbl /mnt /S /mds /mhp