Trojan.MulDrop8.30529

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Adguard' = '%ProgramFiles%\Adguard\Adguard.exe /nosplash /nosplash'

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\Adguard Service] 'Start' = '00000002'
[<HKLM>\SYSTEM\ControlSet001\Services\Adguard Service] 'ImagePath' = '"%ProgramFiles%\Adguard\AdguardSvc.exe"'
[<HKLM>\SYSTEM\ControlSet001\Services\adgnetworktdidrv] 'Start' = '00000001'
[<HKLM>\SYSTEM\ControlSet001\Services\adgnetworktdidrv] 'ImagePath' = 'system32\drivers\adgnetworktdidrv.sys'

Malicious functions:

To bypass firewall, removes or modifies the following registry keys:

[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%ProgramFiles%\Adguard\AdguardSvc.exe' = '%ProgramFiles%\Adguard\Adgua...

Executes the following:

'<SYSTEM32>\taskkill.exe' /f /im "Adguard.exe" /t
'<SYSTEM32>\taskkill.exe' /f /im "AdguardSvc.exe" /t

Modifies file system:

Creates the following files:

%TEMP%\7ZipSfx.000\setup.msi
%ProgramFiles%\Adguard\AdguardNetApi.dll
%ProgramFiles%\Adguard\langs\Adguard.UI.resources.zh.dll
%ProgramFiles%\Adguard\langs\Adguard.UI.resources.vi.dll
%ProgramFiles%\Adguard\langs\Adguard.UI.resources.uk.dll
%ProgramFiles%\Adguard\langs\Adguard.UI.resources.tr.dll
%ProgramFiles%\Adguard\langs\Adguard.UI.resources.sv.dll
%ProgramFiles%\Adguard\Adguard.Network.dll
%ProgramFiles%\Adguard\langs\Adguard.UI.resources.sr.dll
%ProgramFiles%\Adguard\langs\Adguard.UI.resources.sk.dll
%ProgramFiles%\Adguard\langs\Adguard.UI.resources.ro.dll
%ProgramFiles%\Adguard\langs\Adguard.UI.resources.pt-PT.dll
%ProgramFiles%\Adguard\langs\Adguard.UI.resources.pt.dll
%ProgramFiles%\Adguard\langs\Adguard.UI.resources.pl.dll
%ProgramFiles%\Adguard\langs\Adguard.UI.resources.no.dll
%ProgramFiles%\Adguard\langs\Adguard.UI.resources.zh-TW.dll
%ProgramFiles%\Adguard\AdguardNetLib.dll
%ProgramFiles%\Adguard\logo.png
%ProgramFiles%\Adguard\langs\Adguard.UI.resources.ko.dll
%ProgramFiles%\Adguard\AdguardSvc.exe
%ProgramFiles%\Adguard\nss\libplds4.dll
%ProgramFiles%\Adguard\nss\libplc4.dll
%ProgramFiles%\Adguard\nss\libnspr4.dll
%ProgramFiles%\Adguard\libs\inststlib64.dll
%ProgramFiles%\Adguard\default.adg
%ProgramFiles%\Adguard\ICSharpCode.AvalonEdit.dll
%ProgramFiles%\Adguard\nss\freebl3.dll
%ProgramFiles%\Adguard\drivers.bin
%ProgramFiles%\Adguard\nss\certutil.exe
%ProgramFiles%\Adguard\Brotli.NET.dll
%ProgramFiles%\Adguard\brolib64.dll
%ProgramFiles%\Adguard\brolib32.dll
%ProgramFiles%\Adguard\AdguardSvc.exe.manifest
%ProgramFiles%\Adguard\AdguardSvc.exe.config
%ProgramFiles%\Adguard\langs\Adguard.UI.resources.nl.dll
%ProgramFiles%\Adguard\langs\Adguard.UI.resources.ru.dll
%ProgramFiles%\Adguard\langs\Adguard.UI.resources.ja.dll
%ProgramFiles%\Adguard\langs\Adguard.UI.resources.it.dll
%ProgramFiles%\Adguard\Microsoft.Expression.Interactions.dll
%ProgramFiles%\Adguard\langs\Adguard.Filter.resources.sk.dll
%ProgramFiles%\Adguard\langs\Adguard.Filter.resources.zh.dll
%ProgramFiles%\Adguard\langs\Adguard.Filter.resources.vi.dll
%ProgramFiles%\Adguard\langs\Adguard.Filter.resources.uk.dll
%ProgramFiles%\Adguard\langs\Adguard.Filter.resources.tr.dll
%ProgramFiles%\Adguard\langs\Adguard.Filter.resources.sv.dll
%ProgramFiles%\Adguard\langs\Adguard.Filter.resources.sr.dll
%ProgramFiles%\Adguard\langs\Adguard.Filter.resources.ru.dll
%ProgramFiles%\Adguard\Adguard.Global.dll
%ProgramFiles%\Adguard\langs\Adguard.Filter.resources.ro.dll
%ProgramFiles%\Adguard\langs\Adguard.Filter.resources.pt-PT.dll
%ProgramFiles%\Adguard\langs\Adguard.Filter.resources.pt.dll
%ProgramFiles%\Adguard\langs\Adguard.Filter.resources.pl.dll
%ProgramFiles%\Adguard\langs\Adguard.Filter.resources.no.dll
%ProgramFiles%\Adguard\Adguard.Ipc.dll
%ProgramFiles%\Adguard\langs\Adguard.Filter.resources.ko.dll
%ProgramFiles%\Adguard\Adguard.Safebrowsing.dll
%ProgramFiles%\Adguard\Adguard.Tools.exe
%ProgramFiles%\Adguard\langs\Adguard.UI.resources.id.dll
%ProgramFiles%\Adguard\langs\Adguard.Filter.resources.zh-TW.dll
%ProgramFiles%\Adguard\langs\Adguard.UI.resources.hy.dll
%ProgramFiles%\Adguard\langs\Adguard.UI.resources.hu.dll
%ProgramFiles%\Adguard\langs\Adguard.UI.resources.hr.dll
%ProgramFiles%\Adguard\langs\Adguard.UI.resources.he.dll
%ProgramFiles%\Adguard\langs\Adguard.UI.resources.fr.dll
%ProgramFiles%\Adguard\langs\Adguard.UI.resources.fa.dll
%ProgramFiles%\Adguard\langs\Adguard.UI.resources.es.dll
%ProgramFiles%\Adguard\Adguard.UI.dll
%ProgramFiles%\Adguard\langs\Adguard.UI.resources.de.dll
%ProgramFiles%\Adguard\langs\Adguard.UI.resources.da.dll
%ProgramFiles%\Adguard\langs\Adguard.UI.resources.bg.dll
%ProgramFiles%\Adguard\langs\Adguard.UI.resources.ar.dll
%ProgramFiles%\Adguard\Adguard.Tools.exe.manifest
%ProgramFiles%\Adguard\Adguard.Service.dll
%ProgramFiles%\Adguard\langs\Adguard.Filter.resources.nl.dll
%ProgramFiles%\Adguard\Newtonsoft.Json.dll
%WINDIR%\Installer\MSIE.tmp
%ALLUSERSPROFILE%\Application Data\fontcacheev1.dat
%ALLUSERSPROFILE%\Application Data\Adguard\safebrowsing.db
%ALLUSERSPROFILE%\Application Data\Adguard\safebrowsing.db-journal
%ALLUSERSPROFILE%\Application Data\Adguard\config3780b8da6006424e9aea936a858dc117.xml
<LS_APPDATA>\Adguard_Software_Ltd\Adguard.exe_StrongName_fx3hfgw3lp332eqb4g0rna0r2dpoucxg\6.3.1399.4073\aqga3pvs.newcfg
%ALLUSERSPROFILE%\Application Data\Adguard\Logs\agent\agent_14-07-2018-17_53_59-2018-07-14.log
<SYSTEM32>\d3dx9_11.dll.tmp
<DRIVERS>\vwifikerneldrv.sys
%WINDIR%\Temp\Adguard\eed3368c373648fd88bc8ba17ba3a3b2\Userscripts\Web of Trust Beta.txt
%WINDIR%\Temp\Adguard\eed3368c373648fd88bc8ba17ba3a3b2\Userscripts\Resources\Web of Trust.txt
%WINDIR%\Temp\Adguard\eed3368c373648fd88bc8ba17ba3a3b2\Userscripts\Resources\Web of Trust Beta.txt
%WINDIR%\Temp\Adguard\eed3368c373648fd88bc8ba17ba3a3b2\Userscripts\Resources\Popup Blocker by AdGuard.txt
%WINDIR%\Temp\Adguard\eed3368c373648fd88bc8ba17ba3a3b2\Userscripts\Resources\Popup Blocker by AdGuard (Beta).txt
%WINDIR%\Temp\Adguard\eed3368c373648fd88bc8ba17ba3a3b2\Userscripts\Resources\Adguard Assistant.txt
%ALLUSERSPROFILE%\Application Data\Adguard\locale.dat
%WINDIR%\Temp\Adguard\eed3368c373648fd88bc8ba17ba3a3b2\Userscripts\Requires\Web of Trust Beta.txt
%WINDIR%\WinSxS\poqexecv2sys.log
%ALLUSERSPROFILE%\Application Data\Adguard\NetworkTemp\SSL\cert.db
<DRIVERS>\adgnetworktdidrv.sys
%ProgramFiles%\Adguard\Drivers\x86\AdguardNetReg.exe
%ProgramFiles%\Adguard\Drivers\x86\AdguardNetLib.dll
%ProgramFiles%\Adguard\Drivers\x86\adgnetworkwfpdrv.sys
%ProgramFiles%\Adguard\Drivers\x86\adgnetworktdidrv.sys
%ProgramFiles%\Adguard\Drivers\x64\AdguardNetReg.exe
%ProgramFiles%\Adguard\Drivers\x64\AdguardNetLib.dll
%ProgramFiles%\Adguard\Drivers\x64\adgnetworkwfpdrv.sys
%ProgramFiles%\Adguard\Drivers\x64\adgnetworktdidrv.sys
%ProgramFiles%\Adguard\Drivers\win10\x86\adgnetworkwfpdrv.sys
%ProgramFiles%\Adguard\Drivers\win10\x86\adgnetworktdidrv.sys
%ProgramFiles%\Adguard\Drivers\win10\x64\adgnetworkwfpdrv.sys
%ProgramFiles%\Adguard\Drivers\win10\x64\adgnetworktdidrv.sys
%ALLUSERSPROFILE%\Application Data\Microsoft\Network\admngr.dat
%WINDIR%\Temp\Adguard\eed3368c373648fd88bc8ba17ba3a3b2\Userscripts\Resources\Adguard Assistant Beta.txt
%WINDIR%\Temp\Adguard\eed3368c373648fd88bc8ba17ba3a3b2\Userscripts\Web of Trust.txt
%WINDIR%\Temp\Adguard\eed3368c373648fd88bc8ba17ba3a3b2\Userscripts\Requires\Web of Trust.txt
%WINDIR%\Temp\Adguard\eed3368c373648fd88bc8ba17ba3a3b2\Userscripts\Requires\Popup Blocker by AdGuard.txt
%TEMP%\7ZipSfx.000\Adguard\nss\libnspr4.dll
%ProgramFiles%\Adguard\nss\nss3.dll
%WINDIR%\Installer\{685F6AB3-7C61-42D1-AE5B-3864E48D1035}\AdguardIcon.exe
%WINDIR%\Installer\24d8d.msi
%WINDIR%\Installer\MSIC.tmp
%ALLUSERSPROFILE%\Start Menu\Programs\Adguard\Uninstall AdGuard.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Adguard\AdGuard.lnk
%WINDIR%\Installer\MSIB.tmp
%ProgramFiles%\Adguard\System.Windows.Interactivity.dll
%ProgramFiles%\Adguard\System.Data.SQLite.dll
%ProgramFiles%\Adguard\nss\sqlite3.dll
%ProgramFiles%\Adguard\SQLite.Interop.dll
%ProgramFiles%\Adguard\nss\softokn3.dll
%ProgramFiles%\Adguard\nss\smime3.dll
%ProgramFiles%\Adguard\nss\nssutil3.dll
%ProgramFiles%\Adguard\nss\nssdbm3.dll
%WINDIR%\Installer\{685F6AB3-7C61-42D1-AE5B-3864E48D1035}\Uninstall.exe
%ProgramFiles%\Adguard\nss\nssckbi.dll
%WINDIR%\Installer\MSIF.tmp
%WINDIR%\Installer\MSIF.tmp-\Adguard.CustomActions.dll
%WINDIR%\Installer\MSIF.tmp-\Microsoft.Deployment.WindowsInstaller.dll
%WINDIR%\Temp\Adguard\eed3368c373648fd88bc8ba17ba3a3b2\Userscripts\Requires\Adguard Assistant.txt
%WINDIR%\Temp\Adguard\eed3368c373648fd88bc8ba17ba3a3b2\Userscripts\Requires\Adguard Assistant Beta.txt
%WINDIR%\Temp\Adguard\eed3368c373648fd88bc8ba17ba3a3b2\Userscripts\Popup Blocker by AdGuard.txt
%WINDIR%\Temp\Adguard\eed3368c373648fd88bc8ba17ba3a3b2\Userscripts\Popup Blocker by AdGuard (Beta).txt
%WINDIR%\Temp\Adguard\eed3368c373648fd88bc8ba17ba3a3b2\Userscripts\Adguard Assistant.txt
%WINDIR%\Temp\Adguard\eed3368c373648fd88bc8ba17ba3a3b2\Userscripts\Adguard Assistant Beta.txt
%WINDIR%\Temp\Adguard\eed3368c373648fd88bc8ba17ba3a3b2\settings.json
%WINDIR%\Temp\Adguard\eed3368c373648fd88bc8ba17ba3a3b2\Filters\6.txt
%WINDIR%\Temp\Adguard\eed3368c373648fd88bc8ba17ba3a3b2\Filters\2.txt
%WINDIR%\Temp\Adguard\eed3368c373648fd88bc8ba17ba3a3b2\Filters\1.txt
%ALLUSERSPROFILE%\Application Data\Adguard\adguard.db
%ALLUSERSPROFILE%\Application Data\Adguard\adguard.db-journal
%ALLUSERSPROFILE%\Application Data\Adguard\Logs\service\service_14-07-2018-17_53_53-2018-07-14.log
%WINDIR%\Installer\MSIF.tmp-\CustomAction.config
%WINDIR%\Temp\Adguard\eed3368c373648fd88bc8ba17ba3a3b2\Userscripts\Requires\Popup Blocker by AdGuard (Beta).txt
%ProgramFiles%\Adguard\langs\Adguard.Filter.resources.ja.dll
%ProgramFiles%\Adguard\langs\Adguard.Filter.resources.it.dll
%ProgramFiles%\Adguard\langs\Adguard.Filter.resources.id.dll
%TEMP%\7ZipSfx.000\Adguard\Adguard.Network.dll
%TEMP%\7ZipSfx.000\Adguard\Adguard.Ipc.dll
%TEMP%\7ZipSfx.000\Adguard\Adguard.Global.dll
%TEMP%\7ZipSfx.000\Adguard\langs\Adguard.Filter.resources.zh.dll
%TEMP%\7ZipSfx.000\Adguard\langs\Adguard.Filter.resources.zh-TW.dll
%TEMP%\7ZipSfx.000\Adguard\Adguard.Service.dll
%TEMP%\7ZipSfx.000\Adguard\langs\Adguard.UI.resources.ar.dll
%TEMP%\7ZipSfx.000\Adguard\langs\Adguard.Filter.resources.vi.dll
%TEMP%\7ZipSfx.000\Adguard\langs\Adguard.Filter.resources.sv.dll
%TEMP%\7ZipSfx.000\Adguard\langs\Adguard.Filter.resources.sr.dll
%TEMP%\7ZipSfx.000\Adguard\langs\Adguard.Filter.resources.sk.dll
%TEMP%\7ZipSfx.000\Adguard\langs\Adguard.Filter.resources.ru.dll
%TEMP%\7ZipSfx.000\Adguard\langs\Adguard.Filter.resources.ro.dll
%TEMP%\7ZipSfx.000\Adguard\langs\Adguard.Filter.resources.uk.dll
%TEMP%\7ZipSfx.000\Adguard\langs\Adguard.Filter.resources.tr.dll
%TEMP%\7ZipSfx.000\Adguard\langs\Adguard.UI.resources.pt-PT.dll
%TEMP%\7ZipSfx.000\Adguard\langs\Adguard.UI.resources.bg.dll
%TEMP%\7ZipSfx.000\Adguard\langs\Adguard.UI.resources.nl.dll
%TEMP%\7ZipSfx.000\Adguard\langs\Adguard.UI.resources.ko.dll
%TEMP%\7ZipSfx.000\Adguard\langs\Adguard.UI.resources.ja.dll
%TEMP%\7ZipSfx.000\Adguard\langs\Adguard.UI.resources.it.dll
%TEMP%\7ZipSfx.000\Adguard\langs\Adguard.UI.resources.id.dll
%TEMP%\7ZipSfx.000\Adguard\langs\Adguard.UI.resources.hy.dll
%TEMP%\7ZipSfx.000\Adguard\langs\Adguard.UI.resources.hu.dll
%TEMP%\7ZipSfx.000\Adguard\langs\Adguard.UI.resources.hr.dll
%TEMP%\7ZipSfx.000\Adguard\langs\Adguard.UI.resources.he.dll
%TEMP%\7ZipSfx.000\Adguard\langs\Adguard.UI.resources.fr.dll
%TEMP%\7ZipSfx.000\Adguard\langs\Adguard.UI.resources.fa.dll
%TEMP%\7ZipSfx.000\Adguard\langs\Adguard.UI.resources.es.dll
%TEMP%\7ZipSfx.000\Adguard\langs\Adguard.UI.resources.de.dll
%TEMP%\7ZipSfx.000\Adguard\langs\Adguard.UI.resources.da.dll
%TEMP%\7ZipSfx.000\Adguard\langs\Adguard.Filter.resources.pt.dll
%TEMP%\7ZipSfx.000\Adguard\langs\Adguard.Filter.resources.pt-PT.dll
%TEMP%\7ZipSfx.000\Adguard\Adguard.UI.dll
%TEMP%\7ZipSfx.000\Adguard\langs\Adguard.Filter.resources.pl.dll
%TEMP%\7ZipSfx.000\Adguard\langs\Adguard.Filter.resources.no.dll
%TEMP%\7ZipSfx.000\Adguard\nss\certutil.exe
%TEMP%\7ZipSfx.000\cert.db
%TEMP%\7ZipSfx.000\Adguard\Adguard.Tools.exe
%TEMP%\7ZipSfx.000\Adguard\Adguard.exe
%TEMP%\7ZipSfx.000\Adguard\AdguardSvc.exe.config
%TEMP%\7ZipSfx.000\Adguard\Adguard.exe.config
%TEMP%\7ZipSfx.000\Adguard Personal CA.cer
%TEMP%\7ZipSfx.000\Adguard\default.adg
%TEMP%\7ZipSfx.000\adguard.db
%TEMP%\7ZipSfx.000\Adguard\langs\Adguard.UI.resources.pl.dll
%TEMP%\7ZipSfx.000\Adguard\AdguardSvc.exe.manifest
%TEMP%\7ZipSfx.000\Adguard\Adguard.Tools.exe.manifest
%TEMP%\7ZipSfx.000\Adguard\Adguard.exe.manifest
%TEMP%\7ZipSfx.000\Adguard\drivers.bin
%TEMP%\7ZipSfx.000\Adguard\logo.png
%TEMP%\7ZipSfx.000\Setup.exe
%TEMP%\7ZipSfx.000\Adguard\Adguard.Commons.dll
%TEMP%\7ZipSfx.000\Adguard\langs\Adguard.UI.resources.no.dll
%TEMP%\7ZipSfx.000\Adguard\langs\Adguard.Filter.resources.ar.dll
%TEMP%\7ZipSfx.000\Adguard\Adguard.Filter.dll
%TEMP%\7ZipSfx.000\Adguard\AdguardSvc.exe
%TEMP%\7ZipSfx.000\Adguard\langs\Adguard.Filter.resources.ko.dll
%TEMP%\7ZipSfx.000\Adguard\langs\Adguard.Filter.resources.ja.dll
%TEMP%\7ZipSfx.000\Adguard\langs\Adguard.Filter.resources.it.dll
%TEMP%\7ZipSfx.000\Adguard\langs\Adguard.Filter.resources.id.dll
%TEMP%\7ZipSfx.000\Adguard\langs\Adguard.Filter.resources.hy.dll
%TEMP%\7ZipSfx.000\Adguard\langs\Adguard.Filter.resources.hu.dll
%TEMP%\7ZipSfx.000\Adguard\langs\Adguard.Filter.resources.hr.dll
%TEMP%\7ZipSfx.000\Adguard\langs\Adguard.Filter.resources.he.dll
%TEMP%\7ZipSfx.000\Adguard\langs\Adguard.Filter.resources.fr.dll
%TEMP%\7ZipSfx.000\Adguard\langs\Adguard.Filter.resources.fa.dll
%TEMP%\7ZipSfx.000\Adguard\langs\Adguard.Filter.resources.es.dll
%TEMP%\7ZipSfx.000\Adguard\langs\Adguard.Filter.resources.de.dll
%TEMP%\7ZipSfx.000\Adguard\langs\Adguard.Filter.resources.da.dll
%TEMP%\7ZipSfx.000\Adguard\langs\Adguard.Filter.resources.bg.dll
%TEMP%\7ZipSfx.000\Adguard\langs\Adguard.Filter.resources.nl.dll
%TEMP%\7ZipSfx.000\Adguard\Adguard.Safebrowsing.dll
%TEMP%\7ZipSfx.000\Adguard\langs\Adguard.UI.resources.pt.dll
%WINDIR%\Installer\MSI7.tmp
%WINDIR%\Installer\MSI2.tmp
%WINDIR%\Installer\MSI6.tmp-\CustomAction.config
%WINDIR%\Installer\MSI6.tmp-\Microsoft.Deployment.WindowsInstaller.dll
%WINDIR%\Installer\MSI6.tmp-\Adguard.CustomActions.dll
%WINDIR%\Installer\MSI6.tmp
%WINDIR%\Installer\MSI5.tmp
%WINDIR%\Installer\24d8b.ipi
%WINDIR%\Installer\MSI4.tmp
%WINDIR%\Installer\MSI3.tmp-\CustomAction.config
%WINDIR%\Installer\MSI3.tmp-\Microsoft.Deployment.WindowsInstaller.dll
%WINDIR%\Installer\MSI3.tmp-\Adguard.CustomActions.dll
%WINDIR%\Installer\MSI3.tmp
%WINDIR%\Installer\MSI2.tmp-\CustomAction.config
%WINDIR%\Installer\MSI2.tmp-\Microsoft.Deployment.WindowsInstaller.dll
%WINDIR%\Installer\MSI2.tmp-\Adguard.CustomActions.dll
%TEMP%\7ZipSfx.000\Adguard\langs\Adguard.UI.resources.ro.dll
%WINDIR%\Installer\MSI8.tmp
%WINDIR%\Installer\MSI9.tmp
C:\Config.Msi\24d8c.rbs
%ProgramFiles%\Adguard\Adguard.Commons.dll
%ProgramFiles%\Adguard\langs\Adguard.Filter.resources.hu.dll
%ProgramFiles%\Adguard\langs\Adguard.Filter.resources.hr.dll
%ProgramFiles%\Adguard\langs\Adguard.Filter.resources.he.dll
%ProgramFiles%\Adguard\langs\Adguard.Filter.resources.fr.dll
%ProgramFiles%\Adguard\langs\Adguard.Filter.resources.fa.dll
%ProgramFiles%\Adguard\langs\Adguard.Filter.resources.es.dll
%ProgramFiles%\Adguard\Adguard.Filter.dll
%ProgramFiles%\Adguard\langs\Adguard.Filter.resources.de.dll
%ProgramFiles%\Adguard\langs\Adguard.Filter.resources.da.dll
%ProgramFiles%\Adguard\langs\Adguard.Filter.resources.bg.dll
%ProgramFiles%\Adguard\langs\Adguard.Filter.resources.ar.dll
%ProgramFiles%\Adguard\Adguard.exe.manifest
%ProgramFiles%\Adguard\Adguard.exe.config
%ProgramFiles%\Adguard\Adguard.exe
%ProgramFiles%\Adguard\langs\Adguard.Filter.resources.hy.dll
%WINDIR%\ehome\usrsts..dll
%ALLUSERSPROFILE%\Application Data\Adguard\NetworkTemp\SSL\Adguard Personal CA.cer
%WINDIR%\Installer\MSI1.tmp-\Adguard.CustomActions.dll
%TEMP%\7ZipSfx.000\Adguard\langs\Adguard.UI.resources.zh-TW.dll
%TEMP%\7ZipSfx.000\Adguard\Brotli.NET.dll
%TEMP%\7ZipSfx.000\Adguard\brolib64.dll
%TEMP%\7ZipSfx.000\Adguard\brolib32.dll
%TEMP%\7ZipSfx.000\Adguard\AdguardNetLib.dll
%TEMP%\7ZipSfx.000\Adguard\AdguardNetApi.dll
%TEMP%\7ZipSfx.000\Adguard\langs\Adguard.UI.resources.zh.dll
%TEMP%\7ZipSfx.000\Adguard\langs\Adguard.UI.resources.vi.dll
%TEMP%\7ZipSfx.000\Adguard\ICSharpCode.AvalonEdit.dll
%TEMP%\7ZipSfx.000\Adguard\langs\Adguard.UI.resources.uk.dll
%TEMP%\7ZipSfx.000\Adguard\langs\Adguard.UI.resources.tr.dll
%TEMP%\7ZipSfx.000\Adguard\langs\Adguard.UI.resources.sv.dll
%TEMP%\7ZipSfx.000\Adguard\langs\Adguard.UI.resources.sr.dll
%TEMP%\7ZipSfx.000\Adguard\langs\Adguard.UI.resources.sk.dll
%TEMP%\7ZipSfx.000\Adguard\langs\Adguard.UI.resources.ru.dll
%WINDIR%\Installer\MSI1.tmp-\Microsoft.Deployment.WindowsInstaller.dll
%WINDIR%\Installer\MSI1.tmp-\CustomAction.config
%TEMP%\7ZipSfx.000\Adguard\libs\inststlib64.dll
%TEMP%\7ZipSfx.000\Adguard\nss\libplds4.dll
%TEMP%\7ZipSfx.000\Adguard\nss\freebl3.dll
%WINDIR%\Installer\MSI1.tmp
%WINDIR%\Installer\24d89.msi
%TEMP%\7ZipSfx.000\Adguard\System.Windows.Interactivity.dll
%TEMP%\7ZipSfx.000\Adguard\System.Data.SQLite.dll
%TEMP%\7ZipSfx.000\Adguard\nss\sqlite3.dll
%TEMP%\7ZipSfx.000\Adguard\SQLite.Interop.dll
%TEMP%\7ZipSfx.000\Adguard\nss\softokn3.dll
%TEMP%\7ZipSfx.000\Adguard\nss\smime3.dll
%TEMP%\7ZipSfx.000\Adguard\nss\nssutil3.dll
%TEMP%\7ZipSfx.000\Adguard\nss\nssdbm3.dll
%TEMP%\7ZipSfx.000\Adguard\nss\nssckbi.dll
%TEMP%\7ZipSfx.000\Adguard\nss\nss3.dll
%TEMP%\7ZipSfx.000\Adguard\Newtonsoft.Json.dll
%TEMP%\7ZipSfx.000\Adguard\Microsoft.Expression.Interactions.dll
%TEMP%\7ZipSfx.000\Adguard\nss\libplc4.dll
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\CJCTQ25G\wpad[1].cache

Deletes the following files:

%WINDIR%\Installer\MSI1.tmp-\Adguard.CustomActions.dll
%WINDIR%\Temp\Adguard\eed3368c373648fd88bc8ba17ba3a3b2\settings.json
%WINDIR%\Temp\Adguard\eed3368c373648fd88bc8ba17ba3a3b2\Userscripts\Adguard Assistant Beta.txt
%WINDIR%\Temp\Adguard\eed3368c373648fd88bc8ba17ba3a3b2\Userscripts\Adguard Assistant.txt
%WINDIR%\Temp\Adguard\eed3368c373648fd88bc8ba17ba3a3b2\Userscripts\Popup Blocker by AdGuard (Beta).txt
%WINDIR%\Temp\Adguard\eed3368c373648fd88bc8ba17ba3a3b2\Userscripts\Popup Blocker by AdGuard.txt
%WINDIR%\Temp\Adguard\eed3368c373648fd88bc8ba17ba3a3b2\Userscripts\Requires\Adguard Assistant Beta.txt
%WINDIR%\Temp\Adguard\eed3368c373648fd88bc8ba17ba3a3b2\Userscripts\Requires\Adguard Assistant.txt
%WINDIR%\Temp\Adguard\eed3368c373648fd88bc8ba17ba3a3b2\Userscripts\Requires\Popup Blocker by AdGuard (Beta).txt
%WINDIR%\Temp\Adguard\eed3368c373648fd88bc8ba17ba3a3b2\Userscripts\Requires\Popup Blocker by AdGuard.txt
%WINDIR%\Temp\Adguard\eed3368c373648fd88bc8ba17ba3a3b2\Userscripts\Requires\Web of Trust Beta.txt
%WINDIR%\Temp\Adguard\eed3368c373648fd88bc8ba17ba3a3b2\Userscripts\Requires\Web of Trust.txt
%WINDIR%\Temp\Adguard\eed3368c373648fd88bc8ba17ba3a3b2\Userscripts\Resources\Adguard Assistant Beta.txt
%WINDIR%\Temp\Adguard\eed3368c373648fd88bc8ba17ba3a3b2\Userscripts\Resources\Adguard Assistant.txt
%WINDIR%\Temp\Adguard\eed3368c373648fd88bc8ba17ba3a3b2\Userscripts\Resources\Popup Blocker by AdGuard (Beta).txt
%WINDIR%\Temp\Adguard\eed3368c373648fd88bc8ba17ba3a3b2\Userscripts\Resources\Popup Blocker by AdGuard.txt
%WINDIR%\Temp\Adguard\eed3368c373648fd88bc8ba17ba3a3b2\Userscripts\Resources\Web of Trust Beta.txt
%WINDIR%\Temp\Adguard\eed3368c373648fd88bc8ba17ba3a3b2\Userscripts\Resources\Web of Trust.txt
%ProgramFiles%\Adguard\Drivers\x86\AdguardNetLib.dll
%ProgramFiles%\Adguard\Drivers\x86\adgnetworkwfpdrv.sys
%ProgramFiles%\Adguard\Drivers\x86\adgnetworktdidrv.sys
%ProgramFiles%\Adguard\Drivers\x64\AdguardNetReg.exe
%ProgramFiles%\Adguard\Drivers\x64\AdguardNetLib.dll
%ProgramFiles%\Adguard\Drivers\x64\adgnetworkwfpdrv.sys
%ProgramFiles%\Adguard\Drivers\win10\x86\adgnetworkwfpdrv.sys
%ProgramFiles%\Adguard\Drivers\x64\adgnetworktdidrv.sys
%ProgramFiles%\Adguard\Drivers\win10\x86\adgnetworktdidrv.sys
%ProgramFiles%\Adguard\Drivers\win10\x64\adgnetworkwfpdrv.sys
%ProgramFiles%\Adguard\Drivers\win10\x64\adgnetworktdidrv.sys
%ALLUSERSPROFILE%\Application Data\Adguard\safebrowsing.db-journal
%WINDIR%\Temp\Adguard\eed3368c373648fd88bc8ba17ba3a3b2\Userscripts\Web of Trust.txt
%WINDIR%\Temp\Adguard\eed3368c373648fd88bc8ba17ba3a3b2\Userscripts\Web of Trust Beta.txt
%ProgramFiles%\Adguard\Drivers\x86\AdguardNetReg.exe
%WINDIR%\Temp\Adguard\eed3368c373648fd88bc8ba17ba3a3b2\Filters\6.txt
%WINDIR%\Temp\Adguard\eed3368c373648fd88bc8ba17ba3a3b2\Filters\2.txt
%WINDIR%\Temp\Adguard\eed3368c373648fd88bc8ba17ba3a3b2\Filters\1.txt
%WINDIR%\Installer\MSI1.tmp-\CustomAction.config
%WINDIR%\Installer\MSI1.tmp-\Microsoft.Deployment.WindowsInstaller.dll
%WINDIR%\Installer\MSI1.tmp
%WINDIR%\Installer\MSI2.tmp-\Adguard.CustomActions.dll
%WINDIR%\Installer\MSI2.tmp-\CustomAction.config
%WINDIR%\Installer\MSI2.tmp-\Microsoft.Deployment.WindowsInstaller.dll
%WINDIR%\Installer\MSI2.tmp
%WINDIR%\Installer\MSI3.tmp-\Adguard.CustomActions.dll
%WINDIR%\Installer\MSI3.tmp-\CustomAction.config
%WINDIR%\Installer\MSI3.tmp-\Microsoft.Deployment.WindowsInstaller.dll
%WINDIR%\Installer\MSI3.tmp
%WINDIR%\Installer\MSI4.tmp
%WINDIR%\Installer\MSI6.tmp-\Adguard.CustomActions.dll
%WINDIR%\Installer\MSI6.tmp-\CustomAction.config
%WINDIR%\Installer\MSI6.tmp-\Microsoft.Deployment.WindowsInstaller.dll
%WINDIR%\Installer\MSI6.tmp
%WINDIR%\Installer\MSI7.tmp
%WINDIR%\Installer\24d8b.ipi
%WINDIR%\Installer\24d89.msi
%WINDIR%\Installer\MSIF.tmp
%WINDIR%\Installer\MSIF.tmp-\Microsoft.Deployment.WindowsInstaller.dll
%WINDIR%\Installer\MSIF.tmp-\CustomAction.config
%WINDIR%\Installer\MSIF.tmp-\Adguard.CustomActions.dll
%WINDIR%\Installer\MSIE.tmp
%ALLUSERSPROFILE%\Application Data\Adguard\adguard.db-journal
C:\Config.Msi\24d8c.rbs
%WINDIR%\Installer\MSI5.tmp
%WINDIR%\Installer\MSIC.tmp
%WINDIR%\Installer\MSIB.tmp
%WINDIR%\Installer\MSI9.tmp
%WINDIR%\Installer\MSI8.tmp
<SYSTEM32>\d3d9caps.dat
%ALLUSERSPROFILE%\Application Data\Adguard\config3780b8da6006424e9aea936a858dc117.xml

Moves the following files:

from <LS_APPDATA>\Adguard_Software_Ltd\Adguard.exe_StrongName_fx3hfgw3lp332eqb4g0rna0r2dpoucxg\6.3.1399.4073\aqga3pvs.newcfg to <LS_APPDATA>\Adguard_Software_Ltd\Adguard.exe_StrongName_fx3hfgw3lp332eqb4g0rna0r2dpoucxg\6.3.1399.4073\user.config

Substitutes the following files:

%ALLUSERSPROFILE%\Application Data\Adguard\adguard.db-journal
<SYSTEM32>\d3d9caps.dat
%ALLUSERSPROFILE%\Application Data\Adguard\safebrowsing.db-journal

Network activity:

Connects to:

'wp#d':80
'ap#.#dguard.com':80
'fi####s.adtidy.org':80

TCP:

HTTP GET requests:

http://11#.#11.111.2/wpad.dat via wp#d
http://fi####s.adtidy.org/windows/filters.json
http://fi####s.adtidy.org/windows/filters/2.txt

HTTP POST requests:

http://ap#.#dguard.com/api/1.0/license.html

UDP:

DNS ASK google.com
DNS ASK lo###.adguard.com
DNS ASK wp#d
DNS ASK ap#.#dguard.com
DNS ASK fi####s.adtidy.org

Miscellaneous:

Adds a root certificate

Searches for the following windows:

ClassName: '' WindowName: ''

Creates and executes the following:

'%TEMP%\7ZipSfx.000\Setup.exe'
'%ProgramFiles%\Adguard\AdguardSvc.exe'
'%ProgramFiles%\Adguard\Adguard.exe' /visible
'%ProgramFiles%\Adguard\Drivers\x86\AdguardNetReg.exe' adgnetworktdidrv
'%ProgramFiles%\Adguard\nss\certutil.exe' -A -t "TCu" -i "%ALLUSERSPROFILE%\Application Data\Adguard\NetworkTemp\SSL\Adguard Personal CA.cer" -n "Adguard Personal CA" -d "%APPDATA%\Mozilla\Firefox\Profiles\CWDGT0~1.DEF"

Executes the following:

'<SYSTEM32>\msiexec.exe' /i "%TEMP%\7ZipSfx.000\setup.msi" /quiet /norestart
'<SYSTEM32>\schtasks.exe' /delete /tn AdguardUpdater /f
'<SYSTEM32>\cmd.exe' /C "schtasks /delete /tn AdguardUpdater /f"
'<SYSTEM32>\schtasks.exe' /query /v /tn AdguardUpdater
'<SYSTEM32>\cmd.exe' /C "schtasks /query /v /tn AdguardUpdater"
'<SYSTEM32>\schtasks.exe' /run /tn AdguardUpdater
'<SYSTEM32>\cmd.exe' /C "schtasks /run /tn AdguardUpdater"
'<SYSTEM32>\schtasks.exe' /create /xml %ALLUSERSPROFILE%\Application Data\Adguard\config3780b8da6006424e9aea936a858dc117.xml /tn AdguardUpdater /f
'<SYSTEM32>\cmd.exe' "schtasks /create /xml %ALLUSERSPROFILE%\Application Data\Adguard\config3780b8da6006424e9aea936a858dc117.xml /tn AdguardUpdater /f"
'<SYSTEM32>\cmd.exe' /c taskkill /f /im "Adguard.exe" /t
'<SYSTEM32>\sc.exe' sdshow "Adguard Service"
'<SYSTEM32>\net1.exe' start "Adguard Service"
'<SYSTEM32>\cmd.exe' /C "net start "Adguard Service""
'<SYSTEM32>\rundll32.exe' "%WINDIR%\Installer\MSIF.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_177921 97 Adguard.CustomActions!Adguard.CustomActions.CustomActions.OnInstallFinalize
'<SYSTEM32>\msiexec.exe' -Embedding 765E7DFCAA27A11C31338581175ADFD0 M Global\MSI0000
'<SYSTEM32>\rundll32.exe' "%WINDIR%\Installer\MSI6.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_163640 56 Adguard.CustomActions!Adguard.CustomActions.CustomActions.CheckServiceStop
'<SYSTEM32>\rundll32.exe' "%WINDIR%\Installer\MSI3.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_160796 31 Adguard.CustomActions!Adguard.CustomActions.CustomActions.OnInstallInitialize
'<SYSTEM32>\rundll32.exe' "%WINDIR%\Installer\MSI2.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_156078 12 Adguard.CustomActions!Adguard.CustomActions.CustomActions.PermanentActions
'<SYSTEM32>\rundll32.exe' "%WINDIR%\Installer\MSI1.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_153890 1 Adguard.CustomActions!Adguard.CustomActions.CustomActions.OnFirstInstall
'<SYSTEM32>\msiexec.exe' -Embedding A80E24F312539F173C18DF15AD27B7D0
'<SYSTEM32>\msiexec.exe' /V
'<SYSTEM32>\net.exe' start "Adguard Service"
'<SYSTEM32>\cmd.exe' /c taskkill /f /im "AdguardSvc.exe" /t

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical Information

Curing recommendations

Free trial