Trojan.Siggen12.34371

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKLM>\Software\Classes\cclaunch\shell\open\command] '' = '"%ProgramFiles%\CCleaner\ccleaner.exe" /%1'

Creates or modifies the following files

<SYSTEM32>\tasks\ccleanerskipuac

Sets the following service settings

[<HKLM>\System\CurrentControlSet\Services\gusvc] 'ImagePath' = '"%ProgramFiles(x86)%\Google\Common\Google Updater\GoogleUpdaterService.exe"'

Creates the following services

'gusvc' "%ProgramFiles(x86)%\Google\Common\Google Updater\GoogleUpdaterService.exe"
'gusvc' %ProgramFiles(x86)%\Google\Common\Google Updater\GoogleUpdaterService.exe

Malicious functions

Registers BHO

[<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
[<HKLM>\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]

Modifies file system

Creates the following files

%TEMP%\rarsfx0\ccsetup412.exe
%ProgramFiles(x86)%\google\googletoolbarnotifier\5.12.11510.1228\readme.url
%ALLUSERSPROFILE%\google\custom buttons\toolbar.google.com_o8y91yhb24z6sr0sgysk.xml
%TEMP%\nsg4396.tmp\inetc.dll
%ProgramFiles%\ccleaner\checkupdate.log
%ProgramFiles%\ccleaner\ccleaner64.exe
%ProgramFiles%\ccleaner\lang\lang-1031.dll
%ProgramFiles%\ccleaner\lang\lang-1041.dll
%ProgramFiles%\ccleaner\lang\lang-1028.dll
%ProgramFiles%\google\googletoolbarnotifier\5.12.11510.1228\swg64.dll
%ProgramFiles(x86)%\google\googletoolbarnotifier\googletoolbarnotifier.exe
%ProgramFiles%\ccleaner\lang\lang-1044.dll
%ProgramFiles%\ccleaner\lang\lang-1040.dll
%ProgramFiles%\ccleaner\lang\lang-2070.dll
%ProgramFiles%\ccleaner\lang\lang-1043.dll
%ProgramFiles%\ccleaner\lang\lang-1036.dll
%ProgramFiles%\ccleaner\lang\lang-1034.dll
%ProgramFiles%\ccleaner\lang\lang-1045.dll
%ProgramFiles%\ccleaner\lang\lang-1049.dll
%ProgramFiles%\ccleaner\lang\lang-1042.dll
%ProgramFiles(x86)%\google\google toolbar\component\googletoolbar_32_38a4bba9ea6d142a.dll
%ProgramFiles%\ccleaner\lang\lang-1053.dll
%ProgramFiles(x86)%\google\google toolbar\component\searchwithgoogleupdate_ca8a7236098b8f9a.exe
%ProgramFiles(x86)%\google\google toolbar\component\googletoolbardynamic_32_4dc8e820b2954571.dll
%ProgramFiles(x86)%\google\google toolbar\component\googletoolbardynamic_64_dc01444726ea1042.dll
%ProgramFiles(x86)%\google\google toolbar\component\googletoolbardynamic_mui_en_4d8162b8670aa63c.dll
%ProgramFiles(x86)%\google\google toolbar\component\googletoolbarmanager_8b0481a9a34d47cd.exe
%ProgramFiles(x86)%\google\google toolbar\component\googletoolbaruser_32_13d64232a255ca16.exe
%ProgramFiles(x86)%\google\google toolbar\component\googletoolbaruser_64_be5d89d8b9f08786.exe
%ProgramFiles(x86)%\google\google toolbar\component\googleupdaterservice_b33fc4dd36a473c6.exe
%ProgramFiles(x86)%\google\googletoolbarnotifier\5.12.11510.1228\swg.dll
%ProgramFiles(x86)%\google\googletoolbarnotifier\5.12.11510.1228\gth.dll
%ProgramFiles(x86)%\google\googletoolbarnotifier\5.12.11510.1228\gtn.dll
%ProgramFiles(x86)%\google\google toolbar\googletoolbar_32.dll
%ProgramFiles(x86)%\google\google toolbar\googletoolbar_64.dll
%ProgramFiles(x86)%\google\google toolbar\googletoolbaruser_32.exe
%ProgramFiles(x86)%\google\google toolbar\googletoolbaruser_64.exe
%ProgramFiles(x86)%\google\google toolbar\googletoolbarhelper_signed.msi
%ProgramFiles(x86)%\google\google toolbar\googletoolbarhelperpatch_signed.msp
%ProgramFiles(x86)%\google\common\google updater\googleupdaterservice.exe
%ProgramFiles(x86)%\google\google toolbar\component\googleupdatesetup_5cc4b0f53d73ad88.exe
%TEMP%\googletoolbarinstaller1.log
%ProgramFiles(x86)%\google\google toolbar\component\googletoolbar_64_d6be406f550df204.dll
%ProgramFiles%\ccleaner\lang\lang-1030.dll
%ProgramFiles%\ccleaner\lang\lang-1029.dll
%ProgramFiles%\ccleaner\lang\lang-1067.dll
%ProgramFiles%\ccleaner\lang\lang-1079.dll
%ProgramFiles%\ccleaner\lang\lang-9999.dll
%ProgramFiles%\ccleaner\lang\lang-1068.dll
%ProgramFiles%\ccleaner\lang\lang-1060.dll
%ProgramFiles%\ccleaner\lang\lang-1059.dll
%ProgramFiles%\ccleaner\lang\lang-1087.dll
%ProgramFiles%\ccleaner\lang\lang-1061.dll
%ProgramFiles%\ccleaner\lang\lang-1065.dll
%ProgramFiles%\ccleaner\lang\lang-1062.dll
%ProgramFiles%\ccleaner\lang\lang-1092.dll
%ProgramFiles%\ccleaner\lang\lang-1109.dll
%ProgramFiles%\ccleaner\lang\lang-1054.dll
%ProgramFiles%\ccleaner\lang\lang-1081.dll
C:\users\public\desktop\ccleaner.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\ccleaner\ccleaner.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\ccleaner\ccleaner homepage.url
%ProgramFiles%\ccleaner\lang\lang-1102.dll
%ProgramFiles%\ccleaner\lang\lang-1057.dll
%ProgramFiles%\ccleaner\lang\lang-1046.dll
%ProgramFiles%\ccleaner\lang\lang-1035.dll
%ProgramFiles%\ccleaner\lang\lang-1050.dll
%ProgramFiles%\ccleaner\lang\lang-2052.dll
%ProgramFiles%\ccleaner\lang\lang-1027.dll
%ProgramFiles%\ccleaner\lang\lang-1037.dll
%ProgramFiles%\ccleaner\lang\lang-1032.dll
%ProgramFiles%\ccleaner\lang\lang-1055.dll
%ProgramFiles%\ccleaner\lang\lang-1025.dll
%ProgramFiles%\ccleaner\lang\lang-1066.dll
%ProgramFiles%\ccleaner\lang\lang-1038.dll
%ProgramFiles%\ccleaner\lang\lang-1058.dll
%ProgramFiles%\ccleaner\lang\lang-1048.dll
%ProgramFiles%\ccleaner\lang\lang-3098.dll
%ProgramFiles%\ccleaner\lang\lang-2074.dll
%ProgramFiles%\ccleaner\lang\lang-1051.dll
%ProgramFiles%\ccleaner\lang\lang-1071.dll
%ProgramFiles%\ccleaner\lang\lang-5146.dll
%ProgramFiles%\ccleaner\lang\lang-1026.dll
%ProgramFiles%\ccleaner\lang\lang-1110.dll
%ProgramFiles%\ccleaner\lang\lang-1063.dll
%ProgramFiles%\ccleaner\lang\lang-1052.dll
%ProgramFiles(x86)%\google\google toolbar\component\googlecld_019168f3fd68d3c7.dll
%ProgramFiles(x86)%\google\google toolbar\component\googletoolbar.7.5.8231.2252.manifest.xml
%TEMP%\googletoolbarinstaller2.log
%ProgramFiles(x86)%\gum4d64.tmp\psuser.dll
%ProgramFiles(x86)%\gum4d64.tmp\googlecrashhandler64.exe
%ProgramFiles(x86)%\gum4d64.tmp\goopdateres_am.dll
%ProgramFiles(x86)%\gum4d64.tmp\goopdateres_ar.dll
%ProgramFiles(x86)%\gum4d64.tmp\goopdateres_bg.dll
%ProgramFiles(x86)%\gum4d64.tmp\goopdateres_bn.dll
%ProgramFiles(x86)%\gum4d64.tmp\goopdateres_ca.dll
%ProgramFiles(x86)%\gum4d64.tmp\googleupdateondemand.exe
%ProgramFiles(x86)%\gum4d64.tmp\goopdateres_fi.dll
%ProgramFiles(x86)%\gum4d64.tmp\googleupdatebroker.exe
%ProgramFiles(x86)%\gum4d64.tmp\goopdateres_el.dll
%ProgramFiles(x86)%\gum4d64.tmp\goopdateres_en.dll
%ProgramFiles(x86)%\gum4d64.tmp\goopdateres_en-gb.dll
%ProgramFiles(x86)%\gum4d64.tmp\goopdateres_es.dll
%ProgramFiles(x86)%\gum4d64.tmp\goopdateres_es-419.dll
%ProgramFiles(x86)%\gum4d64.tmp\goopdateres_et.dll
%ProgramFiles(x86)%\gum4d64.tmp\goopdateres_fa.dll
%ProgramFiles(x86)%\gum4d64.tmp\goopdateres_da.dll
%ProgramFiles(x86)%\gum4d64.tmp\goopdateres_cs.dll
%ProgramFiles(x86)%\gum4d64.tmp\goopdateres_de.dll
%ProgramFiles(x86)%\gum4d64.tmp\npgoogleupdate3.dll
%TEMP%\nsg4396.tmp\g\pf-toolbar-w78.exe
%TEMP%\nsr4386.tmp
%TEMP%\nsg4396.tmp\system.dll
%TEMP%\nsg4396.tmp\userinfo.dll
%TEMP%\nsg4396.tmp\g\gtapi_signed.dll
%TEMP%\nsg4396.tmp\g\gcapi_dll.dll
%TEMP%\nsg4396.tmp\g\gtb\toolbar.html
%TEMP%\nsg4396.tmp\g\gtb\toolbar-screenshot.jpg
%ProgramFiles(x86)%\gum4d64.tmp\googleupdatehelper.msi
%ProgramFiles(x86)%\gum4d64.tmp\goopdateres_fil.dll
%TEMP%\rarsfx0\kur.bat
%TEMP%\nsg4396.tmp\execdos.dll
%TEMP%\nsw4cc9.tmp\system.dll
%TEMP%\googleupdatesetup_1.3.21.123.exe
%ProgramFiles(x86)%\gut4d75.tmp
%ProgramFiles(x86)%\gum4d64.tmp\googleupdate.exe
%ProgramFiles(x86)%\gum4d64.tmp\googlecrashhandler.exe
%ProgramFiles(x86)%\gum4d64.tmp\goopdate.dll
%TEMP%\nsg4396.tmp\nsexec.dll
%TEMP%\nsg4396.tmp\g\pfwww.dll
%ProgramFiles(x86)%\gum4d64.tmp\psmachine.dll
%ProgramFiles(x86)%\gum4d64.tmp\goopdateres_fr.dll
%ProgramFiles(x86)%\gum4d64.tmp\goopdateres_sl.dll
%ProgramFiles(x86)%\gum4d64.tmp\goopdateres_sv.dll
%ProgramFiles(x86)%\gum4d64.tmp\goopdateres_sw.dll
%ProgramFiles(x86)%\gum4d64.tmp\goopdateres_ta.dll
%ProgramFiles(x86)%\gum4d64.tmp\goopdateres_te.dll
%ProgramFiles(x86)%\gum4d64.tmp\goopdateres_th.dll
%ProgramFiles(x86)%\gum4d64.tmp\goopdateres_tr.dll
%ProgramFiles(x86)%\gum4d64.tmp\goopdateres_sk.dll
%ProgramFiles(x86)%\gum4d64.tmp\goopdateres_ro.dll
%ProgramFiles(x86)%\gum4d64.tmp\goopdateres_sr.dll
%ProgramFiles(x86)%\gum4d64.tmp\goopdateres_uk.dll
%ProgramFiles(x86)%\gum4d64.tmp\goopdateres_zh-tw.dll
%ProgramFiles(x86)%\gum4d64.tmp\googleupdatesetup.exe
%TEMP%\bit9137.tmp
%ProgramFiles(x86)%\google\update\download\{f69eabdd-a4bb-4555-be7e-1ea5f59bba24}\0.0.0.0\googletoolbarinstaller_en_signed.exe
%ProgramFiles(x86)%\google\update\install\{6add3561-c6fd-4de5-8ece-ecaad9f63802}\googletoolbarinstaller_en_signed.exe
%TEMP%\guia2a4.tmp
%ProgramFiles(x86)%\gum4d64.tmp\goopdateres_ur.dll
%ProgramFiles(x86)%\gum4d64.tmp\goopdateres_vi.dll
%ProgramFiles(x86)%\gum4d64.tmp\goopdateres_zh-cn.dll
%ProgramFiles(x86)%\gum4d64.tmp\goopdateres_ru.dll
%ProgramFiles(x86)%\gum4d64.tmp\goopdateres_pt-pt.dll
%ProgramFiles(x86)%\gum4d64.tmp\goopdateres_gu.dll
%ProgramFiles(x86)%\gum4d64.tmp\goopdateres_hr.dll
%ProgramFiles(x86)%\gum4d64.tmp\goopdateres_hu.dll
%ProgramFiles(x86)%\gum4d64.tmp\goopdateres_id.dll
%ProgramFiles(x86)%\gum4d64.tmp\goopdateres_is.dll
%ProgramFiles(x86)%\gum4d64.tmp\goopdateres_it.dll
%ProgramFiles(x86)%\gum4d64.tmp\goopdateres_iw.dll
%ProgramFiles(x86)%\gum4d64.tmp\goopdateres_ja.dll
%ProgramFiles(x86)%\gum4d64.tmp\goopdateres_kn.dll
%ProgramFiles(x86)%\gum4d64.tmp\goopdateres_hi.dll
%ProgramFiles(x86)%\gum4d64.tmp\goopdateres_ko.dll
%ProgramFiles(x86)%\gum4d64.tmp\goopdateres_lv.dll
%ProgramFiles(x86)%\gum4d64.tmp\goopdateres_ml.dll
%ProgramFiles(x86)%\gum4d64.tmp\goopdateres_mr.dll
%ProgramFiles(x86)%\gum4d64.tmp\goopdateres_ms.dll
%ProgramFiles(x86)%\gum4d64.tmp\goopdateres_nl.dll
%ProgramFiles(x86)%\gum4d64.tmp\goopdateres_no.dll
%ProgramFiles(x86)%\gum4d64.tmp\goopdateres_pl.dll
%ProgramFiles(x86)%\gum4d64.tmp\goopdateres_pt-br.dll
%ProgramFiles(x86)%\gum4d64.tmp\goopdateres_lt.dll
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\ccleaner\uninstall ccleaner.lnk
%ProgramFiles%\ccleaner\uninst.exe

Sets the 'hidden' attribute to the following files

%TEMP%\bit9137.tmp

Deletes the following files

%TEMP%\{c9675f46-8ea0-453d-861f-99086341e853}-googletoolbarinstaller_en_signed.exe
%ProgramFiles(x86)%\gum4d64.tmp\goopdateres_uk.dll
%ProgramFiles(x86)%\gum4d64.tmp\goopdateres_tr.dll
%ProgramFiles(x86)%\gum4d64.tmp\goopdateres_th.dll
%ProgramFiles(x86)%\gum4d64.tmp\goopdateres_te.dll
%ProgramFiles(x86)%\gum4d64.tmp\goopdateres_ta.dll
%ProgramFiles(x86)%\gum4d64.tmp\goopdateres_sw.dll
%ProgramFiles(x86)%\gum4d64.tmp\goopdateres_sv.dll
%ProgramFiles(x86)%\gum4d64.tmp\goopdateres_sr.dll
%ProgramFiles(x86)%\gum4d64.tmp\goopdateres_sl.dll
%ProgramFiles(x86)%\gum4d64.tmp\goopdateres_sk.dll
%ProgramFiles(x86)%\gum4d64.tmp\goopdateres_ru.dll
%ProgramFiles(x86)%\gum4d64.tmp\goopdateres_ro.dll
%ProgramFiles(x86)%\gum4d64.tmp\goopdateres_pt-pt.dll
%ProgramFiles(x86)%\gum4d64.tmp\goopdateres_pt-br.dll
%ProgramFiles(x86)%\gum4d64.tmp\goopdateres_pl.dll
%ProgramFiles(x86)%\gum4d64.tmp\goopdateres_no.dll
%ProgramFiles(x86)%\gum4d64.tmp\goopdateres_nl.dll
%ProgramFiles(x86)%\gum4d64.tmp\goopdateres_mr.dll
%ProgramFiles(x86)%\gum4d64.tmp\goopdateres_ms.dll
%ProgramFiles(x86)%\gum4d64.tmp\goopdateres_ur.dll
%ProgramFiles(x86)%\gum4d64.tmp\goopdateres_vi.dll
%TEMP%\nsg4396.tmp\userinfo.dll
%TEMP%\nsg4396.tmp\system.dll
%TEMP%\nsg4396.tmp\nsexec.dll
%TEMP%\nsg4396.tmp\inetc.dll
%TEMP%\nsg4396.tmp\g\pfwww.dll
%TEMP%\nsg4396.tmp\g\gtb\toolbar.html
%TEMP%\nsg4396.tmp\g\gtb\toolbar-screenshot.jpg
%TEMP%\nsg4396.tmp\g\gtapi_signed.dll
%TEMP%\nsg4396.tmp\execdos.dll
%ProgramFiles(x86)%\gum4d64.tmp\goopdateres_hi.dll
%ProgramFiles%\ccleaner\checkupdate.log
%TEMP%\nsg4396.tmp\g\pf-toolbar-w78.exe
%TEMP%\nsw4cc9.tmp\system.dll
%TEMP%\googleupdatesetup_1.3.21.123.exe
%ProgramFiles(x86)%\gum4d64.tmp\googleupdatesetup.exe
%ProgramFiles(x86)%\gut4d75.tmp
%ProgramFiles(x86)%\gum4d64.tmp\goopdateres_zh-tw.dll
%ProgramFiles(x86)%\gum4d64.tmp\goopdateres_zh-cn.dll
%ProgramFiles(x86)%\gum4d64.tmp\goopdateres_ml.dll
%ProgramFiles(x86)%\gum4d64.tmp\goopdateres_lv.dll
%ProgramFiles(x86)%\gum4d64.tmp\goopdateres_lt.dll
%ProgramFiles(x86)%\gum4d64.tmp\goopdateres_cs.dll
%ProgramFiles(x86)%\gum4d64.tmp\goopdateres_ca.dll
%ProgramFiles(x86)%\gum4d64.tmp\goopdateres_bn.dll
%ProgramFiles(x86)%\gum4d64.tmp\goopdateres_bg.dll
%ProgramFiles(x86)%\gum4d64.tmp\goopdateres_ar.dll
%ProgramFiles(x86)%\gum4d64.tmp\goopdateres_am.dll
%ProgramFiles(x86)%\gum4d64.tmp\googlecrashhandler64.exe
%ProgramFiles(x86)%\gum4d64.tmp\psuser.dll
%ProgramFiles(x86)%\gum4d64.tmp\psmachine.dll
%ProgramFiles(x86)%\gum4d64.tmp\googleupdateondemand.exe
%ProgramFiles(x86)%\gum4d64.tmp\googleupdatebroker.exe
%ProgramFiles(x86)%\gum4d64.tmp\googleupdatehelper.msi
%ProgramFiles(x86)%\gum4d64.tmp\npgoogleupdate3.dll
%ProgramFiles(x86)%\gum4d64.tmp\goopdate.dll
%ProgramFiles(x86)%\gum4d64.tmp\googlecrashhandler.exe
%ProgramFiles(x86)%\gum4d64.tmp\googleupdate.exe
%ProgramFiles(x86)%\gum4d64.tmp\goopdateres_de.dll
%ProgramFiles(x86)%\gum4d64.tmp\goopdateres_el.dll
%ProgramFiles(x86)%\gum4d64.tmp\goopdateres_da.dll
%ProgramFiles(x86)%\gum4d64.tmp\goopdateres_en.dll
%ProgramFiles(x86)%\gum4d64.tmp\goopdateres_ko.dll
%ProgramFiles(x86)%\gum4d64.tmp\goopdateres_en-gb.dll
%ProgramFiles(x86)%\gum4d64.tmp\goopdateres_kn.dll
%ProgramFiles(x86)%\gum4d64.tmp\goopdateres_ja.dll
%ProgramFiles(x86)%\gum4d64.tmp\goopdateres_iw.dll
%ProgramFiles(x86)%\gum4d64.tmp\goopdateres_it.dll
%ProgramFiles(x86)%\gum4d64.tmp\goopdateres_is.dll
%ProgramFiles(x86)%\gum4d64.tmp\goopdateres_id.dll
%ProgramFiles(x86)%\gum4d64.tmp\goopdateres_hu.dll
%TEMP%\nsg4396.tmp\g\gcapi_dll.dll
%TEMP%\rarsfx0\ccsetup412.exe
%ProgramFiles(x86)%\gum4d64.tmp\goopdateres_gu.dll
%ProgramFiles(x86)%\gum4d64.tmp\goopdateres_fr.dll
%ProgramFiles(x86)%\gum4d64.tmp\goopdateres_fil.dll
%ProgramFiles(x86)%\gum4d64.tmp\goopdateres_fi.dll
%ProgramFiles(x86)%\gum4d64.tmp\goopdateres_fa.dll
%ProgramFiles(x86)%\gum4d64.tmp\goopdateres_et.dll
%ProgramFiles(x86)%\gum4d64.tmp\goopdateres_es-419.dll
%ProgramFiles(x86)%\gum4d64.tmp\goopdateres_es.dll
%ProgramFiles(x86)%\gum4d64.tmp\goopdateres_hr.dll
%TEMP%\rarsfx0\kur.bat

Moves the following files

from %TEMP%\bit9137.tmp to %TEMP%\{c9675f46-8ea0-453d-861f-99086341e853}-googletoolbarinstaller_en_signed.exe

Network activity

Connects to

'tools.google.com':443
'dl.google.com':80
'microsoft.com':80
'se#####.piriform.com':80
'li######api.ccleaner.com':443

TCP

HTTP GET requests

http://dl.google.com/dl/toolbar/t7/data/7.5.8231.2252/googletoolbarinstaller_en_signed.exe
http://clients1.google.com/tools/swg2/update?ty##################################################################################################################################################...
http://clients1.google.com/tools/pso/ping?as#####################################################################################################################################################...

'tools.google.com':443

'li######api.ccleaner.com':443

UDP

DNS ASK pi###orm.com
DNS ASK tools.google.com
DNS ASK dl.google.com
DNS ASK microsoft.com
DNS ASK se#####.piriform.com
DNS ASK li######api.ccleaner.com

Miscellaneous

Searches for the following windows

ClassName: 'EDIT' WindowName: ''
ClassName: 'PiriformRegistration' WindowName: ''
ClassName: '#32770' WindowName: 'Piriform CCleaner'
ClassName: 'ThunderRT6FormDC' WindowName: 'CCleaner'
ClassName: 'PiriformCCleaner' WindowName: ''
ClassName: '#32770' WindowName: ''
ClassName: 'IEFrame' WindowName: ''
ClassName: '{A7E495BF-9589-4a6e-8479-DDA2D8D3C05F}' WindowName: ''

Creates and executes the following

'%TEMP%\rarsfx0\ccsetup412.exe' /S /norestart
'%ProgramFiles(x86)%\google\google toolbar\component\googletoolbarmanager_8b0481a9a34d47cd.exe' /custombuttonsinstall
'%ProgramFiles(x86)%\google\google toolbar\component\googletoolbarmanager_8b0481a9a34d47cd.exe' /postinstall /sid:S-1-5-21-1960123792-2022915161-3775307078-1001 /q /expon:PUMA /installerdata="%TEMP%\guiA2A4.tmp" /d:ask /h:ask2 /r:PRFD /e:asknot
'%ProgramFiles(x86)%\google\googletoolbarnotifier\googletoolbarnotifier.exe' -Embedding
'%ProgramFiles(x86)%\google\common\google updater\googleupdaterservice.exe' /install /appid=swg
'%ProgramFiles(x86)%\google\googletoolbarnotifier\googletoolbarnotifier.exe' /RegServer "/dll=%ProgramFiles(x86)%\Google\GoogleToolbarNotifier\5.12.11510.1228\gtn.dll" "/swg64=%ProgramFiles%\Google\GoogleToolbarNotifier\5.12.11510.1228\swg64.dll"
'%ProgramFiles(x86)%\google\google toolbar\component\searchwithgoogleupdate_ca8a7236098b8f9a.exe' ietb PRFD
'%ProgramFiles(x86)%\google\common\google updater\googleupdaterservice.exe' /Service
'%ProgramFiles(x86)%\google\update\install\{6add3561-c6fd-4de5-8ece-ecaad9f63802}\googletoolbarinstaller_en_signed.exe' /q /expon:PUMA /installerdata="%TEMP%\guiA2A4.tmp"
'%ProgramFiles(x86)%\gum4d64.tmp\googleupdate.exe' /silent /install "appguid={F69EABDD-A4BB-4555-BE7E-1EA5F59BBA24}&appname=Google%20Toolbar&needsadmin=True&brand=PRFD&usagestats=0" /appargs "appguid={F69EABDD-A4BB-4555-BE7E-1EA5F59BBA24}&insta...
'%TEMP%\googleupdatesetup_1.3.21.123.exe' /silent /install "appguid={F69EABDD-A4BB-4555-BE7E-1EA5F59BBA24}&appname=Google%20Toolbar&needsadmin=True&brand=PRFD&usagestats=0" /appargs "appguid={F69EABDD-A4BB-4555-BE7E-1EA5F59BBA24}&insta...
'%TEMP%\nsg4396.tmp\g\pf-toolbar-w78.exe' /r1:PRFD /r2:PRFF
'%ProgramFiles(x86)%\google\google toolbar\component\googletoolbarmanager_8b0481a9a34d47cd.exe' /install /sid:S-1-5-21-1960123792-2022915161-3775307078-1001 /q /expon:PUMA /installerdata="%TEMP%\guiA2A4.tmp" /d:ask /h:ask2 /r:PRFD /e:asknot
'%ProgramFiles%\ccleaner\ccleaner64.exe' /createSkipUAC
'%ProgramFiles(x86)%\google\google toolbar\component\googleupdaterservice_b33fc4dd36a473c6.exe' /install /appid=tbie
'%TEMP%\nsg4396.tmp\g\pf-toolbar-w78.exe' /r1:PRFD /r2:PRFF' (with hidden window)
'%WINDIR%\syswow64\ping.exe' -n 1 -w 5000 www.pi###orm.com' (with hidden window)

Executes the following

'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\RarSFX0\kur.bat" "
'%WINDIR%\syswow64\ping.exe' -n 1 -w 5000 www.pi###orm.com
'%ProgramFiles(x86)%\google\update\googleupdate.exe' /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB2ZXJzaW9uPSIxLjMuMjEuMTIzIiBzaGVsbF92ZXJzaW9uPSIxLjMuMjEuMTAzIiBpc21hY2hpbmU9IjEiIHNlc3Npb25pZD0iezE5RUR...
'%ProgramFiles(x86)%\google\update\googleupdate.exe' /handoff "appguid={F69EABDD-A4BB-4555-BE7E-1EA5F59BBA24}&appname=Google%20Toolbar&needsadmin=True&brand=PRFD&usagestats=0" /appargs "appguid={F69EABDD-A4BB-4555-BE7E-1EA5F59BBA24}&installerdata...
'<SYSTEM32>\regsvr32.exe' -s "%ProgramFiles%\Google\GoogleToolbarNotifier\5.12.11510.1228\swg64.dll"
'%ProgramFiles(x86)%\google\update\googleupdate.exe' /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB2ZXJzaW9uPSIxLjMuMjYuOSIgc2hlbGxfdmVyc2lvbj0iMS4zLjI2LjkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MTlFREM2QzU...

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical Information

Curing recommendations

Free trial