Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run] 'inetprot' = '"%ProgramFiles(x86)%\Surfblocker\surfblock.exe" tray'
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\InetProtectorHelperService64] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\InetProtectorHelperService64] 'ImagePath' = '%ProgramFiles(x86)%\Surfblocker\IProtectorHelper64.exe'
- [HKLM\SYSTEM\CurrentControlSet\Services\BlumsoftiNetProtDrv] 'ImagePath' = '%ProgramFiles(x86)%\Surfblocker\blumsoftiNetProtDrv64.sys'
- [HKLM\SYSTEM\CurrentControlSet\Services\InternetProtectorService] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\InternetProtectorService] 'ImagePath' = '%ProgramFiles(x86)%\Surfblocker\IProtectorService.exe'
Creates the following services
- 'InetProtectorHelperService64' %ProgramFiles(x86)%\Surfblocker\IProtectorHelper64.exe
- 'BlumsoftiNetProtDrv' %ProgramFiles(x86)%\Surfblocker\blumsoftiNetProtDrv64.sys
- 'InternetProtectorService' %ProgramFiles(x86)%\Surfblocker\IProtectorService.exe
Malicious functions
Injects code into
the following system processes:
- <SYSTEM32>\dllhost.exe
- <SYSTEM32>\conhost.exe
- <SYSTEM32>\oobe\useroobebroker.exe
- <SYSTEM32>\taskhostw.exe
- <SYSTEM32>\svchost.exe
- <SYSTEM32>\securityhealthsystray.exe
- <SYSTEM32>\runtimebroker.exe
- %WINDIR%\systemapps\microsoft.windows.search_cw5n1h2txyewy\searchapp.exe
- %WINDIR%\systemapps\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\startmenuexperiencehost.exe
- %WINDIR%\explorer.exe
- <SYSTEM32>\sihost.exe
- <SYSTEM32>\spoolsv.exe
- <SYSTEM32>\wudfhost.exe
- <SYSTEM32>\dwm.exe
- <SYSTEM32>\fontdrvhost.exe
- <SYSTEM32>\lsass.exe
- <SYSTEM32>\winlogon.exe
the following user processes:
- iexplore.exe
- firefox.exe
Hooks functions
in browsers
- firefox.exe process, wsock32.dll module
Modifies file system
Creates the following files
- %APPDATA%\blumentalssurfblocker\killduplicate.cmd
- %APPDATA%\blumentalssurfblocker\launcher.exe
- %APPDATA%\blumentalssurfblocker\surfblocker.exe
- %TEMP%\is-qr068.tmp\surfblocker.tmp
- %TEMP%\is-jnb4j.tmp\_isetup\_setup64.tmp
- %ProgramFiles(x86)%\surfblocker\is-fmfbu.tmp
- %ProgramFiles(x86)%\surfblocker\is-de7cr.tmp
- %ProgramFiles(x86)%\surfblocker\is-ullul.tmp
- %ProgramFiles(x86)%\surfblocker\is-r3mpu.tmp
- %ProgramFiles(x86)%\surfblocker\is-6vrdj.tmp
- %ProgramFiles(x86)%\surfblocker\is-mds87.tmp
- %ProgramFiles(x86)%\surfblocker\is-dqp6h.tmp
- %ProgramFiles(x86)%\surfblocker\is-ruds9.tmp
- %ProgramFiles(x86)%\surfblocker\is-66h0b.tmp
- %ProgramFiles(x86)%\surfblocker\is-irj8v.tmp
- %ProgramFiles(x86)%\surfblocker\is-s03pb.tmp
- %ProgramFiles(x86)%\surfblocker\is-pbo5d.tmp
- %ProgramFiles(x86)%\surfblocker\is-qhf4u.tmp
- %ProgramFiles(x86)%\surfblocker\is-givis.tmp
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\surfblocker\is-1bd9s.tmp
- %ProgramFiles(x86)%\surfblocker\is-2j3j1.tmp
- %ProgramFiles(x86)%\surfblocker\lang\is-nrjg3.tmp
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\adult\is-h7ddm.tmp
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\adult\is-ltaur.tmp
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\adult\is-nmi6u.tmp
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\adult\is-u90aj.tmp
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\adult\is-ce054.tmp
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\chat\is-r35j1.tmp
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\chat\is-fb86r.tmp
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\drugs\is-512h5.tmp
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\drugs\is-c0g8u.tmp
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\gambling\is-65fl5.tmp
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\gambling\is-12psh.tmp
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\gambling\is-rtnkh.tmp
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\games\is-p99ct.tmp
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\games\is-13r80.tmp
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\malware\is-vlpln.tmp
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\malware\is-svjph.tmp
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\malware\is-vdg2a.tmp
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\malware\is-mv646.tmp
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\malware\is-fn7oq.tmp
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\malware\is-d0oo9.tmp
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\malware\is-c71ep.tmp
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\malware\is-8ontl.tmp
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\nudity\is-7j6v6.tmp
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\nudity\is-s0jr5.tmp
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\social\is-vd4c8.tmp
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\social\is-c8frt.tmp
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\violence\is-f3ddd.tmp
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\violence\is-5ftl6.tmp
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\violence\is-f45dd.tmp
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\proxy\is-rf4sl.tmp
- %ALLUSERSPROFILE%\blumentals\surfblocker\filters\proxy\is-p15o6.tmp
- %ProgramFiles(x86)%\surfblocker\data\offers\is-iq3e4.tmp
- %ProgramFiles(x86)%\surfblocker\data\offers\images\is-r4up0.tmp
- %ProgramFiles(x86)%\surfblocker\data\offers\images\is-27i1m.tmp
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\surfblocker\surfblocker.lnk
- %HOMEPATH%\desktop\surfblocker.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\surfblocker\uninstall surfblocker.lnk
- %ProgramFiles(x86)%\surfblocker\unins000.dat
Sets the 'hidden' attribute to the following files
- %APPDATA%\blumentalssurfblocker\killduplicate.cmd
Moves the following files
- from %ProgramFiles(x86)%\surfblocker\is-fmfbu.tmp to %ProgramFiles(x86)%\surfblocker\unins000.exe
- from %ProgramFiles(x86)%\surfblocker\is-de7cr.tmp to %ProgramFiles(x86)%\surfblocker\surfblock.exe
- from %ProgramFiles(x86)%\surfblocker\is-ullul.tmp to %ProgramFiles(x86)%\surfblocker\ciprotect.exe
- from %ProgramFiles(x86)%\surfblocker\is-r3mpu.tmp to %ProgramFiles(x86)%\surfblocker\iprotectorservice.exe
- from %ProgramFiles(x86)%\surfblocker\is-6vrdj.tmp to %ProgramFiles(x86)%\surfblocker\iprotectorhelper64.exe
- from %ProgramFiles(x86)%\surfblocker\is-mds87.tmp to %ProgramFiles(x86)%\surfblocker\blumsoftinetprotdrv32.sys
- from %ProgramFiles(x86)%\surfblocker\is-dqp6h.tmp to %ProgramFiles(x86)%\surfblocker\blumsoftinetprotdrv64.sys
- from %ProgramFiles(x86)%\surfblocker\is-ruds9.tmp to %ProgramFiles(x86)%\surfblocker\iptrmhook32.dll
- from %ProgramFiles(x86)%\surfblocker\is-66h0b.tmp to %ProgramFiles(x86)%\surfblocker\iptrmhook64.dll
- from %ProgramFiles(x86)%\surfblocker\is-irj8v.tmp to %ProgramFiles(x86)%\surfblocker\wsahook32.dll
- from %ProgramFiles(x86)%\surfblocker\is-s03pb.tmp to %ProgramFiles(x86)%\surfblocker\wsahook64.dll
- from %ProgramFiles(x86)%\surfblocker\is-pbo5d.tmp to %ProgramFiles(x86)%\surfblocker\metro.ico
- from %ProgramFiles(x86)%\surfblocker\is-qhf4u.tmp to %ProgramFiles(x86)%\surfblocker\license.txt
- from %ProgramFiles(x86)%\surfblocker\is-givis.tmp to %ProgramFiles(x86)%\surfblocker\readme.txt
- from %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\surfblocker\is-1bd9s.tmp to %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\surfblocker\blumentals software web site.url
- from %ProgramFiles(x86)%\surfblocker\is-2j3j1.tmp to %ProgramFiles(x86)%\surfblocker\chkpass.dll
- from %ProgramFiles(x86)%\surfblocker\lang\is-nrjg3.tmp to %ProgramFiles(x86)%\surfblocker\lang\languages.sib
- from %ALLUSERSPROFILE%\blumentals\surfblocker\filters\adult\is-h7ddm.tmp to %ALLUSERSPROFILE%\blumentals\surfblocker\filters\adult\domains_adult
- from %ALLUSERSPROFILE%\blumentals\surfblocker\filters\adult\is-ltaur.tmp to %ALLUSERSPROFILE%\blumentals\surfblocker\filters\adult\domains_dating
- from %ALLUSERSPROFILE%\blumentals\surfblocker\filters\adult\is-nmi6u.tmp to %ALLUSERSPROFILE%\blumentals\surfblocker\filters\adult\domains_manga
- from %ALLUSERSPROFILE%\blumentals\surfblocker\filters\adult\is-u90aj.tmp to %ALLUSERSPROFILE%\blumentals\surfblocker\filters\adult\domains_mixed_adult
- from %ALLUSERSPROFILE%\blumentals\surfblocker\filters\adult\is-ce054.tmp to %ALLUSERSPROFILE%\blumentals\surfblocker\filters\adult\filters.ini
- from %ALLUSERSPROFILE%\blumentals\surfblocker\filters\chat\is-r35j1.tmp to %ALLUSERSPROFILE%\blumentals\surfblocker\filters\chat\domains_chat
- from %ALLUSERSPROFILE%\blumentals\surfblocker\filters\chat\is-fb86r.tmp to %ALLUSERSPROFILE%\blumentals\surfblocker\filters\chat\filters.ini
- from %ALLUSERSPROFILE%\blumentals\surfblocker\filters\drugs\is-512h5.tmp to %ALLUSERSPROFILE%\blumentals\surfblocker\filters\drugs\domains_drogue
- from %ALLUSERSPROFILE%\blumentals\surfblocker\filters\drugs\is-c0g8u.tmp to %ALLUSERSPROFILE%\blumentals\surfblocker\filters\drugs\filters.ini
- from %ALLUSERSPROFILE%\blumentals\surfblocker\filters\gambling\is-65fl5.tmp to %ALLUSERSPROFILE%\blumentals\surfblocker\filters\gambling\domains_arjel
- from %ALLUSERSPROFILE%\blumentals\surfblocker\filters\gambling\is-12psh.tmp to %ALLUSERSPROFILE%\blumentals\surfblocker\filters\gambling\domains_gambling
- from %ALLUSERSPROFILE%\blumentals\surfblocker\filters\gambling\is-rtnkh.tmp to %ALLUSERSPROFILE%\blumentals\surfblocker\filters\gambling\filters.ini
- from %ALLUSERSPROFILE%\blumentals\surfblocker\filters\games\is-p99ct.tmp to %ALLUSERSPROFILE%\blumentals\surfblocker\filters\games\domains_games
- from %ALLUSERSPROFILE%\blumentals\surfblocker\filters\games\is-13r80.tmp to %ALLUSERSPROFILE%\blumentals\surfblocker\filters\games\filters.ini
- from %ALLUSERSPROFILE%\blumentals\surfblocker\filters\malware\is-vlpln.tmp to %ALLUSERSPROFILE%\blumentals\surfblocker\filters\malware\domains_cryptojacking
- from %ALLUSERSPROFILE%\blumentals\surfblocker\filters\malware\is-svjph.tmp to %ALLUSERSPROFILE%\blumentals\surfblocker\filters\malware\domains_ddos
- from %ALLUSERSPROFILE%\blumentals\surfblocker\filters\malware\is-vdg2a.tmp to %ALLUSERSPROFILE%\blumentals\surfblocker\filters\malware\domains_hacking
- from %ALLUSERSPROFILE%\blumentals\surfblocker\filters\malware\is-mv646.tmp to %ALLUSERSPROFILE%\blumentals\surfblocker\filters\malware\domains_malware
- from %ALLUSERSPROFILE%\blumentals\surfblocker\filters\malware\is-fn7oq.tmp to %ALLUSERSPROFILE%\blumentals\surfblocker\filters\malware\domains_phishing
- from %ALLUSERSPROFILE%\blumentals\surfblocker\filters\malware\is-d0oo9.tmp to %ALLUSERSPROFILE%\blumentals\surfblocker\filters\malware\domains_stalkerware
- from %ALLUSERSPROFILE%\blumentals\surfblocker\filters\malware\is-c71ep.tmp to %ALLUSERSPROFILE%\blumentals\surfblocker\filters\malware\domains_warez
- from %ALLUSERSPROFILE%\blumentals\surfblocker\filters\malware\is-8ontl.tmp to %ALLUSERSPROFILE%\blumentals\surfblocker\filters\malware\filters.ini
- from %ALLUSERSPROFILE%\blumentals\surfblocker\filters\nudity\is-7j6v6.tmp to %ALLUSERSPROFILE%\blumentals\surfblocker\filters\nudity\domains_lingerie
- from %ALLUSERSPROFILE%\blumentals\surfblocker\filters\nudity\is-s0jr5.tmp to %ALLUSERSPROFILE%\blumentals\surfblocker\filters\nudity\filters.ini
- from %ALLUSERSPROFILE%\blumentals\surfblocker\filters\social\is-vd4c8.tmp to %ALLUSERSPROFILE%\blumentals\surfblocker\filters\social\domains_social_networks
- from %ALLUSERSPROFILE%\blumentals\surfblocker\filters\social\is-c8frt.tmp to %ALLUSERSPROFILE%\blumentals\surfblocker\filters\social\filters.ini
- from %ALLUSERSPROFILE%\blumentals\surfblocker\filters\violence\is-f3ddd.tmp to %ALLUSERSPROFILE%\blumentals\surfblocker\filters\violence\domains_agressif
- from %ALLUSERSPROFILE%\blumentals\surfblocker\filters\violence\is-5ftl6.tmp to %ALLUSERSPROFILE%\blumentals\surfblocker\filters\violence\domains_dangerous_material
- from %ALLUSERSPROFILE%\blumentals\surfblocker\filters\violence\is-f45dd.tmp to %ALLUSERSPROFILE%\blumentals\surfblocker\filters\violence\filters.ini
- from %ALLUSERSPROFILE%\blumentals\surfblocker\filters\proxy\is-rf4sl.tmp to %ALLUSERSPROFILE%\blumentals\surfblocker\filters\proxy\domains_redirector
- from %ALLUSERSPROFILE%\blumentals\surfblocker\filters\proxy\is-p15o6.tmp to %ALLUSERSPROFILE%\blumentals\surfblocker\filters\proxy\filters.ini
- from %ProgramFiles(x86)%\surfblocker\data\offers\is-iq3e4.tmp to %ProgramFiles(x86)%\surfblocker\data\offers\special.htm
- from %ProgramFiles(x86)%\surfblocker\data\offers\images\is-r4up0.tmp to %ProgramFiles(x86)%\surfblocker\data\offers\images\piggy-bank.png
- from %ProgramFiles(x86)%\surfblocker\data\offers\images\is-27i1m.tmp to %ProgramFiles(x86)%\surfblocker\data\offers\images\underline.png
- from %ALLUSERSPROFILE%\blumentals\surfblocker\filters\adult\domains_adult to %WINDIR%\syswow64\config\systemprofile\appdata\roaming\blumentals\surfblocker\filters\adult\domains_adult
- from %ALLUSERSPROFILE%\blumentals\surfblocker\filters\adult\domains_dating to %WINDIR%\syswow64\config\systemprofile\appdata\roaming\blumentals\surfblocker\filters\adult\domains_dating
- from %ALLUSERSPROFILE%\blumentals\surfblocker\filters\adult\domains_manga to %WINDIR%\syswow64\config\systemprofile\appdata\roaming\blumentals\surfblocker\filters\adult\domains_manga
- from %ALLUSERSPROFILE%\blumentals\surfblocker\filters\adult\domains_mixed_adult to %WINDIR%\syswow64\config\systemprofile\appdata\roaming\blumentals\surfblocker\filters\adult\domains_mixed_adult
- from %ALLUSERSPROFILE%\blumentals\surfblocker\filters\adult\filters.ini to %WINDIR%\syswow64\config\systemprofile\appdata\roaming\blumentals\surfblocker\filters\adult\filters.ini
- from %ALLUSERSPROFILE%\blumentals\surfblocker\filters\chat\domains_chat to %WINDIR%\syswow64\config\systemprofile\appdata\roaming\blumentals\surfblocker\filters\chat\domains_chat
- from %ALLUSERSPROFILE%\blumentals\surfblocker\filters\chat\filters.ini to %WINDIR%\syswow64\config\systemprofile\appdata\roaming\blumentals\surfblocker\filters\chat\filters.ini
- from %ALLUSERSPROFILE%\blumentals\surfblocker\filters\drugs\domains_drogue to %WINDIR%\syswow64\config\systemprofile\appdata\roaming\blumentals\surfblocker\filters\drugs\domains_drogue
- from %ALLUSERSPROFILE%\blumentals\surfblocker\filters\drugs\filters.ini to %WINDIR%\syswow64\config\systemprofile\appdata\roaming\blumentals\surfblocker\filters\drugs\filters.ini
- from %ALLUSERSPROFILE%\blumentals\surfblocker\filters\gambling\domains_arjel to %WINDIR%\syswow64\config\systemprofile\appdata\roaming\blumentals\surfblocker\filters\gambling\domains_arjel
- from %ALLUSERSPROFILE%\blumentals\surfblocker\filters\gambling\domains_gambling to %WINDIR%\syswow64\config\systemprofile\appdata\roaming\blumentals\surfblocker\filters\gambling\domains_gambling
- from %ALLUSERSPROFILE%\blumentals\surfblocker\filters\gambling\filters.ini to %WINDIR%\syswow64\config\systemprofile\appdata\roaming\blumentals\surfblocker\filters\gambling\filters.ini
- from %ALLUSERSPROFILE%\blumentals\surfblocker\filters\games\domains_games to %WINDIR%\syswow64\config\systemprofile\appdata\roaming\blumentals\surfblocker\filters\games\domains_games
- from %ALLUSERSPROFILE%\blumentals\surfblocker\filters\games\filters.ini to %WINDIR%\syswow64\config\systemprofile\appdata\roaming\blumentals\surfblocker\filters\games\filters.ini
- from %ALLUSERSPROFILE%\blumentals\surfblocker\filters\malware\domains_cryptojacking to %WINDIR%\syswow64\config\systemprofile\appdata\roaming\blumentals\surfblocker\filters\malware\domains_cryptojacking
- from %ALLUSERSPROFILE%\blumentals\surfblocker\filters\malware\domains_ddos to %WINDIR%\syswow64\config\systemprofile\appdata\roaming\blumentals\surfblocker\filters\malware\domains_ddos
- from %ALLUSERSPROFILE%\blumentals\surfblocker\filters\malware\domains_hacking to %WINDIR%\syswow64\config\systemprofile\appdata\roaming\blumentals\surfblocker\filters\malware\domains_hacking
- from %ALLUSERSPROFILE%\blumentals\surfblocker\filters\malware\domains_malware to %WINDIR%\syswow64\config\systemprofile\appdata\roaming\blumentals\surfblocker\filters\malware\domains_malware
- from %ALLUSERSPROFILE%\blumentals\surfblocker\filters\malware\domains_phishing to %WINDIR%\syswow64\config\systemprofile\appdata\roaming\blumentals\surfblocker\filters\malware\domains_phishing
- from %ALLUSERSPROFILE%\blumentals\surfblocker\filters\malware\domains_stalkerware to %WINDIR%\syswow64\config\systemprofile\appdata\roaming\blumentals\surfblocker\filters\malware\domains_stalkerware
- from %ALLUSERSPROFILE%\blumentals\surfblocker\filters\malware\domains_warez to %WINDIR%\syswow64\config\systemprofile\appdata\roaming\blumentals\surfblocker\filters\malware\domains_warez
- from %ALLUSERSPROFILE%\blumentals\surfblocker\filters\malware\filters.ini to %WINDIR%\syswow64\config\systemprofile\appdata\roaming\blumentals\surfblocker\filters\malware\filters.ini
- from %ALLUSERSPROFILE%\blumentals\surfblocker\filters\nudity\domains_lingerie to %WINDIR%\syswow64\config\systemprofile\appdata\roaming\blumentals\surfblocker\filters\nudity\domains_lingerie
- from %ALLUSERSPROFILE%\blumentals\surfblocker\filters\nudity\filters.ini to %WINDIR%\syswow64\config\systemprofile\appdata\roaming\blumentals\surfblocker\filters\nudity\filters.ini
- from %ALLUSERSPROFILE%\blumentals\surfblocker\filters\proxy\domains_redirector to %WINDIR%\syswow64\config\systemprofile\appdata\roaming\blumentals\surfblocker\filters\proxy\domains_redirector
- from %ALLUSERSPROFILE%\blumentals\surfblocker\filters\proxy\filters.ini to %WINDIR%\syswow64\config\systemprofile\appdata\roaming\blumentals\surfblocker\filters\proxy\filters.ini
- from %ALLUSERSPROFILE%\blumentals\surfblocker\filters\social\domains_social_networks to %WINDIR%\syswow64\config\systemprofile\appdata\roaming\blumentals\surfblocker\filters\social\domains_social_networks
- from %ALLUSERSPROFILE%\blumentals\surfblocker\filters\social\filters.ini to %WINDIR%\syswow64\config\systemprofile\appdata\roaming\blumentals\surfblocker\filters\social\filters.ini
- from %ALLUSERSPROFILE%\blumentals\surfblocker\filters\violence\domains_agressif to %WINDIR%\syswow64\config\systemprofile\appdata\roaming\blumentals\surfblocker\filters\violence\domains_agressif
- from %ALLUSERSPROFILE%\blumentals\surfblocker\filters\violence\domains_dangerous_material to %WINDIR%\syswow64\config\systemprofile\appdata\roaming\blumentals\surfblocker\filters\violence\domains_dangerous_material
- from %ALLUSERSPROFILE%\blumentals\surfblocker\filters\violence\filters.ini to %WINDIR%\syswow64\config\systemprofile\appdata\roaming\blumentals\surfblocker\filters\violence\filters.ini
Modifies the HOSTS file.
Miscellaneous
Creates and executes the following
- '%APPDATA%\blumentalssurfblocker\launcher.exe'
- '%APPDATA%\blumentalssurfblocker\surfblocker.exe' /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
- '%TEMP%\is-qr068.tmp\surfblocker.tmp' /SL5="$90198,15952795,57856,%APPDATA%\BlumentalsSurfblocker\surfblocker.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
- '%ProgramFiles(x86)%\surfblocker\iprotectorhelper64.exe'
- '%ProgramFiles(x86)%\surfblocker\iprotectorservice.exe'
Executes the following
- '<SYSTEM32>\cmd.exe' /c ""%APPDATA%\BlumentalsSurfblocker\KillDuplicate.cmd" "%APPDATA%\BlumentalsSurfblocker" "<File name>.exe""
- '<SYSTEM32>\cmd.exe' /c ""%APPDATA%\BlumentalsSurfblocker\KillDuplicate.cmd" "%APPDATA%\BlumentalsSurfblocker" "<File name>.exe""' (with hidden window)
- '%APPDATA%\blumentalssurfblocker\launcher.exe' ' (with hidden window)
- '%ProgramFiles(x86)%\surfblocker\iprotectorhelper64.exe' ' (with hidden window)
