Trojan.StartPage.48125

Техническая информация

Вредоносные функции:

Запускает на исполнение:

%WINDIR%\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe "%PROGRAM_FILES%\SearchToolbar\Plugin\SearchBar.dll" /codebase /silent

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\{3D098A34-4D9F-4873-A333-229BB80BF7F2}\chrome\content\id_searchtoolbar\tb_bubble.js
%TEMP%\{3D098A34-4D9F-4873-A333-229BB80BF7F2}\chrome\content\id_searchtoolbar\tb_clearautofill.js
%TEMP%\{3D098A34-4D9F-4873-A333-229BB80BF7F2}\chrome\content\id_searchtoolbar\tb_allow_popups.js
%TEMP%\{3D098A34-4D9F-4873-A333-229BB80BF7F2}\chrome\content\id_searchtoolbar\tb_block_popups.js
%TEMP%\{3D098A34-4D9F-4873-A333-229BB80BF7F2}\chrome\content\id_searchtoolbar\tb_clearhistory.js
%TEMP%\{3D098A34-4D9F-4873-A333-229BB80BF7F2}\chrome\content\id_searchtoolbar\tb_clearurlbarhistory.js
%TEMP%\{3D098A34-4D9F-4873-A333-229BB80BF7F2}\chrome\content\id_searchtoolbar\tb_clearcache.js
%TEMP%\{3D098A34-4D9F-4873-A333-229BB80BF7F2}\chrome\content\id_searchtoolbar\tb_clearcookie.js
%TEMP%\{3D098A34-4D9F-4873-A333-229BB80BF7F2}\chrome\content\id_searchtoolbar\tb.css
%TEMP%\{3D098A34-4D9F-4873-A333-229BB80BF7F2}\chrome\content\id_searchtoolbar\tb.js
%TEMP%\{3D098A34-4D9F-4873-A333-229BB80BF7F2}\chrome\content\id_searchtoolbar\separator.png
%TEMP%\{3D098A34-4D9F-4873-A333-229BB80BF7F2}\chrome\content\id_searchtoolbar\tabs.htm
%TEMP%\{3D098A34-4D9F-4873-A333-229BB80BF7F2}\chrome\content\id_searchtoolbar\tbcore3.inf
%TEMP%\{3D098A34-4D9F-4873-A333-229BB80BF7F2}\chrome\content\id_searchtoolbar\tb_alerts.js
%TEMP%\{3D098A34-4D9F-4873-A333-229BB80BF7F2}\chrome\content\id_searchtoolbar\tb.xsl
%TEMP%\{3D098A34-4D9F-4873-A333-229BB80BF7F2}\chrome\content\id_searchtoolbar\tb.xul
%TEMP%\{3D098A34-4D9F-4873-A333-229BB80BF7F2}\chrome\content\id_searchtoolbar\your_logo.png
%TEMP%\{3D098A34-4D9F-4873-A333-229BB80BF7F2}\chrome.manifest
%TEMP%\{3D098A34-4D9F-4873-A333-229BB80BF7F2}\chrome\content\id_searchtoolbar\tb_widget.js
%TEMP%\{3D098A34-4D9F-4873-A333-229BB80BF7F2}\chrome\content\id_searchtoolbar\version.txt
%TEMP%\{3D098A34-4D9F-4873-A333-229BB80BF7F2}\chrome\content\id_searchtoolbar\basis.xml
%TEMP%\conto_corrente_v_1.0.zip
%TEMP%\{3D098A34-4D9F-4873-A333-229BB80BF7F2}\install.rdf
%TEMP%\{3D098A34-4D9F-4873-A333-229BB80BF7F2}\chrome\content\id_searchtoolbar\160.png
%TEMP%\{3D098A34-4D9F-4873-A333-229BB80BF7F2}\chrome\content\id_searchtoolbar\tb_hidetoolbar.js
%TEMP%\{3D098A34-4D9F-4873-A333-229BB80BF7F2}\chrome\content\id_searchtoolbar\tb_launchscript.js
%TEMP%\{3D098A34-4D9F-4873-A333-229BB80BF7F2}\chrome\content\id_searchtoolbar\tb_commandchunk.js
%TEMP%\{3D098A34-4D9F-4873-A333-229BB80BF7F2}\chrome\content\id_searchtoolbar\tb_external_search.js
%TEMP%\{3D098A34-4D9F-4873-A333-229BB80BF7F2}\chrome\content\id_searchtoolbar\tb_switchcommand.js
%TEMP%\{3D098A34-4D9F-4873-A333-229BB80BF7F2}\chrome\content\id_searchtoolbar\tb_webjump.js
%TEMP%\{3D098A34-4D9F-4873-A333-229BB80BF7F2}\chrome\content\id_searchtoolbar\tb_options.js
%TEMP%\{3D098A34-4D9F-4873-A333-229BB80BF7F2}\chrome\content\id_searchtoolbar\tb_shellexecute.js
%TEMP%\{3D098A34-4D9F-4873-A333-229BB80BF7F2}\chrome\content\id_searchtoolbar\arrow_refresh.png
%TEMP%\{3D098A34-4D9F-4873-A333-229BB80BF7F2}\chrome\content\id_searchtoolbar\ask_settings.xul
%PROGRAM_FILES%\SearchToolbar\Plugin\SearchBar.dll
%TEMP%\stff.zip
%TEMP%\{3D098A34-4D9F-4873-A333-229BB80BF7F2}\chrome\content\id_searchtoolbar\bubble.xul
%TEMP%\{3D098A34-4D9F-4873-A333-229BB80BF7F2}\chrome\content\id_searchtoolbar\closeIcon.png
%TEMP%\{3D098A34-4D9F-4873-A333-229BB80BF7F2}\chrome\content\id_searchtoolbar\ask_settings_bg.png
%TEMP%\{3D098A34-4D9F-4873-A333-229BB80BF7F2}\chrome\content\id_searchtoolbar\bubble.js
%PROGRAM_FILES%\SearchToolbar\Plugin\IE BHO.dll
%PROGRAM_FILES%\SearchToolbar\Plugin\Uninstall.exe
%TEMP%\nsn2.tmp\NSISdl.dll
<SYSTEM32>\HCIRes.dll
%PROGRAM_FILES%\SearchToolbar\Plugin\BandObjectLib.dll
%PROGRAM_FILES%\SearchToolbar\Plugin\Interop.SHDocVw.dll
%PROGRAM_FILES%\SearchToolbar\Plugin\st.zip
%TEMP%\nsn2.tmp\ZipDLL.dll
%TEMP%\{3D098A34-4D9F-4873-A333-229BB80BF7F2}\chrome\content\id_searchtoolbar\md5.js
%TEMP%\{3D098A34-4D9F-4873-A333-229BB80BF7F2}\chrome\content\id_searchtoolbar\minibrowser.js
%TEMP%\{3D098A34-4D9F-4873-A333-229BB80BF7F2}\chrome\content\id_searchtoolbar\info.txt
%TEMP%\{3D098A34-4D9F-4873-A333-229BB80BF7F2}\chrome\content\id_searchtoolbar\jscontainer.htm
%TEMP%\{3D098A34-4D9F-4873-A333-229BB80BF7F2}\chrome\content\id_searchtoolbar\options.js
%TEMP%\{3D098A34-4D9F-4873-A333-229BB80BF7F2}\chrome\content\id_searchtoolbar\options.xul
%TEMP%\{3D098A34-4D9F-4873-A333-229BB80BF7F2}\chrome\content\id_searchtoolbar\minibrowser.xul
%TEMP%\{3D098A34-4D9F-4873-A333-229BB80BF7F2}\chrome\content\id_searchtoolbar\mozilla.xul
%TEMP%\{3D098A34-4D9F-4873-A333-229BB80BF7F2}\chrome\content\id_searchtoolbar\computer_delete.png
%TEMP%\{3D098A34-4D9F-4873-A333-229BB80BF7F2}\chrome\content\id_searchtoolbar\contents.rdf
%TEMP%\{3D098A34-4D9F-4873-A333-229BB80BF7F2}\chrome\content\id_searchtoolbar\cog.png
%TEMP%\{3D098A34-4D9F-4873-A333-229BB80BF7F2}\chrome\content\id_searchtoolbar\colorpicker.htm
%TEMP%\{3D098A34-4D9F-4873-A333-229BB80BF7F2}\chrome\content\id_searchtoolbar\icons.bmp
%TEMP%\{3D098A34-4D9F-4873-A333-229BB80BF7F2}\chrome\content\id_searchtoolbar\icons.png
%TEMP%\{3D098A34-4D9F-4873-A333-229BB80BF7F2}\chrome\content\id_searchtoolbar\custom_toolbar_items.xml
%TEMP%\{3D098A34-4D9F-4873-A333-229BB80BF7F2}\chrome\content\id_searchtoolbar\emailchecker_options.xul

Удаляет следующие файлы:

%TEMP%\stff.zip
%PROGRAM_FILES%\SearchToolbar\Plugin\st.zip

Сетевая активность:

Подключается к:

'www.ca##au.net':80
'81.##.214.174':80

TCP:

Запросы HTTP GET:

www.ca##au.net/public/sfw_x_external/conto_corrente_v_1.0.zip
81.##.214.174/Install.aspx?a=#############################################################

UDP: