Trojan.StartPage.63711

Техническая информация

Вредоносные функции:

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

C:\RECYCLER\S-1-5-21-2052111302-484763869-725345543-1003\desktop.ini

Удаляет следующие файлы:

%WINDIR%\$NtUninstallKB942288-v3$\msimsg.dll
%WINDIR%\$NtUninstallKB942288-v3$\msisip.dll
%WINDIR%\$NtUninstallKB942288-v3$\msihnd.dll
%WINDIR%\$NtUninstallKB942288-v3$\msi.dll
%WINDIR%\$NtUninstallKB942288-v3$\msiexec.exe
%WINDIR%\$NtUninstallKB942288-v3$\reg00016
%WINDIR%\$NtUninstallKB942288-v3$\reg00017
%WINDIR%\$NtUninstallKB942288-v3$\reg00015
%WINDIR%\$NtUninstallKB942288-v3$\reg00013
%WINDIR%\$NtUninstallKB942288-v3$\reg00014
%WINDIR%\Prefetch\XPSEPSC-X86-EN-US.EXE-13D81584.pf
%WINDIR%\Prefetch\XPSEPSC-X86-EN-US.EXE-1D9A5DDC.pf
%WINDIR%\Prefetch\WUAUCLT.EXE-399A8E72.pf
%WINDIR%\Prefetch\WMPLAYER.EXE-18DDEF9D.pf
%WINDIR%\Prefetch\WSCNTFY.EXE-1B24F5EB.pf
%WINDIR%\$NtUninstallWIC$\spuninst\spuninst.txt
%WINDIR%\$NtUninstallWIC$\spuninst\updspapi.dll
%WINDIR%\$NtUninstallWIC$\spuninst\spuninst.inf
%WINDIR%\Temp\Perflib_Perfdata_7e8.dat
%WINDIR%\$NtUninstallWIC$\spuninst\spuninst.exe
%WINDIR%\$NtUninstallKB942288-v3$\reg00031
%WINDIR%\$NtUninstallKB942288-v3$\reg00032
%WINDIR%\$NtUninstallKB942288-v3$\reg00030
%WINDIR%\$NtUninstallKB942288-v3$\reg00028
%WINDIR%\$NtUninstallKB942288-v3$\reg00029
%WINDIR%\$NtUninstallKB942288-v3$\reg00036
%WINDIR%\$NtUninstallKB942288-v3$\reg00037
%WINDIR%\$NtUninstallKB942288-v3$\reg00035
%WINDIR%\$NtUninstallKB942288-v3$\reg00033
%WINDIR%\$NtUninstallKB942288-v3$\reg00034
%WINDIR%\$NtUninstallKB942288-v3$\reg00021
%WINDIR%\$NtUninstallKB942288-v3$\reg00022
%WINDIR%\$NtUninstallKB942288-v3$\reg00020
%WINDIR%\$NtUninstallKB942288-v3$\reg00018
%WINDIR%\$NtUninstallKB942288-v3$\reg00019
%WINDIR%\$NtUninstallKB942288-v3$\reg00026
%WINDIR%\$NtUninstallKB942288-v3$\reg00027
%WINDIR%\$NtUninstallKB942288-v3$\reg00025
%WINDIR%\$NtUninstallKB942288-v3$\reg00023
%WINDIR%\$NtUninstallKB942288-v3$\reg00024
%WINDIR%\Prefetch\SL1.TMP-04C43349.pf
%WINDIR%\Prefetch\SL38.TMP-141C07C8.pf
%WINDIR%\Prefetch\SHMGRATE.EXE-1BA69E68.pf
%WINDIR%\Prefetch\SETUP50.EXE-362FF7C9.pf
%WINDIR%\Prefetch\SETUP_WM.EXE-3135CBD7.pf
%WINDIR%\Prefetch\TASKMGR.EXE-20256C55.pf
%WINDIR%\Prefetch\TOURSTART.EXE-0D0140ED.pf
%WINDIR%\Prefetch\SVCHOST.EXE-3530F672.pf
%WINDIR%\Prefetch\SPOOLSV.EXE-282F76A7.pf
%WINDIR%\Prefetch\SPUPDSVC.EXE-21B36524.pf
%WINDIR%\Prefetch\SERVICEMODELREG.EXE-3848AC09.pf
%WINDIR%\Prefetch\SERVICES.EXE-2F433351.pf
%WINDIR%\Prefetch\SERVICEMODELREG.EXE-1FB5DD06.pf
%WINDIR%\Prefetch\RUNONCE.EXE-2803F297.pf
%WINDIR%\Prefetch\SCOOPYNG.EXE-1E3B99FD.pf
%WINDIR%\Prefetch\SETUP.EXE-1BF5B58E.pf
%WINDIR%\Prefetch\SETUP.EXE-314FAC7C.pf
%WINDIR%\Prefetch\SETUP.EXE-183299E5.pf
%WINDIR%\Prefetch\SETUP.EXE-015E7381.pf
%WINDIR%\Prefetch\SETUP.EXE-0FFAB653.pf
%WINDIR%\Prefetch\VCREDI~1.EXE-33033670.pf
%WINDIR%\Prefetch\VCREDI~3.EXE-0730BA06.pf
%WINDIR%\Prefetch\VCREDIST_X86_2010SP1.EXE-2DD9A199.pf
%WINDIR%\Prefetch\VCREDIST_X86_2008.EXE-0322FB7F.pf
%WINDIR%\Prefetch\VCREDIST_X86_2010.EXE-24F154F5.pf
%WINDIR%\Prefetch\WMIADAP.EXE-2DF425B2.pf
%WINDIR%\Prefetch\WMIPRVSE.EXE-28F301A9.pf
%WINDIR%\Prefetch\WIC_X86_ENU.EXE-0A240D86.pf
%WINDIR%\Prefetch\VS7.1SP1-KB9322981102-X86-ENU-356F70C0.pf
%WINDIR%\Prefetch\WFSERVICESREG.EXE-063492A2.pf
%WINDIR%\Prefetch\UPDATE.EXE-15191106.pf
%WINDIR%\Prefetch\UPDATE.EXE-32EB78F6.pf
%WINDIR%\Prefetch\UPDATE.EXE-0B22B468.pf
%WINDIR%\Prefetch\UNLODCTR.EXE-37313252.pf
%WINDIR%\Prefetch\UNREGMP2.EXE-07CACB61.pf
%WINDIR%\Prefetch\VCREDIST_X86_2005.EXE-1A2586B8.pf
%WINDIR%\Prefetch\VCREDIST_X86_2005SP1.EXE-005B71E6.pf
%WINDIR%\Prefetch\VCREDIST.EXE-3810E24C.pf
%WINDIR%\Prefetch\USERINIT.EXE-30B18140.pf
%WINDIR%\Prefetch\VC6REDISTSETUP_ENU.EXE-0D8EC880.pf
%WINDIR%\$NtUninstallKB942288-v3$\reg00039
%WINDIR%\$NtUninstallKB942288-v3$\reg00095
%WINDIR%\$NtUninstallKB942288-v3$\reg00096
%WINDIR%\$NtUninstallKB942288-v3$\reg00094
%WINDIR%\$NtUninstallKB942288-v3$\reg00092
%WINDIR%\$NtUninstallKB942288-v3$\reg00093
%WINDIR%\$NtUninstallKB942288-v3$\reg00100
%WINDIR%\$NtUninstallKB942288-v3$\reg00101
%WINDIR%\$NtUninstallKB942288-v3$\reg00099
%WINDIR%\$NtUninstallKB942288-v3$\reg00097
%WINDIR%\$NtUninstallKB942288-v3$\reg00098
%WINDIR%\$NtUninstallKB942288-v3$\reg00085
%WINDIR%\$NtUninstallKB942288-v3$\reg00086
%WINDIR%\$NtUninstallKB942288-v3$\reg00084
%WINDIR%\$NtUninstallKB942288-v3$\reg00082
%WINDIR%\$NtUninstallKB942288-v3$\reg00083
%WINDIR%\$NtUninstallKB942288-v3$\reg00090
%WINDIR%\$NtUninstallKB942288-v3$\reg00091
%WINDIR%\$NtUninstallKB942288-v3$\reg00089
%WINDIR%\$NtUninstallKB942288-v3$\reg00087
%WINDIR%\$NtUninstallKB942288-v3$\reg00088
%WINDIR%\$NtUninstallKB942288-v3$\reg00115
%WINDIR%\$NtUninstallKB942288-v3$\reg00116
%WINDIR%\$NtUninstallKB942288-v3$\reg00114
%WINDIR%\$NtUninstallKB942288-v3$\reg00112
%WINDIR%\$NtUninstallKB942288-v3$\reg00113
%WINDIR%\$NtUninstallKB942288-v3$\spuninst\spuninst.txt
%WINDIR%\$NtUninstallKB942288-v3$\spuninst\updspapi.dll
%WINDIR%\$NtUninstallKB942288-v3$\spuninst\spuninst.inf
%WINDIR%\$NtUninstallKB942288-v3$\reg00117
%WINDIR%\$NtUninstallKB942288-v3$\spuninst\spuninst.exe
%WINDIR%\$NtUninstallKB942288-v3$\reg00105
%WINDIR%\$NtUninstallKB942288-v3$\reg00106
%WINDIR%\$NtUninstallKB942288-v3$\reg00104
%WINDIR%\$NtUninstallKB942288-v3$\reg00102
%WINDIR%\$NtUninstallKB942288-v3$\reg00103
%WINDIR%\$NtUninstallKB942288-v3$\reg00110
%WINDIR%\$NtUninstallKB942288-v3$\reg00111
%WINDIR%\$NtUninstallKB942288-v3$\reg00109
%WINDIR%\$NtUninstallKB942288-v3$\reg00107
%WINDIR%\$NtUninstallKB942288-v3$\reg00108
%WINDIR%\$NtUninstallKB942288-v3$\reg00055
%WINDIR%\$NtUninstallKB942288-v3$\reg00056
%WINDIR%\$NtUninstallKB942288-v3$\reg00054
%WINDIR%\$NtUninstallKB942288-v3$\reg00052
%WINDIR%\$NtUninstallKB942288-v3$\reg00053
%WINDIR%\$NtUninstallKB942288-v3$\reg00060
%WINDIR%\$NtUninstallKB942288-v3$\reg00061
%WINDIR%\$NtUninstallKB942288-v3$\reg00059
%WINDIR%\$NtUninstallKB942288-v3$\reg00057
%WINDIR%\$NtUninstallKB942288-v3$\reg00058
%WINDIR%\$NtUninstallKB942288-v3$\reg00043
%WINDIR%\$NtUninstallKB942288-v3$\reg00044
%WINDIR%\$NtUninstallKB942288-v3$\reg00042
%WINDIR%\$NtUninstallKB942288-v3$\reg00040
%WINDIR%\$NtUninstallKB942288-v3$\reg00041
%WINDIR%\$NtUninstallKB942288-v3$\reg00048
%WINDIR%\$NtUninstallKB942288-v3$\reg00049
%WINDIR%\$NtUninstallKB942288-v3$\reg00047
%WINDIR%\$NtUninstallKB942288-v3$\reg00045
%WINDIR%\$NtUninstallKB942288-v3$\reg00046
%WINDIR%\$NtUninstallKB942288-v3$\reg00075
%WINDIR%\$NtUninstallKB942288-v3$\reg00076
%WINDIR%\$NtUninstallKB942288-v3$\reg00074
%WINDIR%\$NtUninstallKB942288-v3$\reg00072
%WINDIR%\$NtUninstallKB942288-v3$\reg00073
%WINDIR%\$NtUninstallKB942288-v3$\reg00080
%WINDIR%\$NtUninstallKB942288-v3$\reg00081
%WINDIR%\$NtUninstallKB942288-v3$\reg00079
%WINDIR%\$NtUninstallKB942288-v3$\reg00077
%WINDIR%\$NtUninstallKB942288-v3$\reg00078
%WINDIR%\$NtUninstallKB942288-v3$\reg00065
%WINDIR%\$NtUninstallKB942288-v3$\reg00066
%WINDIR%\$NtUninstallKB942288-v3$\reg00064
%WINDIR%\$NtUninstallKB942288-v3$\reg00062
%WINDIR%\$NtUninstallKB942288-v3$\reg00063
%WINDIR%\$NtUninstallKB942288-v3$\reg00070
%WINDIR%\$NtUninstallKB942288-v3$\reg00071
%WINDIR%\$NtUninstallKB942288-v3$\reg00069
%WINDIR%\$NtUninstallKB942288-v3$\reg00067
%WINDIR%\$NtUninstallKB942288-v3$\reg00068
<SYSTEM32>\CatRoot2\edb0000F.log
<SYSTEM32>\CatRoot2\edb00010.log
<SYSTEM32>\CatRoot2\edb0000E.log
<SYSTEM32>\CatRoot2\edb.log
<SYSTEM32>\CatRoot2\edb0000D.log
<SYSTEM32>\CatRoot2\edb00014.log
<SYSTEM32>\CatRoot2\edb00015.log
<SYSTEM32>\CatRoot2\edb00013.log
<SYSTEM32>\CatRoot2\edb00011.log
<SYSTEM32>\CatRoot2\edb00012.log
%WINDIR%\security\logs\backup.log
%WINDIR%\security\logs\SceRoot.log
%WINDIR%\repair\setup.log
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ngen_service.log
%WINDIR%\pchealth\helpctr\Logs\hcupdate.log
%WINDIR%\SoftwareDistribution\DataStore\Logs\res1.log
%WINDIR%\SoftwareDistribution\DataStore\Logs\res2.log
%WINDIR%\SoftwareDistribution\DataStore\Logs\edb.log
%WINDIR%\security\logs\scesetup.log
%WINDIR%\SoftwareDistribution\ReportingEvents.log
<SYSTEM32>\wbem\Logs\wmiadap.log
<SYSTEM32>\wbem\Logs\wmiprov.log
<SYSTEM32>\wbem\Logs\wbemprox.log
<SYSTEM32>\wbem\Logs\wbemcore.log
<SYSTEM32>\wbem\Logs\wbemess.log
%WINDIR%\imsins.BAK
%WINDIR%\pchealth\helpctr\Config\Cache\Professional_32_1033.dat.bak
%WINDIR%\REGLOCS.OLD
%WINDIR%\SoftwareDistribution\DataStore\Logs\edb.chk
<SYSTEM32>\CatRoot2\edb.chk
<SYSTEM32>\CatRoot2\res2.log
<SYSTEM32>\MsDtc\MSDTC.LOG
<SYSTEM32>\CatRoot2\res1.log
<SYSTEM32>\CatRoot2\edb00016.log
<SYSTEM32>\CatRoot2\edb00017.log
<SYSTEM32>\wbem\Logs\replog.log
<SYSTEM32>\wbem\Logs\setup.log
<SYSTEM32>\wbem\Logs\mofcomp.log
<SYSTEM32>\MsDtc\Trace\dtctrace.log
<SYSTEM32>\wbem\Logs\FrameWork.log
%WINDIR%\MedCtrOC.log
%WINDIR%\msgsocm.log
%WINDIR%\KB942288-v3.log
%WINDIR%\iis6.log
%WINDIR%\imsins.log
%WINDIR%\ocgen.log
%WINDIR%\ocmsn.log
%WINDIR%\ntdtcsetup.log
%WINDIR%\msmqinst.log
%WINDIR%\netfxocm.log
<SYSTEM32>\CONFIG.TMP
%WINDIR%\0.log
%WINDIR%\SET8.tmp
%WINDIR%\SET3.tmp
%WINDIR%\SET4.tmp
%WINDIR%\DtcInstall.log
%WINDIR%\FaxSetup.log
%WINDIR%\comsetup.log
%WINDIR%\cmsetacl.log
%WINDIR%\COM+.log
%WINDIR%\wmsetup.log
%WINDIR%\Debug\blastcln.log
%WINDIR%\WindowsUpdate.log
%WINDIR%\wiadebug.log
%WINDIR%\wiaservc.log
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ngen_service.log
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ngen.log
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ngen.log
%WINDIR%\Debug\NetSetup.LOG
%WINDIR%\Debug\UserMode\userenv.log
%WINDIR%\setupapi.log
%WINDIR%\setuperr.log
%WINDIR%\setupact.log
%WINDIR%\regopt.log
%WINDIR%\sessmgr.setup.log
%WINDIR%\tsoc.log
%WINDIR%\updspapi.log
%WINDIR%\tabletoc.log
%WINDIR%\spupdsvc.log
%WINDIR%\Sti_Trace.log
<SYSTEM32>\config\systemprofile\Application Data\Microsoft\Internet Explorer\brndlog.bak
%WINDIR%\Prefetch\PERFORMANCECOUNTERINSTALLER.E-334D54EC.pf
%WINDIR%\Prefetch\PRESETUP.EXE-1C8BD573.pf
%WINDIR%\Prefetch\NTOSBOOT-B00DFAAD.pf
%WINDIR%\Prefetch\NGEN.EXE-1F9EA69F.pf
%WINDIR%\Prefetch\NGEN.EXE-38021CCC.pf
%WINDIR%\Prefetch\REGSVCS.EXE-077D24C2.pf
%WINDIR%\Prefetch\REGSVCS.EXE-11A17120.pf
%WINDIR%\Prefetch\REGEDIT.EXE-1B606482.pf
%WINDIR%\Prefetch\PRINTFILTERPIPELINESVC.EXE-0F2B9E77.pf
%WINDIR%\Prefetch\PRINTFILTERPIPELINESVC.EXE-31AE7114.pf
%WINDIR%\Prefetch\MSCORSVW.EXE-1BF30400.pf
%WINDIR%\Prefetch\MSDTC.EXE-0E6E4AF7.pf
%WINDIR%\Prefetch\MSCORSVW.EXE-1366B4F5.pf
%WINDIR%\Prefetch\MOFCOMP.EXE-01718E95.pf
%WINDIR%\Prefetch\MSCONFIG.EXE-35E4DAE9.pf
%WINDIR%\Prefetch\MSOOBE.EXE-30411B02.pf
%WINDIR%\Prefetch\NGEN.EXE-171CDCC6.pf
%WINDIR%\Prefetch\MSMSGS.EXE-2B6052DE.pf
%WINDIR%\Prefetch\MSIEXEC.EXE-2F8A8CAE.pf
%WINDIR%\Prefetch\MSIMN.EXE-38BA891D.pf
%WINDIR%\Prefetch\RUNDLL32.EXE-2C7B5C4A.pf
%WINDIR%\Prefetch\RUNDLL32.EXE-2F26E69F.pf
%WINDIR%\Prefetch\RUNDLL32.EXE-2AF77CC9.pf
%WINDIR%\Prefetch\RUNDLL32.EXE-286A7F8C.pf
%WINDIR%\Prefetch\RUNDLL32.EXE-29373198.pf
%WINDIR%\Prefetch\RUNDLL32.EXE-470F11BD.pf
%WINDIR%\Prefetch\RUNDLL32.EXE-49F747DB.pf
%WINDIR%\Prefetch\RUNDLL32.EXE-4499C56E.pf
%WINDIR%\Prefetch\RUNDLL32.EXE-31EBBE5F.pf
%WINDIR%\Prefetch\RUNDLL32.EXE-4176E9B5.pf
%WINDIR%\Prefetch\REGTLIBV12.EXE-35B5D8AD.pf
%WINDIR%\Prefetch\RUNDLL32.EXE-12E27DD0.pf
%WINDIR%\Prefetch\REGTLIBV12.EXE-0E2FA54B.pf
%WINDIR%\Prefetch\REGSVR32.EXE-25EEFE2F.pf
%WINDIR%\Prefetch\REGTLIB.EXE-0CCB81E6.pf
%WINDIR%\Prefetch\RUNDLL32.EXE-1BC69D2D.pf
%WINDIR%\Prefetch\RUNDLL32.EXE-2576181F.pf
%WINDIR%\Prefetch\RUNDLL32.EXE-1831A4F3.pf
%WINDIR%\Prefetch\RUNDLL32.EXE-147710F4.pf
%WINDIR%\Prefetch\RUNDLL32.EXE-169CA248.pf
%WINDIR%\Prefetch\CVTRES.EXE-2329DCD5.pf
%WINDIR%\Prefetch\DFRGNTFS.EXE-269967DF.pf
%WINDIR%\Prefetch\CTFMON.EXE-0E17969B.pf
%WINDIR%\Prefetch\CSCRIPT.EXE-1C26180C.pf
%WINDIR%\Prefetch\CSRSS.EXE-12B63473.pf
%WINDIR%\Prefetch\DOTNETFX.EXE-2FD4C451.pf
%WINDIR%\Prefetch\DOTNETFX3.EXE-35065F74.pf
%WINDIR%\Prefetch\DOTNETFX.EXE-2AC9C3A4.pf
%WINDIR%\Prefetch\DLLHOST.EXE-5353C76C.pf
%WINDIR%\Prefetch\DOTNETFX.EXE-1747AF91.pf
%WINDIR%\Prefetch\ASPNET_REGIIS.EXE-38397C30.pf
%WINDIR%\Prefetch\CALC.EXE-02CD573A.pf
%WINDIR%\Prefetch\ASPNET_REGIIS.EXE-057C90FA.pf
%WINDIR%\Prefetch\ALG.EXE-0F138680.pf
%WINDIR%\Prefetch\ASPNET_REGIIS.EXE-009D6E80.pf
%WINDIR%\Prefetch\CONTROL.EXE-013DBFB5.pf
%WINDIR%\Prefetch\CSC.EXE-01730C27.pf
%WINDIR%\Prefetch\CMD.EXE-087B4001.pf
%WINDIR%\Prefetch\CLEANMGR.EXE-1F86EA8E.pf
%WINDIR%\Prefetch\CLWIREG.EXE-2A4BC2FD.pf
%WINDIR%\Prefetch\LODCTR.EXE-1009C3B4.pf
%WINDIR%\Prefetch\LOGON.SCR-151EFAEA.pf
%WINDIR%\Prefetch\INSTALL.EXE-37B819BB.pf
%WINDIR%\Prefetch\IMAPI.EXE-0BF740A4.pf
%WINDIR%\Prefetch\INSTALL.EXE-372327E4.pf
%WINDIR%\Prefetch\MMC.EXE-06C90BC7.pf
%WINDIR%\Prefetch\MMC.EXE-39071BCC.pf
%WINDIR%\Prefetch\MIGPOLWIN.EXE-1EFB7D70.pf
%WINDIR%\Prefetch\LOGONUI.EXE-0AF22957.pf
%WINDIR%\Prefetch\LSASS.EXE-20DB6D1B.pf
%WINDIR%\Prefetch\DOTNETREDIST.EXE-2C5CB08D.pf
%WINDIR%\Prefetch\EXPLORER.EXE-082F38A9.pf
%WINDIR%\Prefetch\DOTNETFX40_FULL_X86_X64.EXE-2F42557F.pf
%WINDIR%\Prefetch\DOTNETFX35.EXE-0101DD70.pf
%WINDIR%\Prefetch\DOTNETFX35SETUP.EXE-39FE1058.pf
%WINDIR%\Prefetch\IE4UINIT.EXE-169A5A39.pf
%WINDIR%\Prefetch\IEXPLORE.EXE-27122324.pf
%WINDIR%\Prefetch\ICWCONN1.EXE-24884676.pf
%WINDIR%\Prefetch\FAR.EXE-13A195F9.pf
%WINDIR%\Prefetch\FIREFOX.EXE-030B768A.pf

Другое:

Ищет следующие окна:

ClassName: 'Shell_TrayWnd' WindowName: '(null)'

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней