Trojan.Click2.29724

Техническая информация

Вредоносные функции:

Запускает на исполнение:

%PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE http://www.ge####erkezi.com/toolbar/yuklemebitti.html
<SYSTEM32>\regsvr32.exe /s "%PROGRAM_FILES%\IEToolbar\Geyik Toolbar\geyik.dll"

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\{0AA1C598-2D4D-4282-8A5C-3C48229C1E19}\radio_on_01.gif
%TEMP%\{0AA1C598-2D4D-4282-8A5C-3C48229C1E19}\radio_03.gif
%TEMP%\{0AA1C598-2D4D-4282-8A5C-3C48229C1E19}\radio_02.gif
%TEMP%\{0AA1C598-2D4D-4282-8A5C-3C48229C1E19}\radio_on_02.gif
%TEMP%\{0AA1C598-2D4D-4282-8A5C-3C48229C1E19}\splitw.gif
%TEMP%\{0AA1C598-2D4D-4282-8A5C-3C48229C1E19}\spliton.gif
%TEMP%\{0AA1C598-2D4D-4282-8A5C-3C48229C1E19}\split.gif
%TEMP%\{0AA1C598-2D4D-4282-8A5C-3C48229C1E19}\icons.bmp
%TEMP%\{0AA1C598-2D4D-4282-8A5C-3C48229C1E19}\geyik.crc
%TEMP%\{0AA1C598-2D4D-4282-8A5C-3C48229C1E19}\basis.xml
%TEMP%\{0AA1C598-2D4D-4282-8A5C-3C48229C1E19}\info.txt
%TEMP%\{0AA1C598-2D4D-4282-8A5C-3C48229C1E19}\radio_01.gif
%TEMP%\{0AA1C598-2D4D-4282-8A5C-3C48229C1E19}\radio.html
%TEMP%\{0AA1C598-2D4D-4282-8A5C-3C48229C1E19}\radio.css
%TEMP%\{0AA1C598-2D4D-4282-8A5C-3C48229C1E19}\splitwon.gif
%TEMP%\{0AA1C598-2D4D-4282-8A5C-3C48229C1E19}\your_logo.png
%TEMP%\{0AA1C598-2D4D-4282-8A5C-3C48229C1E19}\volbg.gif
%TEMP%\{0AA1C598-2D4D-4282-8A5C-3C48229C1E19}\vol.gif
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\frame[1].php
%TEMP%\{0AA1C598-2D4D-4282-8A5C-3C48229C1E19}\cache\f2732b2b2f49bcb45bc99c78285dc635
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\version[1].txt
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\yuklemebitti[1].html
%TEMP%\{0AA1C598-2D4D-4282-8A5C-3C48229C1E19}\Thumbs.db
%TEMP%\{0AA1C598-2D4D-4282-8A5C-3C48229C1E19}\stations.xml
%TEMP%\{0AA1C598-2D4D-4282-8A5C-3C48229C1E19}\stations.js
%TEMP%\{0AA1C598-2D4D-4282-8A5C-3C48229C1E19}\ufacik.bmp
%TEMP%\{0AA1C598-2D4D-4282-8A5C-3C48229C1E19}\version.txt
%TEMP%\{0AA1C598-2D4D-4282-8A5C-3C48229C1E19}\update.exe
%TEMP%\{0AA1C598-2D4D-4282-8A5C-3C48229C1E19}\uninstall.exe
%PROGRAM_FILES%\IEToolbar\Geyik Toolbar\your_logo.png
%PROGRAM_FILES%\IEToolbar\Geyik Toolbar\radio_01.gif
%PROGRAM_FILES%\IEToolbar\Geyik Toolbar\radio.html
%PROGRAM_FILES%\IEToolbar\Geyik Toolbar\radio.css
%PROGRAM_FILES%\IEToolbar\Geyik Toolbar\radio_02.gif
%PROGRAM_FILES%\IEToolbar\Geyik Toolbar\radio_on_02.gif
%PROGRAM_FILES%\IEToolbar\Geyik Toolbar\radio_on_01.gif
%PROGRAM_FILES%\IEToolbar\Geyik Toolbar\radio_03.gif
%PROGRAM_FILES%\IEToolbar\Geyik Toolbar\basis.xml
%PROGRAM_FILES%\IEToolbar\Geyik Toolbar\autosearch_plugin.dll
%PROGRAM_FILES%\IEToolbar\Geyik Toolbar\Thumbs.db
%PROGRAM_FILES%\IEToolbar\Geyik Toolbar\geyik.crc
%PROGRAM_FILES%\IEToolbar\Geyik Toolbar\info.txt
%PROGRAM_FILES%\IEToolbar\Geyik Toolbar\icons.bmp
%PROGRAM_FILES%\IEToolbar\Geyik Toolbar\geyik.dll
%PROGRAM_FILES%\IEToolbar\Geyik Toolbar\split.gif
%PROGRAM_FILES%\IEToolbar\Geyik Toolbar\uninstall.exe
%PROGRAM_FILES%\IEToolbar\Geyik Toolbar\ufacik.bmp
%PROGRAM_FILES%\IEToolbar\Geyik Toolbar\tbhelper.dll
%PROGRAM_FILES%\IEToolbar\Geyik Toolbar\update.exe
%PROGRAM_FILES%\IEToolbar\Geyik Toolbar\volbg.gif
%PROGRAM_FILES%\IEToolbar\Geyik Toolbar\vol.gif
%PROGRAM_FILES%\IEToolbar\Geyik Toolbar\version.txt
%PROGRAM_FILES%\IEToolbar\Geyik Toolbar\splitwon.gif
%PROGRAM_FILES%\IEToolbar\Geyik Toolbar\splitw.gif
%PROGRAM_FILES%\IEToolbar\Geyik Toolbar\spliton.gif
%PROGRAM_FILES%\IEToolbar\Geyik Toolbar\stations.dll
%PROGRAM_FILES%\IEToolbar\Geyik Toolbar\suggestion_plugin.dll
%PROGRAM_FILES%\IEToolbar\Geyik Toolbar\stations.xml
%PROGRAM_FILES%\IEToolbar\Geyik Toolbar\stations.js