Trojan.Click2.35722

Техническая информация

Вредоносные функции:

Запускает на исполнение:

<SYSTEM32>\regsvr32.exe /s "%PROGRAM_FILES%\IEToolbar\tool Toolbar\tbcore3.dll"
%PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE http://64.##.44.216/toolbarserver/add_install.asp?ur#############################################################################################################################
<SYSTEM32>\taskkill.exe /F /IM rssclient.exe
<SYSTEM32>\taskkill.exe /F /IM tbhelper.exe

Изменения в файловой системе:

Создает следующие файлы:

%ALLUSERSPROFILE%\Application Data\Toolbar4\{10000000-1000-1000-1000-100000000000}\icons.bmp
%ALLUSERSPROFILE%\Application Data\Toolbar4\{10000000-1000-1000-1000-100000000000}\fdb.bin
%ALLUSERSPROFILE%\Application Data\Toolbar4\{10000000-1000-1000-1000-100000000000}\info.txt
%ALLUSERSPROFILE%\Application Data\Toolbar4\{10000000-1000-1000-1000-100000000000}\Index.html
%ALLUSERSPROFILE%\Application Data\Toolbar4\{10000000-1000-1000-1000-100000000000}\descdb.bin
%PROGRAM_FILES%\IEToolbar\tool Toolbar\your_logo.bmp
%PROGRAM_FILES%\IEToolbar\tool Toolbar\whiteList_plugin.dll
%ALLUSERSPROFILE%\Application Data\Toolbar4\{10000000-1000-1000-1000-100000000000}\demo_logo.bmp
%ALLUSERSPROFILE%\Application Data\Toolbar4\{10000000-1000-1000-1000-100000000000}\basis.xml
%ALLUSERSPROFILE%\Application Data\Toolbar4\{10000000-1000-1000-1000-100000000000}\your_logo.bmp
%ALLUSERSPROFILE%\Application Data\Toolbar4\{10000000-1000-1000-1000-100000000000}\version.txt
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\0777365[1]
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\add_install[1].asp
%ALLUSERSPROFILE%\Application Data\Toolbar4\{10000000-1000-1000-1000-100000000000}\update.exe
%ALLUSERSPROFILE%\Application Data\Toolbar4\{10000000-1000-1000-1000-100000000000}\regdb.bin
%ALLUSERSPROFILE%\Application Data\Toolbar4\{10000000-1000-1000-1000-100000000000}\options.html
%ALLUSERSPROFILE%\Application Data\Toolbar4\{10000000-1000-1000-1000-100000000000}\uninstall.exe
%ALLUSERSPROFILE%\Application Data\Toolbar4\{10000000-1000-1000-1000-100000000000}\spyrem.exe
%PROGRAM_FILES%\IEToolbar\tool Toolbar\version.txt
%PROGRAM_FILES%\IEToolbar\tool Toolbar\icons.bmp
%PROGRAM_FILES%\IEToolbar\tool Toolbar\fdb.bin
%PROGRAM_FILES%\IEToolbar\tool Toolbar\microsoft.dll
%PROGRAM_FILES%\IEToolbar\tool Toolbar\info.txt
%PROGRAM_FILES%\IEToolbar\tool Toolbar\descdb.bin
%PROGRAM_FILES%\IEToolbar\tool Toolbar\antiads_plugin.dll
%PROGRAM_FILES%\IEToolbar\tool Toolbar\Index.html
%PROGRAM_FILES%\IEToolbar\tool Toolbar\demo_logo.bmp
%PROGRAM_FILES%\IEToolbar\tool Toolbar\basis.xml
%PROGRAM_FILES%\IEToolbar\tool Toolbar\tbhelper.dll
%PROGRAM_FILES%\IEToolbar\tool Toolbar\tbcore3.dll
%PROGRAM_FILES%\IEToolbar\tool Toolbar\update.exe
%PROGRAM_FILES%\IEToolbar\tool Toolbar\uninstall.exe
%PROGRAM_FILES%\IEToolbar\tool Toolbar\spyrem.exe
%PROGRAM_FILES%\IEToolbar\tool Toolbar\options.html
%PROGRAM_FILES%\IEToolbar\tool Toolbar\mimefilter.dll
%PROGRAM_FILES%\IEToolbar\tool Toolbar\regdb.bin
%PROGRAM_FILES%\IEToolbar\tool Toolbar\panicButton_plugin.dll

Удаляет следующие файлы:

%ALLUSERSPROFILE%\Application Data\Toolbar4\{10000000-1000-1000-1000-100000000000}\uninstall.exe
%ALLUSERSPROFILE%\Application Data\Toolbar4\{10000000-1000-1000-1000-100000000000}\spyrem.exe
%ALLUSERSPROFILE%\Application Data\Toolbar4\{10000000-1000-1000-1000-100000000000}\regdb.bin
%ALLUSERSPROFILE%\Application Data\Toolbar4\{10000000-1000-1000-1000-100000000000}\update.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\add_install[1].asp
%ALLUSERSPROFILE%\Application Data\Toolbar4\{10000000-1000-1000-1000-100000000000}\your_logo.bmp
%ALLUSERSPROFILE%\Application Data\Toolbar4\{10000000-1000-1000-1000-100000000000}\version.txt
%ALLUSERSPROFILE%\Application Data\Toolbar4\{10000000-1000-1000-1000-100000000000}\descdb.bin
%ALLUSERSPROFILE%\Application Data\Toolbar4\{10000000-1000-1000-1000-100000000000}\demo_logo.bmp
%ALLUSERSPROFILE%\Application Data\Toolbar4\{10000000-1000-1000-1000-100000000000}\basis.xml
%ALLUSERSPROFILE%\Application Data\Toolbar4\{10000000-1000-1000-1000-100000000000}\fdb.bin
%ALLUSERSPROFILE%\Application Data\Toolbar4\{10000000-1000-1000-1000-100000000000}\options.html
%ALLUSERSPROFILE%\Application Data\Toolbar4\{10000000-1000-1000-1000-100000000000}\info.txt
%ALLUSERSPROFILE%\Application Data\Toolbar4\{10000000-1000-1000-1000-100000000000}\icons.bmp

Сетевая активность:

Подключается к:

'www.07##365.com':80
'64.##.44.216':80
'localhost':1035

TCP:

Запросы HTTP GET:

www.07##365.com/
64.##.44.216/toolbarserver/add_install.asp?ur#############################################################################################################################

UDP: