Trojan.StartPage.49097

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Classes\cmdfile\shell\open\command] '' = '"%1" %*'
[<HKLM>\SOFTWARE\Classes\comfile\shell\open\command] '' = '"%1" %*'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'WebScan' = '%PROGRAM_FILES%\Acceleration Software\Anti-Virus\DEFSCA~1.EXE -k'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'WebScan' = '%PROGRAM_FILES%\Acceleration Software\Anti-Virus\defscangui.exe -k'
[<HKLM>\SOFTWARE\Classes\batfile\shell\open\command] '' = '"%1" %*'
[<HKLM>\SOFTWARE\Classes\regfile\shell\open\command] '' = 'regedit.exe "%1"'
[<HKLM>\SOFTWARE\Classes\exefile\shell\open\command] '' = '"%1" %*'
[<HKLM>\SOFTWARE\Classes\scrfile\shell\open\command] '' = '"%1" /S'
[<HKLM>\SOFTWARE\Classes\piffile\shell\open\command] '' = '"%1" %*'

Вредоносные функции:

Создает и запускает на исполнение:

%PROGRAM_FILES%\Acceleration Software\Anti-Virus\defscangui.exe /RegServer
%PROGRAM_FILES%\Acceleration Software\Anti-Virus\defscangui.exe Software\Anti-Virus\DEFSCA~1.EXE -startmin
%PROGRAM_FILES%\Acceleration Software\Anti-Virus\defscangui.exe Software\Anti-Virus\DEFSCA~1.EXE -k
%TEMP%\EAC2211530672_00000000\regsvr32.exe /s "%PROGRAM_FILES%\Acceleration Software\Anti-Virus\dsshell.dll"
%TEMP%\EAC2211530672_00000000\setup.exe /Cmd <Полный путь к вирусу> <Полный путь к вирусу>
%TEMP%\EAC2211530672_00000000\regsvr32.exe /s "%PROGRAM_FILES%\Acceleration Software\Anti-Virus\scancore.dll"
%TEMP%\EAC2211530672_00000000\regsvr32.exe /s "%PROGRAM_FILES%\Acceleration Software\Anti-Virus\eac_mindef.dll"
%TEMP%\EANTHM~1.EXE (загружен из сети Интернет)

Изменения в файловой системе:

Создает следующие файлы:

%PROGRAM_FILES%\Acceleration Software\Anti-Virus\exp_head01.gif
%PROGRAM_FILES%\Acceleration Software\Anti-Virus\exp_head02.gif
%PROGRAM_FILES%\Acceleration Software\Anti-Virus\skins.ini
%PROGRAM_FILES%\Acceleration Software\Anti-Virus\sc_mail.gif
%PROGRAM_FILES%\Acceleration Software\Anti-Virus\sc_firewall.gif
%PROGRAM_FILES%\Acceleration Software\Anti-Virus\sc_baseline.gif
%PROGRAM_FILES%\Acceleration Software\Anti-Virus\ealook.dll
%PROGRAM_FILES%\Acceleration Software\Anti-Virus\scancore.dll.chk
%PROGRAM_FILES%\Acceleration Software\Anti-Virus\ws_uninst.exe
%PROGRAM_FILES%\Acceleration Software\Anti-Virus\defscangui.exe
%PROGRAM_FILES%\Acceleration Software\Anti-Virus\shexclude.dat
%PROGRAM_FILES%\Acceleration Software\Anti-Virus\clnrchk.dat
%PROGRAM_FILES%\Acceleration Software\Anti-Virus\stop-sign_icon03.gif
%PROGRAM_FILES%\Acceleration Software\Anti-Virus\sc_spam.gif
%ALLUSERSPROFILE%\Start Menu\Programs\eAcceleration\Stop-Sign\Start Scan.lnk
%HOMEPATH%\Desktop\Scan Now for Viruses and Threats.lnk
%PROGRAM_FILES%\Acceleration Software\Anti-Virus\dsshell.dll
%TEMP%\eanthmngr_update.exe
%ALLUSERSPROFILE%\Start Menu\Programs\eAcceleration\Stop-Sign\Threat Cleaner.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\eAcceleration\Stop-Sign\Threat Scanner Settings.lnk
%PROGRAM_FILES%\Acceleration Software\Anti-Virus\eac_mindef.dll
%PROGRAM_FILES%\Acceleration Software\Anti-Virus\lspfix.txt
%PROGRAM_FILES%\Acceleration Software\Anti-Virus\lspfix.exe
%PROGRAM_FILES%\Acceleration Software\Anti-Virus\cure_rslt01.gif
%PROGRAM_FILES%\Acceleration Software\Anti-Virus\scancore.dll
%PROGRAM_FILES%\Acceleration Software\Anti-Virus\xprestore.vbs
%PROGRAM_FILES%\Acceleration Software\Anti-Virus\restore_instructions.txt
%TEMP%\EAC2211530672_00000000\dsshell.dll
%TEMP%\EAC2211530672_00000000\clnrchk.dat
%TEMP%\EAC2211530672_00000000\stop-sign_icon03.gif
%TEMP%\EAC2211530672_00000000\shexclude.dat
%TEMP%\EAC2211530672_00000000\InstRvn.exe
%TEMP%\EAC2211530672_00000000\comp.chk
%TEMP%\EAC2211530672_00000000\eac_mindef.dll
%TEMP%\EAC2211530672_00000000\scancore.dll
%TEMP%\EAC2211530672_00000000\defscangui.exe
%TEMP%\EAC2211530672_00000000\setup.ini
%TEMP%\EAC2211530672_00000000\setup.exe
%TEMP%\EAC2211530672_00000000\ws_uninst.exe
%TEMP%\EAC2211530672_00000000\regsvr32.exe
%TEMP%\EAC2211530672_00000000\ealook.dll
%TEMP%\EAC2211530672_00000000\lspfix.txt
%TEMP%\EAC2211530672_00000000\lspfix.exe
%TEMP%\EAC2211530672_00000000\cure_rslt01.gif
%PROGRAM_FILES%\Acceleration Software\Anti-Virus\regsvr32.exe
%TEMP%\EAC2211530672_00000000\xprestore.vbs
%TEMP%\EAC2211530672_00000000\restore_instructions.txt
%TEMP%\EAC2211530672_00000000\sc_spam.gif
%TEMP%\EAC2211530672_00000000\exp_head01.gif
%TEMP%\EAC2211530672_00000000\exp_head02.gif
%TEMP%\EAC2211530672_00000000\skins.ini
%TEMP%\EAC2211530672_00000000\sc_mail.gif
%TEMP%\EAC2211530672_00000000\sc_firewall.gif
%TEMP%\EAC2211530672_00000000\sc_baseline.gif