Trojan.StartPage.55479

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'SetPageOnce' = '%PROGRAM_FILES%\EMOTIONSOFT\HomePage\HomePage.exe'

Вредоносные функции:

Создает и запускает на исполнение:

'%PROGRAM_FILES%\EMOTIONSOFT\HomePage\HomePage.exe'
'%PROGRAM_FILES%\EMOTIONSOFT\HomePage\HomePage.exe' install
'%PROGRAM_FILES%\EMOTIONSOFT\HomePage\HomePage.exe' install_setup

Запускает на исполнение:

'<SYSTEM32>\rundll32.exe' "%PROGRAM_FILES%\EMOTIONSOFT\HomePage\hl.dll",HL_InstallDll
'<SYSTEM32>\msiexec.exe' /V
'<SYSTEM32>\msiexec.exe' /i "<LS_APPDATA>\EMOTIONSOFT\HomePage\\HomePageSetup.msi" /qb

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%PROGRAM_FILES%\EMOTIONSOFT\HomePage\libexpatw.dll
%PROGRAM_FILES%\EMOTIONSOFT\HomePage\search.ico
%PROGRAM_FILES%\EMOTIONSOFT\HomePage\HomePage.exe
%PROGRAM_FILES%\EMOTIONSOFT\HomePage\sqlite3.dll
%PROGRAM_FILES%\EMOTIONSOFT\HomePage\hl64.dll
%PROGRAM_FILES%\EMOTIONSOFT\HomePage\hl.dll
%WINDIR%\Installer\MSI1.tmp
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.DATA
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING2.MAP
C:\Config.Msi\41702.rbs
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\RestorePointSize
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.MAP
%PROGRAM_FILES%\EMOTIONSOFT\HomePage\mgsearcheng.xml
%APPDATA%\Microsoft\Installer\{AD427252-C069-49F6-A0DC-C3235CF6576D}\_C80D7DB87A05741EED2343.exe
%APPDATA%\Microsoft\Installer\{AD427252-C069-49F6-A0DC-C3235CF6576D}\_308689C67FD3F050CCF1B4.exe
%ALLUSERSPROFILE%\Application Data\EMOTIONSOFT\HomePage\actions.txt
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\searchplugins\mgsearch.xml
%APPDATA%\Microsoft\Installer\{AD427252-C069-49F6-A0DC-C3235CF6576D}\_E69F5409F6C670C7E7E129.exe
%APPDATA%\Microsoft\Installer\{AD427252-C069-49F6-A0DC-C3235CF6576D}\_6E2D9F78BDAB9D22DDEEB1.exe
%HOMEPATH%\Start Menu\Programs\Home Page\Install wonderpage in browsers.lnk
%PROGRAM_FILES%\EMOTIONSOFT\HomePage\mgsearch.xml
%PROGRAM_FILES%\EMOTIONSOFT\HomePage\SafLib.dll
%HOMEPATH%\Start Menu\Programs\Home Page\Uninstall.lnk
%HOMEPATH%\Start Menu\Programs\Home Page\SetHomePage.lnk
%HOMEPATH%\Desktop\SetHomePage.lnk
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-2052111302-484763869-725345543-1003
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SECURITY
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_.DEFAULT
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\rp.log
%WINDIR%\Installer\416ff.msi
<LS_APPDATA>\EMOTIONSOFT\HomePage\HomePageSetup.msi
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SOFTWARE
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.BTR
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\$WinMgmt.CFG
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING1.MAP
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING.VER
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.MAP
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\ComDb.Dat
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SAM
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SYSTEM
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP15\drivetable.txt
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\drivetable.txt
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\domain.txt