Trojan.StartPage.56358

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Classes\asdffile\shell\open\command] '' = '"%CommonProgramFiles%\cgyguard.exe" "%1"'

Создает или изменяет следующие файлы:

%HOMEPATH%\Start Menu\Programs\Startup\NetTV.lnk

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\Kingsoft Antivirus WebShield Service] 'Start' = '00000002'

Вредоносные функции:

Создает и запускает на исполнение:

'%WINDIR%\kingsoftv\KSWebShield.exe' -install
'%TEMP%\is-KIECN.tmp\vip.tmp' /SL5="$100FC,912334,51712,%PROGRAM_FILES%\vip.exe" /sp- /silent /norestart /verysilent
'%WINDIR%\kingsoftv\KSWebShield.exe' -start
'%CommonProgramFiles%\FunshionInstall_C8776.exe'
'%WINDIR%\kingsoftv\KSWebShield.exe'
'%CommonProgramFiles%\cgyiesuo.exe'
'%CommonProgramFiles%\deskop.exe'
'%CommonProgramFiles%\cgyplay.exe'
'%PROGRAM_FILES%\vip.exe'
'%CommonProgramFiles%\AboutUs.exe'
'%CommonProgramFiles%\FunshionInstall_C8776.exe' (загружен из сети Интернет)

Внедряет код в

следующие системные процессы:

<SYSTEM32>\winlogon.exe

Изменения в файловой системе:

Создает следующие файлы:

%WINDIR%\kingsoftv\is-5J5TB.tmp
%WINDIR%\kingsoftv\is-IR4GR.tmp
%HOMEPATH%\Desktop\ёЯЗеУ°КУІҐ·ЕЖч.lnk
%WINDIR%\kingsoftv\is-2P734.tmp
%WINDIR%\kingsoftv\is-RHV68.tmp
%WINDIR%\kingsoftv\is-EAM94.tmp
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\УОП·.url.url
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\Ч¬З®ПоДї.url
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\ЅЎїµmmНш.url
%TEMP%\is-2V30P.tmp\_isetup\_shfoldr.dll
%TEMP%\is-2V30P.tmp\_isetup\_RegDLL.tmp
%TEMP%\is-KIECN.tmp\vip.tmp
%ALLUSERSPROFILE%\Application Data\kingsoft\kws\urlcache.dat
%ALLUSERSPROFILE%\Application Data\kingsoft\kws\kws.ini
%ALLUSERSPROFILE%\Application Data\kingsoft\kws\spitesp.dat
%CommonProgramFiles%\FunshionInstall_C8776.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\download[1].php
%TEMP%\is-2V30P.tmp\is-N3H6N.tmp
%TEMP%\is-2V30P.tmp\is-53KGJ.tmp
%WINDIR%\kingsoftv\is-QUVBR.tmp
%WINDIR%\kingsoftv\KWSSVC.log
%WINDIR%\kingsoftv\unins000.dat
%ALLUSERSPROFILE%\Application Data\kingsoft\kws\is-2K7CG.tmp
%PROGRAM_FILES%\InccconetTV\Icons\Ч¬З®ПоДї.ico
%PROGRAM_FILES%\InccconetTV\Icons\°Щ¶И.ico
%CommonProgramFiles%\cgyguard.exe
%PROGRAM_FILES%\InccconetTV\Icons\УОП·.ico
%PROGRAM_FILES%\InccconetTV\Icons\МФ±¦.ico
%PROGRAM_FILES%\InccconetTV\Icons\Google.ico
%CommonProgramFiles%\deskop.exe
%PROGRAM_FILES%\InccconetTV\cgyset.exe
%CommonProgramFiles%\CigInf.ini
%CommonProgramFiles%\AboutUs.exe
%CommonProgramFiles%\cgyiesuo.exe
%CommonProgramFiles%\cgyplay.exe
%HOMEPATH%\Favorites\УОП·.url.url
%HOMEPATH%\Favorites\Ч¬З®ПоДї.url
%PROGRAM_FILES%\vip.exe
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\МФ±¦.url
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\Google.url
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\°Щ¶И.url
%HOMEPATH%\Favorites\°Щ¶И.url
%PROGRAM_FILES%\InccconetTV\Icons\ЅЎїµ.ico
%PROGRAM_FILES%\InccconetTV\Icons\IE.ico
%HOMEPATH%\Favorites\ЅЎїµmmНш.url
%HOMEPATH%\Favorites\МФ±¦.url
%HOMEPATH%\Favorites\Google.url

Удаляет следующие файлы:

%PROGRAM_FILES%\InccconetTV\Icons\ЅЎїµ.ico.tmp
%PROGRAM_FILES%\vip.exe
%PROGRAM_FILES%\InccconetTV\Icons\ЅЎїµ.ico
%PROGRAM_FILES%\InccconetTV\Icons\IE.ico
%PROGRAM_FILES%\InccconetTV\Icons\IE.ico.tmp
%TEMP%\is-2V30P.tmp\_isetup\_shfoldr.dll
%TEMP%\is-KIECN.tmp\vip.tmp
%TEMP%\is-2V30P.tmp\_isetup\_RegDLL.tmp
%TEMP%\is-2V30P.tmp\time.dll
%TEMP%\is-2V30P.tmp\nsExec.dll
%PROGRAM_FILES%\InccconetTV\Icons\Ч¬З®ПоДї.ico.tmp
%PROGRAM_FILES%\InccconetTV\Icons\Google.ico
%PROGRAM_FILES%\InccconetTV\Icons\Ч¬З®ПоДї.ico
%PROGRAM_FILES%\InccconetTV\Icons\°Щ¶И.ico
%PROGRAM_FILES%\InccconetTV\Icons\°Щ¶И.ico.tmp
%PROGRAM_FILES%\InccconetTV\Icons\УОП·.ico
%PROGRAM_FILES%\InccconetTV\Icons\УОП·.ico.tmp
%PROGRAM_FILES%\InccconetTV\Icons\МФ±¦.ico.tmp
%PROGRAM_FILES%\InccconetTV\Icons\Google.ico.tmp
%PROGRAM_FILES%\InccconetTV\Icons\МФ±¦.ico

Перемещает следующие файлы:

%TEMP%\is-2V30P.tmp\is-53KGJ.tmp в %TEMP%\is-2V30P.tmp\time.dll
%WINDIR%\kingsoftv\is-QUVBR.tmp в %WINDIR%\kingsoftv\kwsui.dll
%ALLUSERSPROFILE%\Application Data\kingsoft\kws\is-2K7CG.tmp в %ALLUSERSPROFILE%\Application Data\kingsoft\kws\kws.ini
%TEMP%\is-2V30P.tmp\is-N3H6N.tmp в %TEMP%\is-2V30P.tmp\nsExec.dll
%WINDIR%\kingsoftv\is-2P734.tmp в %WINDIR%\kingsoftv\kwssp.dll
%WINDIR%\kingsoftv\is-5J5TB.tmp в %WINDIR%\kingsoftv\KSWBC.dll
%WINDIR%\kingsoftv\is-IR4GR.tmp в %WINDIR%\kingsoftv\unins000.exe
%WINDIR%\kingsoftv\is-RHV68.tmp в %WINDIR%\kingsoftv\KSWebShield.exe
%WINDIR%\kingsoftv\is-EAM94.tmp в %WINDIR%\kingsoftv\kswebshield.dll

Сетевая активность:

Подключается к: