Trojan.StartPage1.14077

Техническая информация

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\xcopy.exe' /S /Y /i "Mozilla" "C:\Documents and Settings\Default User\Application Data\Mozilla"
'<SYSTEM32>\xcopy.exe' /S /Y /i "Google" "C:\Documents and Settings\Default User\Local Settings\Application Data\Google"
'<SYSTEM32>\xcopy.exe' /S /Y /i "%PROGRAM_FILES%\Yaimo\searchplugins" searchplugins
'<SYSTEM32>\sc.exe' stop CltMngSvc
'<SYSTEM32>\sc.exe' config CltMngSvc start= disabled

Завершает или пытается завершить

следующие пользовательские процессы:

chrome.exe
firefox.exe

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\cwdgt0y8.default\places.sqlite
C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\cwdgt0y8.default\permissions.sqlite
C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\cwdgt0y8.default\pluginreg.dat
C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\cwdgt0y8.default\search.json
C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\cwdgt0y8.default\prefs.js
C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\cwdgt0y8.default\mimeTypes.rdf
C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions.sqlite
C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions.ini
C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\cwdgt0y8.default\formhistory.sqlite
C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\cwdgt0y8.default\localstore.rdf
C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\cwdgt0y8.default\key3.db
C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\userChrome-example.css
C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\cwdgt0y8.default\bookmarkbackups\bookmarks-2011-11-10.json
C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\userContent-example.css
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\userChrome.css
C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\cwdgt0y8.default\searchplugins\yaimo.xml
C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\cwdgt0y8.default\webappsstore.sqlite
C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\cwdgt0y8.default\secmod.db
C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\cwdgt0y8.default\search.sqlite
C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\cwdgt0y8.default\sessionstore.bak
C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\cwdgt0y8.default\signons.sqlite
C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\cwdgt0y8.default\sessionstore.js
C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\cwdgt0y8.default\downloads.sqlite
%PROGRAM_FILES%\Yaimo\jgapnhijgmmehljdkfkojcoefcddinjl\1.0_9\yaimo48.jpg
%PROGRAM_FILES%\Yaimo\jgapnhijgmmehljdkfkojcoefcddinjl\1.0_9\yaimo16.jpg
%PROGRAM_FILES%\Yaimo\jgapnhijgmmehljdkfkojcoefcddinjl\1.0_9\yaimo128.jpg
<SYSTEM32>\w16Bq3eezlSVhbrqKorM.exe
%PROGRAM_FILES%\Yaimo\BCPQCI0Bq5y9YWXMNJuY.exe
%PROGRAM_FILES%\Yaimo\jgapnhijgmmehljdkfkojcoefcddinjl\1.0_9\yaimo.jpg
%PROGRAM_FILES%\Yaimo\jgapnhijgmmehljdkfkojcoefcddinjl\1.0_9\manifest.json
%PROGRAM_FILES%\Yaimo\yaimo.crx
%PROGRAM_FILES%\Yaimo\jgapnhijgmmehljdkfkojcoefcddinjl\1.0_9\newtab.html
%PROGRAM_FILES%\Yaimo\jgapnhijgmmehljdkfkojcoefcddinjl\1.0_9\script.js
%PROGRAM_FILES%\Yaimo\jgapnhijgmmehljdkfkojcoefcddinjl\1.0_9\newtab.js
C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\cwdgt0y8.default\compatibility.ini
C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\cwdgt0y8.default\chromeappsstore.sqlite
C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\cwdgt0y8.default\content-prefs.sqlite
%PROGRAM_FILES%\Yaimo\bsp
C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\cwdgt0y8.default\cookies.sqlite
C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\cwdgt0y8.default\cert8.db
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\searchplugins\yaimo.xml
%PROGRAM_FILES%\Yaimo\searchplugins\yaimo.xml
%PROGRAM_FILES%\Yaimo\gafgmes.exe
C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\cwdgt0y8.default\bookmarks.html
C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\profiles.ini