Trojan.StartPage.48307

Техническая информация

Вредоносные функции:

Создает и запускает на исполнение:

%PROGRAM_FILES%\Acala 3GP Movies FileBulldog Toolbar\TbHelper2.exe -Embedding
%PROGRAM_FILES%\Acala 3GP Movies FileBulldog Toolbar\TbHelper2.exe -RegServer
%TEMP%\acala3gp-local.exe /S /affid=acala3gp /guid={CBF44387-C1FC-4267-84E1-3A71C72A0EDE} /nokill /abortonexisting /afterinstall=""

Запускает на исполнение:

<SYSTEM32>\regsvr32.exe /s "%PROGRAM_FILES%\Acala 3GP Movies FileBulldog Toolbar\tbcore3.dll"
<SYSTEM32>\regsvr32.exe /s "%PROGRAM_FILES%\Acala 3GP Movies FileBulldog Toolbar\TbCommonUtils.dll"
<SYSTEM32>\taskkill.exe /F /IM rssclient.exe
<SYSTEM32>\taskkill.exe /F /IM tbhelper.exe

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%PROGRAM_FILES%\Acala 3GP Movies FileBulldog Toolbar\UninstallToolbar.exe
%TEMP%\nss8.tmp
%PROGRAM_FILES%\Acala 3GP Movies FileBulldog Toolbar\icons.bmp
%PROGRAM_FILES%\Acala 3GP Movies FileBulldog Toolbar\tbcore3.inf
%APPDATA%\Toolbar4\{338B4DFE-2E2C-4338-9E41-E176D497299E}\affid.dat
%APPDATA%\Toolbar4\{338B4DFE-2E2C-4338-9E41-E176D497299E}\basis.xml
%TEMP%\nsb9.tmp
%TEMP%\nsk7.tmp\NSISpcre.dll
%PROGRAM_FILES%\Acala 3GP Movies FileBulldog Toolbar\KeywordsPlugin.dll
%PROGRAM_FILES%\Acala 3GP Movies FileBulldog Toolbar\CustomTabPage.dll
%PROGRAM_FILES%\Acala 3GP Movies FileBulldog Toolbar\mbback.bmp
%PROGRAM_FILES%\Acala 3GP Movies FileBulldog Toolbar\somoto.dll
%PROGRAM_FILES%\Acala 3GP Movies FileBulldog Toolbar\affid.dat
%PROGRAM_FILES%\Acala 3GP Movies FileBulldog Toolbar\info.txt
%PROGRAM_FILES%\Acala 3GP Movies FileBulldog Toolbar\update.exe
%PROGRAM_FILES%\Acala 3GP Movies FileBulldog Toolbar\uninstall.exe
%APPDATA%\Toolbar4\{338B4DFE-2E2C-4338-9E41-E176D497299E}\icons.bmp
%APPDATA%\Toolbar4\{338B4DFE-2E2C-4338-9E41-E176D497299E}\uninstall.exe
%APPDATA%\Toolbar4\{338B4DFE-2E2C-4338-9E41-E176D497299E}\UninstallToolbar.exe
%APPDATA%\Toolbar4\{338B4DFE-2E2C-4338-9E41-E176D497299E}\tbcore3.inf
%APPDATA%\Toolbar4\{338B4DFE-2E2C-4338-9E41-E176D497299E}\TbHelper2.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\complete[1].htm
%TEMP%\InstallComplete
%APPDATA%\Toolbar4\{338B4DFE-2E2C-4338-9E41-E176D497299E}\update.exe
%APPDATA%\Toolbar4\{338B4DFE-2E2C-4338-9E41-E176D497299E}\version.txt
%APPDATA%\Toolbar4\{338B4DFE-2E2C-4338-9E41-E176D497299E}\mbback.bmp
%APPDATA%\Toolbar4\{338B4DFE-2E2C-4338-9E41-E176D497299E}\mbbigopen.bmp
%APPDATA%\Toolbar4\{338B4DFE-2E2C-4338-9E41-E176D497299E}\info.txt
%APPDATA%\Toolbar4\{338B4DFE-2E2C-4338-9E41-E176D497299E}\install.ico
%APPDATA%\Toolbar4\{338B4DFE-2E2C-4338-9E41-E176D497299E}\mbsep.bmp
%APPDATA%\Toolbar4\{338B4DFE-2E2C-4338-9E41-E176D497299E}\nav1c.bmp
%APPDATA%\Toolbar4\{338B4DFE-2E2C-4338-9E41-E176D497299E}\mbclose.bmp
%APPDATA%\Toolbar4\{338B4DFE-2E2C-4338-9E41-E176D497299E}\mbfwd.bmp
%TEMP%\InstallQuit
%TEMP%\acala3gp-local.exe
%TEMP%\xx.ini
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\quit[1].htm
%TEMP%\nsk7.tmp\icon_magnifier.bmp
%TEMP%\nsk7.tmp\icon_money.bmp
%TEMP%\nsp6.tmp
%TEMP%\nsk7.tmp\icon_house.bmp
%TEMP%\nsz3.tmp\inetc.dll
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\getCountry[1]
%TEMP%\nsu2.tmp
%TEMP%\nsz3.tmp\System.dll
%TEMP%\nsz3.tmp\md5dll.dll
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\execution_arguments[1].htm
%TEMP%\getCountry
%TEMP%\nsi4.tmp
%TEMP%\nsk7.tmp\System.dll
%PROGRAM_FILES%\Acala 3GP Movies FileBulldog Toolbar\alert_plugin.dll
%PROGRAM_FILES%\Acala 3GP Movies FileBulldog Toolbar\nav1c.bmp
%PROGRAM_FILES%\Acala 3GP Movies FileBulldog Toolbar\TbCommonUtils.dll
%PROGRAM_FILES%\Acala 3GP Movies FileBulldog Toolbar\MacroParserPlugin.dll
%PROGRAM_FILES%\Acala 3GP Movies FileBulldog Toolbar\mbclose.bmp
%PROGRAM_FILES%\Acala 3GP Movies FileBulldog Toolbar\mbbigopen.bmp
%PROGRAM_FILES%\Acala 3GP Movies FileBulldog Toolbar\mbsep.bmp
%PROGRAM_FILES%\Acala 3GP Movies FileBulldog Toolbar\mbfwd.bmp
%TEMP%\nsk7.tmp\CabDLL.dll
%PROGRAM_FILES%\Acala 3GP Movies FileBulldog Toolbar\tbcore3.dll
%PROGRAM_FILES%\Acala 3GP Movies FileBulldog Toolbar\install.ico
%TEMP%\ietb.cab
%PROGRAM_FILES%\Acala 3GP Movies FileBulldog Toolbar\tbhelper.dll
%PROGRAM_FILES%\Acala 3GP Movies FileBulldog Toolbar\TbHelper2.exe
%PROGRAM_FILES%\Acala 3GP Movies FileBulldog Toolbar\basis.xml
%PROGRAM_FILES%\Acala 3GP Movies FileBulldog Toolbar\version.txt