Trojan.StartPage.35767

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'PCGenius' = '"%PROGRAM_FILES%\PCGenius\PCGenius.exe" /start'

Вредоносные функции:

Создает и запускает на исполнение:

%PROGRAM_FILES%\PCGenius\PCGenius.exe /WebApp

Запускает на исполнение:

%WINDIR%\regedit.exe /s "%PROGRAM_FILES%\PCGenius\Config\SetIndex.reg"

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%PROGRAM_FILES%\PCGenius\PCGApp\WebApp\УРµАґКµд.ico
%PROGRAM_FILES%\PCGenius\PCGApp\WebApp\ФЪПЯPS.ico
%PROGRAM_FILES%\PCGenius\PCGApp\WebApp\НјСѕСѕ.ico
%PROGRAM_FILES%\PCGenius\PCGApp\WebApp\ТфФГМЁ.ico
%PROGRAM_FILES%\PCGenius\PCGApp\WebApp\ФЪПЯµШНј.ico
%PROGRAM_FILES%\PCGenius\PCGApp\WebGame\defaul.ico
%PROGRAM_FILES%\PCGenius\PCGApp\WebShop\360buy.ico
%PROGRAM_FILES%\PCGenius\PCGApp\WebApp\ХЛЧејЗХЛ.ico
%PROGRAM_FILES%\PCGenius\PCGApp\WebGame\config.txt
%PROGRAM_FILES%\PCGenius\PCGApp\WebApp\ГАНјРгРг.ico
%PROGRAM_FILES%\PCGenius\PCGApp\WebApp\ЖжТХ.ico
%PROGRAM_FILES%\PCGenius\PCGApp\WebApp\»ріµ»ъЖ±.ico
%PROGRAM_FILES%\PCGenius\PCGApp\WebApp\ГАИЭ№ЛОК.ico
%PROGRAM_FILES%\PCGenius\PCGApp\WebApp\ИЛИЛµзМЁ.ico
%PROGRAM_FILES%\PCGenius\PCGApp\WebApp\КЦ»ъідЦµ.ico
%PROGRAM_FILES%\PCGenius\PCGApp\WebApp\МмЖшФ¤±Ё.ico
%PROGRAM_FILES%\PCGenius\PCGApp\WebApp\ИХАъ.ico
%PROGRAM_FILES%\PCGenius\PCGApp\WebApp\КФТВјд.ico
%PROGRAM_FILES%\PCGenius\PCGApp\WebSoft\config.txt
%PROGRAM_FILES%\PCGenius\PCGApp\WebSoft\defaul.ico
%PROGRAM_FILES%\PCGenius\PCGApp\WebShop\ЧїФЅНш.ico
%PROGRAM_FILES%\PCGenius\PCGApp\WebSoft\PPSНшКУ.ico
%PROGRAM_FILES%\PCGenius\UserData\CustomUrls.txt
%PROGRAM_FILES%\PCGenius\UserData\AppleIOS\DaysMatter.txt
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\001[1].htm
%HOMEPATH%\Start Menu\Programs\PCЙПНшѕ«Бй\Р¶ФШPCЙПНшѕ«Бй.lnk
%PROGRAM_FILES%\PCGenius\uninst.exe
%PROGRAM_FILES%\PCGenius\PCGApp\WebShop\defaul.ico
%PROGRAM_FILES%\PCGenius\PCGApp\WebShop\µ±µ±Нш.ico
%PROGRAM_FILES%\PCGenius\PCGApp\WebShop\Thumbs.db
%PROGRAM_FILES%\PCGenius\PCGApp\WebShop\config.txt
%PROGRAM_FILES%\PCGenius\PCGApp\WebShop\їмµЭІйСЇ.ico
%PROGRAM_FILES%\PCGenius\PCGApp\WebShop\МФ±¦»К№Ъ.ico
%PROGRAM_FILES%\PCGenius\PCGApp\WebShop\МФ±¦ЙМіЗ.ico
%PROGRAM_FILES%\PCGenius\PCGApp\WebShop\ВуїјБЦ.ico
%PROGRAM_FILES%\PCGenius\PCGApp\WebShop\МФ±¦.ico
%PROGRAM_FILES%\PCGenius\PCGApp\WebApp\·п»ЛКУЖµ.ico
%HOMEPATH%\Start Menu\Programs\PCЙПНшѕ«Бй\±ёНьВј.lnk
%HOMEPATH%\Desktop\PCЙПНшѕ«Бй.lnk
%HOMEPATH%\Start Menu\Programs\PCЙПНшѕ«Бй\¶ЁК±№Ш»ъ.lnk
%HOMEPATH%\Start Menu\Programs\PCЙПНшѕ«Бй\Days Matter.lnk
%HOMEPATH%\Desktop\МФ!ОТПІ»¶.lnk
%PROGRAM_FILES%\PCGenius\Config\SearchAndMusicVer.txt
%PROGRAM_FILES%\PCGenius\Config\SearchList.txt
%PROGRAM_FILES%\PCGenius\Config\PcGenius.ini
%PROGRAM_FILES%\PCGenius\Config\Search.txt
%PROGRAM_FILES%\PCGenius\PCGWebApp.exe
%HOMEPATH%\Start Menu\PCЙПНшѕ«Бй.lnk
%TEMP%\nst2.tmp
%PROGRAM_FILES%\PCGenius\PCGenius.exe
%HOMEPATH%\Start Menu\Programs\PCЙПНшѕ«Бй\PCЙПНшѕ«Бй.lnk
%HOMEPATH%\Start Menu\Programs\PCЙПНшѕ«Бй\ТфАЦєР.lnk
%HOMEPATH%\Start Menu\Programs\PCЙПНшѕ«Бй\№¤ѕЯПд.lnk
%HOMEPATH%\Start Menu\Programs\PCЙПНшѕ«Бй\У¦УГ±¦їв.lnk
%HOMEPATH%\Start Menu\Programs\PCЙПНшѕ«Бй\МФ!ОТПІ»¶.lnk
%PROGRAM_FILES%\PCGenius\PCGApp\WebApp\PPTVѕзіЎ.ico
%PROGRAM_FILES%\PCGenius\PCGApp\WebApp\PPTVЧЫТХ.ico
%PROGRAM_FILES%\PCGenius\Pages\TG.htm
%PROGRAM_FILES%\PCGenius\PCGApp\WebApp\PPTVµзУ°.ico
%PROGRAM_FILES%\PCGenius\PCGApp\WebApp\Thumbs.db
%PROGRAM_FILES%\PCGenius\PCGApp\WebApp\defaul.ico
%PROGRAM_FILES%\PCGenius\PCGApp\WebApp\¶№°кµзМЁ.ico
%PROGRAM_FILES%\PCGenius\PCGApp\WebApp\WebQQ.ico
%PROGRAM_FILES%\PCGenius\PCGApp\WebApp\config.txt
%PROGRAM_FILES%\PCGenius\Pages\CX.htm
%PROGRAM_FILES%\PCGenius\Pages\DH.htm
%PROGRAM_FILES%\PCGenius\Config\SetIndex.reg
%PROGRAM_FILES%\PCGenius\Config\WebMusicList.txt
%PROGRAM_FILES%\PCGenius\Pages\GW.htm
%PROGRAM_FILES%\PCGenius\Pages\SY.htm
%PROGRAM_FILES%\PCGenius\Pages\TB.htm
%PROGRAM_FILES%\PCGenius\Pages\PagesVer.txt
%PROGRAM_FILES%\PCGenius\Pages\RJ.htm