Trojan.AVKill.12729

Техническая информация

Вредоносные функции:

Запускает на исполнение:

<SYSTEM32>\regsvr32.exe /s "%PROGRAM_FILES%\ShopAtHome\tbcore3U.dll"

Завершает или пытается завершить

следующие пользовательские процессы:

iexplore.exe

Изменения в файловой системе:

Создает следующие файлы:

%APPDATA%\ShopAtHomeToolbar\{311B58DC-A4DC-4B04-B1B5-60299AD3D803}\ClearHist.exe
%APPDATA%\ShopAtHomeToolbar\{311B58DC-A4DC-4B04-B1B5-60299AD3D803}\icons.bmp
%ALLUSERSPROFILE%\Start Menu\Programs\ShopAtHome.com Toolbar\ShopAtHome.com Homepage.url
%APPDATA%\ShopAtHomeToolbar\{311B58DC-A4DC-4B04-B1B5-60299AD3D803}\basis.xml
%APPDATA%\ShopAtHomeToolbar\{311B58DC-A4DC-4B04-B1B5-60299AD3D803}\Merchants.xml
%APPDATA%\ShopAtHomeToolbar\{311B58DC-A4DC-4B04-B1B5-60299AD3D803}\Prefs.xml
%APPDATA%\ShopAtHomeToolbar\{311B58DC-A4DC-4B04-B1B5-60299AD3D803}\IE8GuardWorkaround.exe
%APPDATA%\ShopAtHomeToolbar\{311B58DC-A4DC-4B04-B1B5-60299AD3D803}\logo.png
%PROGRAM_FILES%\ShopAtHome\sahtb-information.png
%PROGRAM_FILES%\ShopAtHome\sahtb-options.png
%PROGRAM_FILES%\ShopAtHome\sahtb-comment.png
%PROGRAM_FILES%\ShopAtHome\sahtb-clearsearch.png
%PROGRAM_FILES%\ShopAtHome\ShopAtHomeUninstall.exe
%ALLUSERSPROFILE%\Start Menu\Programs\ShopAtHome.com Toolbar\ShopAtHome.com Uninstall.lnk
%PROGRAM_FILES%\ShopAtHome\SAH_favicon.ico
%PROGRAM_FILES%\ShopAtHome\version.txt
%APPDATA%\ShopAtHomeToolbar\{311B58DC-A4DC-4B04-B1B5-60299AD3D803}\sahtb-options.png
%APPDATA%\ShopAtHomeToolbar\{311B58DC-A4DC-4B04-B1B5-60299AD3D803}\sahtb-restaurant.png
%APPDATA%\ShopAtHomeToolbar\{311B58DC-A4DC-4B04-B1B5-60299AD3D803}\sahtb-information.png
%APPDATA%\ShopAtHomeToolbar\{311B58DC-A4DC-4B04-B1B5-60299AD3D803}\sahtb-mysah.png
%APPDATA%\ShopAtHomeToolbar\{311B58DC-A4DC-4B04-B1B5-60299AD3D803}\TbHelper2.exe
%APPDATA%\ShopAtHomeToolbar\{311B58DC-A4DC-4B04-B1B5-60299AD3D803}\uninstall.exe
%APPDATA%\ShopAtHomeToolbar\{311B58DC-A4DC-4B04-B1B5-60299AD3D803}\SAH_favicon.ico
%APPDATA%\ShopAtHomeToolbar\{311B58DC-A4DC-4B04-B1B5-60299AD3D803}\ShopAtHomeUninstall.exe
%APPDATA%\ShopAtHomeToolbar\{311B58DC-A4DC-4B04-B1B5-60299AD3D803}\sahtb-comment.png
%APPDATA%\ShopAtHomeToolbar\{311B58DC-A4DC-4B04-B1B5-60299AD3D803}\sahtb-contests.png
%APPDATA%\ShopAtHomeToolbar\{311B58DC-A4DC-4B04-B1B5-60299AD3D803}\sahtb-alert.png
%APPDATA%\ShopAtHomeToolbar\{311B58DC-A4DC-4B04-B1B5-60299AD3D803}\sahtb-clearsearch.png
%APPDATA%\ShopAtHomeToolbar\{311B58DC-A4DC-4B04-B1B5-60299AD3D803}\sahtb-go.png
%APPDATA%\ShopAtHomeToolbar\{311B58DC-A4DC-4B04-B1B5-60299AD3D803}\sahtb-grocerycoupons.png
%APPDATA%\ShopAtHomeToolbar\{311B58DC-A4DC-4B04-B1B5-60299AD3D803}\sahtb-freecoupons.png
%APPDATA%\ShopAtHomeToolbar\{311B58DC-A4DC-4B04-B1B5-60299AD3D803}\sahtb-freesamples.png
%PROGRAM_FILES%\ShopAtHome\ClearHist.exe
%PROGRAM_FILES%\ShopAtHome\IE8GuardWorkaround.exe
%TEMP%\nsk4.tmp
%TEMP%\nsi3.tmp\System.dll
%PROGRAM_FILES%\ShopAtHome\HttpHandle302.dll
%PROGRAM_FILES%\ShopAtHome\tbcore3U.dll
%TEMP%\nsi3.tmp\KillProcDLL.dll
%PROGRAM_FILES%\ShopAtHome\TbCommonUtils.dll
%TEMP%\nsi3.tmp\splash.bmp
%TEMP%\nsi3.tmp\AdvSplash.dll
%TEMP%\nsh2.tmp
%TEMP%\nsi3.tmp\HTTPHelper.dll
%TEMP%\nsi3.tmp\UserInfo.dll
%PROGRAM_FILES%\ShopAtHome\Prefs.xml
%TEMP%\nsi3.tmp\modern-header.bmp
%TEMP%\nsi3.tmp\modern-wizard.bmp
%PROGRAM_FILES%\ShopAtHome\sahtb-freecoupons.png
%PROGRAM_FILES%\ShopAtHome\sahtb-freesamples.png
%PROGRAM_FILES%\ShopAtHome\sahtb-alert.png
%PROGRAM_FILES%\ShopAtHome\sahtb-contests.png
%PROGRAM_FILES%\ShopAtHome\sahtb-restaurant.png
%PROGRAM_FILES%\ShopAtHome\sahtb-mysah.png
%PROGRAM_FILES%\ShopAtHome\sahtb-go.png
%PROGRAM_FILES%\ShopAtHome\sahtb-grocerycoupons.png
%PROGRAM_FILES%\ShopAtHome\uninstall.exe
%PROGRAM_FILES%\ShopAtHome\update.exe
%PROGRAM_FILES%\ShopAtHome\TbHelper2.exe
%PROGRAM_FILES%\ShopAtHome\tbhelper.dll
%PROGRAM_FILES%\ShopAtHome\icons.bmp
%PROGRAM_FILES%\ShopAtHome\logo.png
%PROGRAM_FILES%\ShopAtHome\basis.xml
%PROGRAM_FILES%\ShopAtHome\Merchants.xml