..
Click anywhere to stop
Click anywhere to stop
Class | Trojan |
Platform | JS |
Description |
Technical DetailsThe Trojan program modifies the Internet Explorer home page and adds new links to ‘Favorites’ without the knowledge or consent of the user. The Trojan is written in JavaScript. It locates hypertext documents on web sites and in emails. It only functions if browser support for JavaScript is enabled. PayloadThe Trojan modifies the following system registry keys: [HKCUSoftwareMicrosoftInternet ExplorerMain]
[HKLMSoftwareMicrosoftInternet ExplorerMain] “Start Page”=” New parameter examples: http://joblist.***.ru/redir.html
http://zavarka.***/gift.htm http://sety.***.ru/post.html http://ok***.ok999.net The Trojan also creates shortcuts with URLs in the following directories: %Documents and Settings%All UsersFavorites %Documents and Settings% %WinDir%ProfilesAll UsersFavorites Examples of files created by the Trojan: SuperNavigator.URL (http://joblist.***.ru/redir.htm)
-=Absolutno luchshaya KHALYAVA=-.URL (http://zavarka.***/gift.htm) Znakomstva-Razvlecheniya-Chat.URL (http://www.zavarka.***) – Vse dlya dosuga -.URL (http://sety.***.ru/post.html) (File names are written in Cyrillic) The Trojan also modifies the following system registry values: [HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer] [HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem] [HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesWinOldApp] [HKLMEnumPCI] [HKCUSoftwarePoliciesMicrosoftInternet ExplorerRestrictions] [HKCUControl PanelInternational] These modifications may affect the stability of Windows. Removal instructions
|
Find out the statistics of the threats spreading in your region |