Trojan.StartPage.36639

Technical Information

Malicious functions:

Creates and executes the following:

%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\TbHelper2.exe -Embedding -RegServer
%ALLUSERSPROFILE%\Application Data\WidgetServer\WidgetServ.exe -regserver system
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\setup_widget_serv.exe /id={1BB22D38-A411-4B13-A746-C2A4F4EC7344} /mode=system

Executes the following:

<SYSTEM32>\regsvr32.exe /s "%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\TbCommonUtils.dll"
<SYSTEM32>\regsvr32.exe /s "%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\tbcore3.dll"

Sets a new unauthorized home page for Windows Internet Explorer.

Modifies file system :

Creates the following files:

%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\fb_22.png
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\fb_11.png
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\fb_00.png
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\fb_33.png
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\fb_events.png
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\fb_55.png
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\fb_44.png
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\facebook_oauth.html
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\facebook.png
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\DynamicMenuConfig-32-Assorted-634332933718100000.gif
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\DynamicMenuConfig-29-Assorted-634332942087787500.gif
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\facebook_cmd.js
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\facebook_logout.js
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\facebook_frame.html
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\facebook_ex_oauth.js
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\fb_friends.png
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\highlighter.png
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\head-logo.png
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\games.png
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\html.png
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\info.txt
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\image.png
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\icons.bmp
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\fb_notes.png
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\fb_loader.gif
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\fb_index.html
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\fb_groups.png
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\fb_menuscript.js
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\fb_news.png
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\fb_messages.png
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\fb_menustyle.css
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\DynamicMenuConfig-28-Assorted-634332935629975000.gif
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\633773901302025000.gif
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\633647037138212500.gif
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\633576113266550000.gif
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\633801340473856250.gif
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\alert_plugin.js
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\634050554397183750.png
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\633936233259281250.gif
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\633377522185887500.gif
%TEMP%\nso2.tmp\inetc.dll
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\your_logo.png
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\ws_30.png
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\statistics[1]
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\633311923915725000.gif
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\16 Arrow-Down.png
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\-1704670046.gif
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\alert_template.htm
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\Downloadve.png
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\download.png
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\documentsearch.png
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\DynamicMenuConfig-0-Nature-634332948606381250.gif
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\DynamicMenuConfig-25-Assorted-634332936749818750.gif
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\DynamicMenuConfig-14-Media-634332948606850000.gif
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\DynamicMenuConfig-1-Nature-634332948606537500.gif
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\computer_delete.png
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\basis.xml
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\arrow_refresh.png
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\alert_widget.js
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\bg.gif
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\cog.png
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\close.gif
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\clock.png
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\inst.tmp
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\twitter.png
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\twitter-sprite-icons.png
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\theegg.gif
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\twitter_cmd.js
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\twitter_frame.html
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\twitter_ex_oauthsimple.js
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\twitter_ex_oauth.js
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\tbs_include_script_022747.js
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\TbHelper2.exe
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\sha1.js
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\setup_widget_serv.exe
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\tbs_include_script_001217.js
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\tbs_include_script_016974.js
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\tbs_include_script_014761.js
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\tbs_include_script_008195.js
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\twitter_logout.js
%ALLUSERSPROFILE%\Application Data\WidgetServer\WidgetServ.exe
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\your_logo.png
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\ws_30.png
%ALLUSERSPROFILE%\Application Data\WidgetServer\uninst.exe
%TEMP%\nso2.tmp\System.dll
%TEMP%\nst5.tmp\AccessControl.dll
%ALLUSERSPROFILE%\Application Data\WidgetServer\users.ini
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\volume.gif
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\uninstall.exe
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\twitter_popup.html
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\twitter_oauth.html
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\uninstaller.exe
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\video.png
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\version.txt
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\update.exe
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\settings.gif
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\mipony barra 25.bmp
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\minimize.gif
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\lt.gif
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\mipony16.png
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\oauth.js
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\NotesRed.png
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\news.png
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\logo.png
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\jquery-ui-1.8.13.custom.css
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\jquery-1.5.1.min.js
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\jquery-1.3.2.min.js
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\jquery-ui-1.8.13.custom.min.js
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\lb.gif
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\kart.gif
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\jquery.json-2.2.min.js
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\onclose.gif
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\radio_prev.png
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\radio_next.png
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\radio_02.png
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\rb.gif
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\rt.gif
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\remote_en.xml
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\rb_res.gif
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\radio_01.png
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\onsettings.gif
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\onontop.gif
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\onminimize.gif
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\ontop.gif
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\polarity.gif
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\PlayerPlug.cfg
%APPDATA%\Toolbar4\{1BB22D38-A411-4B13-A746-C2A4F4EC7344}\pixel.gif
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\fb_11.png
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\fb_00.png
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\facebook_oauth.html
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\fb_22.png
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\fb_55.png
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\fb_44.png
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\fb_33.png
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\facebook_logout.js
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\DynamicMenuConfig-32-Assorted-634332933718100000.gif
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\DynamicMenuConfig-29-Assorted-634332942087787500.gif
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\DynamicMenuConfig-28-Assorted-634332935629975000.gif
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\facebook.png
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\facebook_frame.html
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\facebook_ex_oauth.js
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\facebook_cmd.js
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\fb_events.png
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\head-logo.png
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\games.png
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\fb_notes.png
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\highlighter.png
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\image.png
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\icons.bmp
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\html.png
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\fb_news.png
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\fb_index.html
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\fb_groups.png
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\fb_friends.png
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\fb_loader.gif
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\fb_messages.png
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\fb_menustyle.css
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\fb_menuscript.js
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\DynamicMenuConfig-25-Assorted-634332936749818750.gif
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\633647037138212500.gif
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\633576113266550000.gif
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\633377522185887500.gif
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\633773901302025000.gif
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\634050554397183750.png
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\633936233259281250.gif
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\633801340473856250.gif
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\633311923915725000.gif
%TEMP%\nso2.tmp\UserInfo.dll
%TEMP%\nso2.tmp\Processes.dll
%TEMP%\nso2.tmp\UAC.dll
%TEMP%\mipony-plugin-2-remote.cab
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\16 Arrow-Down.png
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\-1704670046.gif
%TEMP%\nso2.tmp\CabDLL.dll
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\alert_plugin.js
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\download.png
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\documentsearch.png
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\computer_delete.png
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\Downloadve.png
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\DynamicMenuConfig-14-Media-634332948606850000.gif
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\DynamicMenuConfig-1-Nature-634332948606537500.gif
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\DynamicMenuConfig-0-Nature-634332948606381250.gif
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\cog.png
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\arrow_refresh.png
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\alert_widget.js
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\alert_template.htm
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\basis.xml
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\close.gif
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\clock.png
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\bg.gif
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\info.txt
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\tbs_include_script_008195.js
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\tbs_include_script_001217.js
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\TbHelper2.exe
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\tbs_include_script_014761.js
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\theegg.gif
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\tbs_include_script_022747.js
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\tbs_include_script_016974.js
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\tbhelper.dll
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\setup_widget_serv.exe
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\settings.gif
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\rt.gif
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\sha1.js
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\tbcore3.dll
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\TbCommonUtils.dll
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\stations.dll
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\twitter-sprite-icons.png
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\update.exe
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\uninstaller.exe
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\uninstall.exe
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\version.txt
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\Widget.dll
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\volume.gif
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\video.png
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\twitter_popup.html
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\twitter_ex_oauth.js
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\twitter_cmd.js
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\twitter.png
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\twitter_ex_oauthsimple.js
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\twitter_oauth.html
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\twitter_logout.js
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\twitter_frame.html
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\remote_en.xml
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\minimize.gif
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\lt.gif
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\logo.png
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\mipony barra 25.bmp
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\news.png
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\mipony16.png
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\mipony-plugin-2-remote.dll
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\lb.gif
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\jquery-1.5.1.min.js
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\jquery-1.3.2.min.js
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\inst.tmp
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\jquery-ui-1.8.13.custom.css
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\kart.gif
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\jquery.json-2.2.min.js
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\jquery-ui-1.8.13.custom.min.js
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\NotesRed.png
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\radio_02.png
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\radio_01.png
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\polarity.gif
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\radio_next.png
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\rb_res.gif
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\rb.gif
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\radio_prev.png
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\PlayerPlug.cfg
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\onminimize.gif
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\onclose.gif
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\oauth.js
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\onontop.gif
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\pixel.gif
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\ontop.gif
%PROGRAM_FILES%\Mipony-plugin-2\tbunsn3.tmp\onsettings.gif

Deletes the following files:

%TEMP%\nso2.tmp\System.dll
%TEMP%\nso2.tmp\UAC.dll
%TEMP%\nso2.tmp\UserInfo.dll
%TEMP%\nso2.tmp\Processes.dll
%TEMP%\nst5.tmp\AccessControl.dll
%TEMP%\nso2.tmp\CabDLL.dll
%TEMP%\nso2.tmp\inetc.dll

Network activity:

Connects to:

'to####rserver.com':80

TCP:

HTTP GET requests:

to####rserver.com/statistics/?tb######################################################################################

UDP:

DNS ASK to####rserver.com

Miscellaneous:

Searches for the following windows:

ClassName: 'Shell_TrayWnd' WindowName: ''
ClassName: 'SysListView32' WindowName: ''
ClassName: '#32770' WindowName: ''

技术

术语

教育培训

误区

Technical Information

Curing recommendations

Free trial