Trojan.StartPage.56333

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Internet Explorer\Extensions\{C18CB140-0BBB-11D4-8FE8-0088CC102437}] 'Exec' = 'http://www.taobao.com/go/chn/tbk_channel/channelcode.php?pid=mm_24729190_2602056_9571523&eventid=101329'

Malicious functions:

Creates and executes the following:

'<SYSTEM32>\AppData.exe'

Executes the following:

'%WINDIR%\regedit.exe' /s %WINDIR%\yh.reg
'<SYSTEM32>\mmc.exe' "<SYSTEM32>\devmgmt.msc"
'<SYSTEM32>\ping.exe' 127.0.0.1 -n 3
'<SYSTEM32>\cacls.exe' "%APPDATA%/SogouExplorer/config.xml" /g %USERNAME%:r
'<SYSTEM32>\ping.exe' 127.0.0.1 -n 1
'<SYSTEM32>\regini.exe' regset.ini
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\7ZSfx000.cmd" "

Sets a new unauthorized home page for Windows Internet Explorer.

Modifies file system :

Creates the following files:

%TEMP%\aut23.tmp
%HOMEPATH%\Favorites\Links\亚马逊商城.url
%TEMP%\aut24.tmp
%HOMEPATH%\Favorites\Links\携程网.url
%TEMP%\aut22.tmp
%HOMEPATH%\Favorites\Links\库巴购物网.url
%TEMP%\aut20.tmp
%HOMEPATH%\Favorites\Links\大众点评.url
%TEMP%\aut21.tmp
C:\Documents and Settings\Default User\Application Data\Tencent\QQBrowser\webkit_cache\2\Local Storage\__0.localstorage
C:\Documents and Settings\Default User\Application Data\Tencent\TencentTraveler\100\TtConf.dat
C:\Documents and Settings\Default User\Application Data\Tencent\QQBrowser\user_data\0\config.db
C:\Documents and Settings\Default User\Application Data\Tencent\QQBrowser\user_data\0\Bookmarks
C:\Documents and Settings\Default User\Application Data\Tencent\TencentTraveler\100\navinfo.db
%TEMP%\aut25.tmp
%HOMEPATH%\Favorites\Links\国美电器网上商城.url
C:\Documents and Settings\Default User\Application Data\winscp.rnd
%HOMEPATH%\Favorites\Links\梦芭莎.url
%TEMP%\aut1A.tmp
%HOMEPATH%\Favorites\Links\系统之家.url
%TEMP%\aut1B.tmp
%HOMEPATH%\Favorites\Links\特价机票.url
%TEMP%\aut19.tmp
%HOMEPATH%\Favorites\Links\9233安全网址导航.url
%TEMP%\aut17.tmp
%HOMEPATH%\Favorites\Links\淘宝每日低价商品抢购中！.url
%TEMP%\aut18.tmp
%HOMEPATH%\Favorites\Links\淘宝电器城.url
%TEMP%\aut1E.tmp
%HOMEPATH%\Favorites\Links\凡客诚品.url
%TEMP%\aut1F.tmp
%HOMEPATH%\Favorites\Links\淘宝商城-天猫.url
%TEMP%\aut1C.tmp
%HOMEPATH%\Favorites\Links\Win7之家.url
%TEMP%\aut1D.tmp
%HOMEPATH%\Favorites\Links\淘宝皇冠店铺.url
C:\Documents and Settings\Default User\Favorites\Links\凡客诚品.url
C:\Documents and Settings\Default User\Favorites\Links\亚马逊商城.url
C:\Documents and Settings\Default User\Favorites\Links\大众点评.url
C:\Documents and Settings\Default User\Favorites\Links\国美电器网上商城.url
C:\Documents and Settings\Default User\Favorites\Links\Win7之家.url
C:\Documents and Settings\Default User\Favorites\特价机票.url
C:\Documents and Settings\Default User\Favorites\潮男必备武器.url
C:\Documents and Settings\Default User\Favorites\Links\9233安全网址导航.url
C:\Documents and Settings\Default User\Favorites\系统之家-最新XP系统下载.url
C:\Documents and Settings\Default User\Favorites\Links\淘宝皇冠店铺.url
C:\Documents and Settings\Default User\Favorites\Links\淘宝电器城.url
C:\Documents and Settings\Default User\Favorites\Links\系统之家.url
C:\Documents and Settings\Default User\Favorites\Links\特价机票.url
C:\Documents and Settings\Default User\Favorites\Links\淘宝每日低价商品抢购中！.url
C:\Documents and Settings\Default User\Favorites\Links\携程网.url
C:\Documents and Settings\Default User\Favorites\Links\库巴购物网.url
C:\Documents and Settings\Default User\Favorites\Links\淘宝商城-天猫.url
C:\Documents and Settings\Default User\Favorites\Links\梦芭莎.url
C:\Documents and Settings\Default User\Favorites\大众点评.url
C:\Documents and Settings\Default User\Favorites\国美电器网上商城.url
C:\Documents and Settings\Default User\Favorites\库巴购物网.url
C:\Documents and Settings\Default User\Favorites\好吃-别流口水.url
C:\Documents and Settings\Default User\Favorites\凡客诚品.url
C:\Documents and Settings\Default User\Favorites\9233安全网址导航.url
C:\Documents and Settings\Default User\Application Data\SogouExplorer\CommCfg.xml
C:\Documents and Settings\Default User\Favorites\亚马逊商城.url
C:\Documents and Settings\Default User\Favorites\Win7之家-最新系统下载.url
C:\Documents and Settings\Default User\Favorites\淘宝电器城-手机、电脑.url
C:\Documents and Settings\Default User\Favorites\淘宝每日低价商品抢购中！.url
C:\Documents and Settings\Default User\Favorites\漂亮女生揭秘.url
C:\Documents and Settings\Default User\Favorites\淘宝皇冠店铺.url
C:\Documents and Settings\Default User\Favorites\淘宝商城-天猫.url
C:\Documents and Settings\Default User\Favorites\新蛋.url
C:\Documents and Settings\Default User\Favorites\携程网.url
C:\Documents and Settings\Default User\Favorites\梦芭莎.url
C:\Documents and Settings\Default User\Favorites\时尚女人专柜.url
%APPDATA%\Maxthon3\Users\guest\Favorite\Favorite.dat
%APPDATA%\Maxthon3\Users\guest\Config\config.dat
%APPDATA%\Maxthon3\Users\guest\QuickAccess\QaConfig.dat
%APPDATA%\SogouExplorer\Favorite2.dat
%APPDATA%\CoralExplorer\Users\Default\Default.cfg
%APPDATA%\360se\data\360sefav.db
%APPDATA%\360se\data\URLTitle.ini
%APPDATA%\Tencent\TencentTraveler\100\navinfo.db
%APPDATA%\Tencent\QQBrowser\user_data\0\config.db
%HOMEPATH%\Favorites\9233安全网址导航.url
%TEMP%\aut3.tmp
%HOMEPATH%\Favorites\淘宝每日低价商品抢购中！.url
%TEMP%\aut4.tmp
%TEMP%\7ZSfx000.cmd
%APPDATA%\CoralExplorer\Users\Default\Favorites.data
%APPDATA%\Tencent\TencentTraveler\100\TtConf.dat
%APPDATA%\Tencent\QQBrowser\webkit_cache\2\Local Storage\__0.localstorage
%APPDATA%\CoralExplorer\Users\Default\StartPageConfig.data
%APPDATA%\SogouExplorer\config.xml
%APPDATA%\SogouExplorer\CommCfg.xml
%APPDATA%\SogouExplorer\y.txt
%APPDATA%\SogouExplorer\configlocal.xml
%APPDATA%\Tencent\QQBrowser\user_data\0\Bookmarks
<SYSTEM32>\AppData.exe
%TEMP%\aut1.tmp
<SYSTEM32>\regset.ini
%TEMP%\aut2.tmp
%APPDATA%\360se\seup.ini
%APPDATA%\360se\data\guardconfig.ini
%APPDATA%\360se\data\switch.ini
%APPDATA%\360se\stat.ini
%APPDATA%\Maxthon3\Users\guest\Config\config.ini
%APPDATA%\360se\360seie6.ini
%APPDATA%\360se\360SE.ini
%APPDATA%\360se\data\BlankData.ini
%APPDATA%\360se\360se_s.ini
%TEMP%\aut11.tmp
%HOMEPATH%\Favorites\库巴购物网.url
%TEMP%\aut12.tmp
%HOMEPATH%\Favorites\大众点评.url
%TEMP%\aut10.tmp
%HOMEPATH%\Favorites\淘宝电器城-手机、电脑.url
%TEMP%\autE.tmp
%HOMEPATH%\Favorites\凡客诚品.url
%TEMP%\autF.tmp
%HOMEPATH%\Favorites\国美电器网上商城.url
%TEMP%\aut15.tmp
%HOMEPATH%\Favorites\梦芭莎.url
%TEMP%\aut16.tmp
%HOMEPATH%\Favorites\携程网.url
%TEMP%\aut13.tmp
%HOMEPATH%\Favorites\亚马逊商城.url
%TEMP%\aut14.tmp
%HOMEPATH%\Favorites\新蛋.url
%TEMP%\aut8.tmp
%HOMEPATH%\Favorites\Win7之家-最新系统下载.url
%TEMP%\aut9.tmp
%HOMEPATH%\Favorites\淘宝皇冠店铺.url
%TEMP%\aut7.tmp
%HOMEPATH%\Favorites\特价机票.url
%TEMP%\aut5.tmp
%HOMEPATH%\Favorites\系统之家-最新XP系统下载.url
%TEMP%\aut6.tmp
%HOMEPATH%\Favorites\潮男必备武器.url
%TEMP%\autC.tmp
%HOMEPATH%\Favorites\漂亮女生揭秘.url
%TEMP%\autD.tmp
%HOMEPATH%\Favorites\好吃-别流口水.url
%TEMP%\autA.tmp
%HOMEPATH%\Favorites\淘宝商城-天猫.url
%TEMP%\autB.tmp
%HOMEPATH%\Favorites\时尚女人专柜.url

Sets the 'hidden' attribute to the following files:

%APPDATA%\CoralExplorer\Users\Default\StartPageConfig.data

Deletes the following files:

%TEMP%\aut19.tmp
%TEMP%\aut18.tmp
%TEMP%\aut1A.tmp
%TEMP%\aut1C.tmp
%TEMP%\aut1B.tmp
%TEMP%\aut14.tmp
%TEMP%\aut13.tmp
%TEMP%\aut15.tmp
%TEMP%\aut17.tmp
%TEMP%\aut16.tmp
%TEMP%\aut23.tmp
%TEMP%\aut22.tmp
%TEMP%\aut24.tmp
<SYSTEM32>\regset.ini
%TEMP%\aut25.tmp
%TEMP%\aut1E.tmp
%TEMP%\aut1D.tmp
%TEMP%\aut1F.tmp
%TEMP%\aut21.tmp
%TEMP%\aut20.tmp
%TEMP%\aut12.tmp
%TEMP%\aut4.tmp
%TEMP%\aut3.tmp
%TEMP%\aut5.tmp
%TEMP%\aut7.tmp
%TEMP%\aut6.tmp
%TEMP%\aut2.tmp
%TEMP%\aut1.tmp
<SYSTEM32>\AppData.exe
%APPDATA%\SogouExplorer\y.txt
%TEMP%\7ZSfx000.cmd
%TEMP%\autE.tmp
%TEMP%\autD.tmp
%TEMP%\autF.tmp
%TEMP%\aut11.tmp
%TEMP%\aut10.tmp
%TEMP%\aut9.tmp
%TEMP%\aut8.tmp
%TEMP%\autA.tmp
%TEMP%\autC.tmp
%TEMP%\autB.tmp

Deletes itself.

Miscellaneous:

Searches for the following windows:

ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'RegEdit_RegEdit' WindowName: '(null)'

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial