Trojan.StartPage.46927

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Classes\lnkfile\shell\open\command] '' = '"<SYSTEM32>\dumpint.exe" ,"%1" %*'
[<HKLM>\SOFTWARE\Classes\piffile\shell\open\command] '' = '"<SYSTEM32>\dumpint.exe" ,"%1" %*'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Host-Script' = '<SYSTEM32>\boot2.vbs'
[<HKLM>\SOFTWARE\Classes\scrfile\shell\open\command] '' = '"<SYSTEM32>\dumpint.exe" ,"%1" %*'
[<HKLM>\SOFTWARE\Classes\batfile\shell\open\command] '' = '"<SYSTEM32>\dumpint.exe" ,"%1" %*'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe,<SYSTEM32>\dumpint.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,<SYSTEM32>\dumpint.exe'
[<HKLM>\SOFTWARE\Classes\exefile\shell\open\command] '' = '"<SYSTEM32>\dumpint.exe" ,"%1" %*'
[<HKLM>\SOFTWARE\Classes\comfile\shell\open\command] '' = '"<SYSTEM32>\dumpint.exe" ,"%1" %*'

Malicious functions:

Creates and executes the following:

<SYSTEM32>\dumpint.exe

Sets a new unauthorized home page for Windows Internet Explorer.

Modifies file system :

Creates the following files:

C:\VcXaWc35.com
C:\VcXaWc35.cpl
C:\VcXaWc34.scr
C:\VcXaWc35.exe
C:\VcXaWc36.exe
C:\VcXaWc36.com
C:\VcXaWc35.pif
C:\VcXaWc35.scr
C:\VcXaWc33.pif
C:\VcXaWc33.scr
C:\VcXaWc33.com
C:\VcXaWc33.cpl
C:\VcXaWc34.cpl
C:\VcXaWc34.pif
C:\VcXaWc34.exe
C:\VcXaWc34.com
C:\VcXaWc36.cpl
C:\VcXaWc38.pif
C:\VcXaWc38.scr
C:\VcXaWc38.com
C:\VcXaWc38.cpl
C:\VcXaWc39.cpl
C:\VcXaWc39.pif
C:\VcXaWc39.exe
C:\VcXaWc39.com
C:\VcXaWc37.exe
C:\VcXaWc37.com
C:\VcXaWc36.pif
C:\VcXaWc36.scr
C:\VcXaWc37.scr
C:\VcXaWc38.exe
C:\VcXaWc37.cpl
C:\VcXaWc37.pif
C:\VcXaWc28.pif
C:\VcXaWc28.scr
C:\VcXaWc28.com
C:\VcXaWc28.cpl
C:\VcXaWc29.cpl
C:\VcXaWc29.pif
C:\VcXaWc29.exe
C:\VcXaWc29.com
C:\VcXaWc27.exe
C:\VcXaWc27.com
C:\VcXaWc26.pif
C:\VcXaWc26.scr
C:\VcXaWc27.scr
C:\VcXaWc28.exe
C:\VcXaWc27.cpl
C:\VcXaWc27.pif
C:\VcXaWc29.scr
C:\VcXaWc32.exe
C:\VcXaWc32.com
C:\VcXaWc31.pif
C:\VcXaWc31.scr
C:\VcXaWc32.scr
C:\VcXaWc33.exe
C:\VcXaWc32.cpl
C:\VcXaWc32.pif
C:\VcXaWc30.cpl
C:\VcXaWc30.pif
C:\VcXaWc30.exe
C:\VcXaWc30.com
C:\VcXaWc31.com
C:\VcXaWc31.cpl
C:\VcXaWc30.scr
C:\VcXaWc31.exe
C:\VcXaWc48.cpl
C:\VcXaWc48.pif
C:\VcXaWc48.exe
C:\VcXaWc48.com
C:\VcXaWc49.com
C:\VcXaWc49.cpl
C:\VcXaWc48.scr
C:\VcXaWc49.exe
C:\VcXaWc46.scr
C:\VcXaWc47.exe
C:\VcXaWc46.cpl
C:\VcXaWc46.pif
C:\VcXaWc47.pif
C:\VcXaWc47.scr
C:\VcXaWc47.com
C:\VcXaWc47.cpl
C:\VcXaWc49.pif
<SYSTEM32>\vdsddc.dll
<SYSTEM32>\ascacx.dll
<SYSTEM32>\syrpsc.dll
<SYSTEM32>\cetasd.dll
<SYSTEM32>\boot2.vbs
C:\boot.exe
<SYSTEM32>\biosys.sys
<SYSTEM32>\blank2.html
C:\VcXaWc50.com
C:\VcXaWc50.cpl
C:\VcXaWc49.scr
C:\VcXaWc50.exe
<SYSTEM32>\dumpint.exe
C:\VcXaWc50.pif
C:\VcXaWc50.scr
C:\VcXaWc41.scr
C:\VcXaWc42.exe
C:\VcXaWc41.cpl
C:\VcXaWc41.pif
C:\VcXaWc42.pif
C:\VcXaWc42.scr
C:\VcXaWc42.com
C:\VcXaWc42.cpl
C:\VcXaWc40.com
C:\VcXaWc40.cpl
C:\VcXaWc39.scr
C:\VcXaWc40.exe
C:\VcXaWc41.exe
C:\VcXaWc41.com
C:\VcXaWc40.pif
C:\VcXaWc40.scr
C:\VcXaWc43.exe
C:\VcXaWc45.com
C:\VcXaWc45.cpl
C:\VcXaWc44.scr
C:\VcXaWc45.exe
C:\VcXaWc46.exe
C:\VcXaWc46.com
C:\VcXaWc45.pif
C:\VcXaWc45.scr
C:\VcXaWc43.pif
C:\VcXaWc43.scr
C:\VcXaWc43.com
C:\VcXaWc43.cpl
C:\VcXaWc44.cpl
C:\VcXaWc44.pif
C:\VcXaWc44.exe
C:\VcXaWc44.com
C:\VcXaWc26.cpl
C:\VcXaWc8.pif
C:\VcXaWc8.scr
C:\VcXaWc8.com
C:\VcXaWc8.cpl
C:\VcXaWc9.cpl
C:\VcXaWc9.pif
C:\VcXaWc9.exe
C:\VcXaWc9.com
C:\VcXaWc7.exe
C:\VcXaWc7.com
C:\VcXaWc6.pif
C:\VcXaWc6.scr
C:\VcXaWc7.scr
C:\VcXaWc8.exe
C:\VcXaWc7.cpl
C:\VcXaWc7.pif
C:\VcXaWc9.scr
C:\VcXaWc12.exe
C:\VcXaWc12.com
C:\VcXaWc11.pif
C:\VcXaWc11.scr
C:\VcXaWc12.scr
C:\VcXaWc13.exe
C:\VcXaWc12.cpl
C:\VcXaWc12.pif
C:\VcXaWc10.cpl
C:\VcXaWc10.pif
C:\VcXaWc10.exe
C:\VcXaWc10.com
C:\VcXaWc11.com
C:\VcXaWc11.cpl
C:\VcXaWc10.scr
C:\VcXaWc11.exe
C:\VcXaWc2.exe
C:\VcXaWc2.com
C:\VcXaWc1.pif
C:\VcXaWc1.scr
C:\VcXaWc2.scr
C:\VcXaWc3.exe
C:\VcXaWc2.cpl
C:\VcXaWc2.pif
C:\VcXaWc0.cpl
C:\VcXaWc0.pif
C:\VcXaWc0.exe
C:\VcXaWc0.com
C:\VcXaWc1.com
C:\VcXaWc1.cpl
C:\VcXaWc0.scr
C:\VcXaWc1.exe
C:\VcXaWc3.com
C:\VcXaWc5.cpl
C:\VcXaWc5.pif
C:\VcXaWc5.exe
C:\VcXaWc5.com
C:\VcXaWc6.com
C:\VcXaWc6.cpl
C:\VcXaWc5.scr
C:\VcXaWc6.exe
C:\VcXaWc3.scr
C:\VcXaWc4.exe
C:\VcXaWc3.cpl
C:\VcXaWc3.pif
C:\VcXaWc4.pif
C:\VcXaWc4.scr
C:\VcXaWc4.com
C:\VcXaWc4.cpl
C:\VcXaWc21.scr
C:\VcXaWc22.exe
C:\VcXaWc21.cpl
C:\VcXaWc21.pif
C:\VcXaWc22.pif
C:\VcXaWc22.scr
C:\VcXaWc22.com
C:\VcXaWc22.cpl
C:\VcXaWc20.com
C:\VcXaWc20.cpl
C:\VcXaWc19.scr
C:\VcXaWc20.exe
C:\VcXaWc21.exe
C:\VcXaWc21.com
C:\VcXaWc20.pif
C:\VcXaWc20.scr
C:\VcXaWc23.exe
C:\VcXaWc25.com
C:\VcXaWc25.cpl
C:\VcXaWc24.scr
C:\VcXaWc25.exe
C:\VcXaWc26.exe
C:\VcXaWc26.com
C:\VcXaWc25.pif
C:\VcXaWc25.scr
C:\VcXaWc23.pif
C:\VcXaWc23.scr
C:\VcXaWc23.com
C:\VcXaWc23.cpl
C:\VcXaWc24.cpl
C:\VcXaWc24.pif
C:\VcXaWc24.exe
C:\VcXaWc24.com
C:\VcXaWc15.com
C:\VcXaWc15.cpl
C:\VcXaWc14.scr
C:\VcXaWc15.exe
C:\VcXaWc16.exe
C:\VcXaWc16.com
C:\VcXaWc15.pif
C:\VcXaWc15.scr
C:\VcXaWc13.pif
C:\VcXaWc13.scr
C:\VcXaWc13.com
C:\VcXaWc13.cpl
C:\VcXaWc14.cpl
C:\VcXaWc14.pif
C:\VcXaWc14.exe
C:\VcXaWc14.com
C:\VcXaWc16.cpl
C:\VcXaWc18.pif
C:\VcXaWc18.scr
C:\VcXaWc18.com
C:\VcXaWc18.cpl
C:\VcXaWc19.cpl
C:\VcXaWc19.pif
C:\VcXaWc19.exe
C:\VcXaWc19.com
C:\VcXaWc17.exe
C:\VcXaWc17.com
C:\VcXaWc16.pif
C:\VcXaWc16.scr
C:\VcXaWc17.scr
C:\VcXaWc18.exe
C:\VcXaWc17.cpl
C:\VcXaWc17.pif

Sets the 'hidden' attribute to the following files:

C:\VcXaWc34.exe
C:\VcXaWc34.com
C:\VcXaWc33.pif
C:\VcXaWc33.scr
C:\VcXaWc34.scr
C:\VcXaWc35.exe
C:\VcXaWc34.cpl
C:\VcXaWc34.pif
C:\VcXaWc32.cpl
C:\VcXaWc32.pif
C:\VcXaWc32.exe
C:\VcXaWc32.com
C:\VcXaWc33.com
C:\VcXaWc33.cpl
C:\VcXaWc32.scr
C:\VcXaWc33.exe
C:\VcXaWc37.com
C:\VcXaWc37.cpl
C:\VcXaWc36.scr
C:\VcXaWc37.exe
C:\VcXaWc38.exe
C:\VcXaWc38.com
C:\VcXaWc37.pif
C:\VcXaWc37.scr
C:\VcXaWc35.pif
C:\VcXaWc35.scr
C:\VcXaWc35.com
C:\VcXaWc35.cpl
C:\VcXaWc36.cpl
C:\VcXaWc36.pif
C:\VcXaWc36.exe
C:\VcXaWc36.com
C:\VcXaWc27.pif
C:\VcXaWc27.scr
C:\VcXaWc27.com
C:\VcXaWc27.cpl
C:\VcXaWc28.cpl
C:\VcXaWc28.pif
C:\VcXaWc28.exe
C:\VcXaWc28.com
C:\VcXaWc26.exe
C:\VcXaWc26.com
C:\VcXaWc25.pif
C:\VcXaWc25.scr
C:\VcXaWc26.scr
C:\VcXaWc27.exe
C:\VcXaWc26.cpl
C:\VcXaWc26.pif
C:\VcXaWc30.scr
C:\VcXaWc31.exe
C:\VcXaWc30.cpl
C:\VcXaWc30.pif
C:\VcXaWc31.pif
C:\VcXaWc31.scr
C:\VcXaWc31.com
C:\VcXaWc31.cpl
C:\VcXaWc29.com
C:\VcXaWc29.cpl
C:\VcXaWc28.scr
C:\VcXaWc29.exe
C:\VcXaWc30.exe
C:\VcXaWc30.com
C:\VcXaWc29.pif
C:\VcXaWc29.scr
C:\VcXaWc46.scr
C:\VcXaWc47.exe
C:\VcXaWc46.cpl
C:\VcXaWc46.pif
C:\VcXaWc47.pif
C:\VcXaWc47.scr
C:\VcXaWc47.com
C:\VcXaWc47.cpl
C:\VcXaWc45.com
C:\VcXaWc45.cpl
C:\VcXaWc44.scr
C:\VcXaWc45.exe
C:\VcXaWc46.exe
C:\VcXaWc46.com
C:\VcXaWc45.pif
C:\VcXaWc45.scr
C:\VcXaWc50.exe
C:\VcXaWc50.com
C:\VcXaWc49.pif
C:\VcXaWc49.scr
C:\VcXaWc50.scr
C:\boot.exe
C:\VcXaWc50.cpl
C:\VcXaWc50.pif
C:\VcXaWc48.cpl
C:\VcXaWc48.pif
C:\VcXaWc48.exe
C:\VcXaWc48.com
C:\VcXaWc49.com
C:\VcXaWc49.cpl
C:\VcXaWc48.scr
C:\VcXaWc49.exe
C:\VcXaWc40.cpl
C:\VcXaWc40.pif
C:\VcXaWc40.exe
C:\VcXaWc40.com
C:\VcXaWc41.com
C:\VcXaWc41.cpl
C:\VcXaWc40.scr
C:\VcXaWc41.exe
C:\VcXaWc38.scr
C:\VcXaWc39.exe
C:\VcXaWc38.cpl
C:\VcXaWc38.pif
C:\VcXaWc39.pif
C:\VcXaWc39.scr
C:\VcXaWc39.com
C:\VcXaWc39.cpl
C:\VcXaWc43.pif
C:\VcXaWc43.scr
C:\VcXaWc43.com
C:\VcXaWc43.cpl
C:\VcXaWc44.cpl
C:\VcXaWc44.pif
C:\VcXaWc44.exe
C:\VcXaWc44.com
C:\VcXaWc42.exe
C:\VcXaWc42.com
C:\VcXaWc41.pif
C:\VcXaWc41.scr
C:\VcXaWc42.scr
C:\VcXaWc43.exe
C:\VcXaWc42.cpl
C:\VcXaWc42.pif
C:\VcXaWc8.cpl
C:\VcXaWc8.pif
C:\VcXaWc8.exe
C:\VcXaWc8.com
C:\VcXaWc9.com
C:\VcXaWc9.cpl
C:\VcXaWc8.scr
C:\VcXaWc9.exe
C:\VcXaWc6.scr
C:\VcXaWc7.exe
C:\VcXaWc6.cpl
C:\VcXaWc6.pif
C:\VcXaWc7.pif
C:\VcXaWc7.scr
C:\VcXaWc7.com
C:\VcXaWc7.cpl
C:\VcXaWc11.pif
C:\VcXaWc11.scr
C:\VcXaWc11.com
C:\VcXaWc11.cpl
C:\VcXaWc12.cpl
C:\VcXaWc12.pif
C:\VcXaWc12.exe
C:\VcXaWc12.com
C:\VcXaWc10.exe
C:\VcXaWc10.com
C:\VcXaWc9.pif
C:\VcXaWc9.scr
C:\VcXaWc10.scr
C:\VcXaWc11.exe
C:\VcXaWc10.cpl
C:\VcXaWc10.pif
C:\VcXaWc2.exe
C:\VcXaWc2.com
C:\VcXaWc1.pif
C:\VcXaWc1.scr
C:\VcXaWc2.scr
C:\VcXaWc3.exe
C:\VcXaWc2.cpl
C:\VcXaWc2.pif
C:\VcXaWc0.cpl
C:\VcXaWc0.pif
C:\VcXaWc0.exe
C:\VcXaWc0.com
C:\VcXaWc1.com
C:\VcXaWc1.cpl
C:\VcXaWc0.scr
C:\VcXaWc1.exe
C:\VcXaWc5.com
C:\VcXaWc5.cpl
C:\VcXaWc4.scr
C:\VcXaWc5.exe
C:\VcXaWc6.exe
C:\VcXaWc6.com
C:\VcXaWc5.pif
C:\VcXaWc5.scr
C:\VcXaWc3.pif
C:\VcXaWc3.scr
C:\VcXaWc3.com
C:\VcXaWc3.cpl
C:\VcXaWc4.cpl
C:\VcXaWc4.pif
C:\VcXaWc4.exe
C:\VcXaWc4.com
C:\VcXaWc21.com
C:\VcXaWc21.cpl
C:\VcXaWc20.scr
C:\VcXaWc21.exe
C:\VcXaWc22.exe
C:\VcXaWc22.com
C:\VcXaWc21.pif
C:\VcXaWc21.scr
C:\VcXaWc19.pif
C:\VcXaWc19.scr
C:\VcXaWc19.com
C:\VcXaWc19.cpl
C:\VcXaWc20.cpl
C:\VcXaWc20.pif
C:\VcXaWc20.exe
C:\VcXaWc20.com
C:\VcXaWc24.cpl
C:\VcXaWc24.pif
C:\VcXaWc24.exe
C:\VcXaWc24.com
C:\VcXaWc25.com
C:\VcXaWc25.cpl
C:\VcXaWc24.scr
C:\VcXaWc25.exe
C:\VcXaWc22.scr
C:\VcXaWc23.exe
C:\VcXaWc22.cpl
C:\VcXaWc22.pif
C:\VcXaWc23.pif
C:\VcXaWc23.scr
C:\VcXaWc23.com
C:\VcXaWc23.cpl
C:\VcXaWc14.scr
C:\VcXaWc15.exe
C:\VcXaWc14.cpl
C:\VcXaWc14.pif
C:\VcXaWc15.pif
C:\VcXaWc15.scr
C:\VcXaWc15.com
C:\VcXaWc15.cpl
C:\VcXaWc13.com
C:\VcXaWc13.cpl
C:\VcXaWc12.scr
C:\VcXaWc13.exe
C:\VcXaWc14.exe
C:\VcXaWc14.com
C:\VcXaWc13.pif
C:\VcXaWc13.scr
C:\VcXaWc18.exe
C:\VcXaWc18.com
C:\VcXaWc17.pif
C:\VcXaWc17.scr
C:\VcXaWc18.scr
C:\VcXaWc19.exe
C:\VcXaWc18.cpl
C:\VcXaWc18.pif
C:\VcXaWc16.cpl
C:\VcXaWc16.pif
C:\VcXaWc16.exe
C:\VcXaWc16.com
C:\VcXaWc17.com
C:\VcXaWc17.cpl
C:\VcXaWc16.scr
C:\VcXaWc17.exe

Deletes the following files:

%TEMP%\~DFECD9.tmp

Miscellaneous:

Searches for the following windows:

ClassName: 'Shell_TrayWnd' WindowName: ''

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial