Trojan.StartPage.53829

Technical Information

Malicious functions:

Creates and executes the following:

'%HOMEPATH%\Desktop\Packed.exe'

Terminates or attempts to terminate

the following user processes:

iexplore.exe

Sets a new unauthorized home page for Windows Internet Explorer.

Modifies file system :

Creates the following files:

<Current directory>\520黑信\辽宁3[42].txt
<Current directory>\520黑信\内蒙古1[71].txt
<Current directory>\520黑信\山东1[369].txt
<Current directory>\520黑信\辽宁2[75].txt
<Current directory>\520黑信\江西2[117].txt
<Current directory>\520黑信\江西3[197].txt
<Current directory>\520黑信\辽宁1[199].txt
<Current directory>\520黑信\山东2[191].txt
<Current directory>\520黑信\山西1[452].txt
<Current directory>\520黑信\山西2[51].txt
<Current directory>\520黑信\陕西1[747].txt
<Current directory>\520黑信\山东6[62].txt
<Current directory>\520黑信\山东3[65].txt
<Current directory>\520黑信\山东4[38].txt
<Current directory>\520黑信\山东5[81].txt
<Current directory>\520黑信\华北3[62].txt
<Current directory>\520黑信\华北4[99].txt
<Current directory>\520黑信\吉林1[146].txt
<Current directory>\520黑信\华北2[185].txt
<Current directory>\520黑信\湖南6[110].txt
<Current directory>\520黑信\湖南7[306].txt
<Current directory>\520黑信\华北1[239].txt
<Current directory>\520黑信\江苏1[217].txt
<Current directory>\520黑信\江苏6[74].txt
<Current directory>\520黑信\江苏8[92].txt
<Current directory>\520黑信\江西1[498].txt
<Current directory>\520黑信\江苏5[104].txt
<Current directory>\520黑信\江苏2[151].txt
<Current directory>\520黑信\江苏3[127].txt
<Current directory>\520黑信\江苏4[86].txt
<Current directory>\520黑信\云南1[236].txt
<Current directory>\520黑信\浙江1[235].txt
<Current directory>\520黑信\浙江2[125].txt
<Current directory>\520黑信\云贵1[55].txt
<Current directory>\520黑信\西南2[370].txt
<Current directory>\520黑信\西南3[103].txt
<Current directory>\520黑信\新疆1[68].txt
<Current directory>\520黑信\浙江3[45].txt
<Current directory>\520黑信\重庆2[109].txt
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\loading[1].html
%WINDIR%\Fonts\Guanggaopz.ini
<Current directory>\520黑信\重庆1[421].txt
<Current directory>\520黑信\浙江4[85].txt
<Current directory>\520黑信\浙江6[43].txt
<Current directory>\520黑信\浙江7[34].txt
<Current directory>\520黑信\上海4[118].txt
<Current directory>\520黑信\四川1[472].txt
<Current directory>\520黑信\四川2[243].txt
<Current directory>\520黑信\上海3[91].txt
<Current directory>\520黑信\陕西2[145].txt
<Current directory>\520黑信\上海1[243].txt
<Current directory>\520黑信\上海2[126].txt
<Current directory>\520黑信\四川3[159].txt
<Current directory>\520黑信\西北1[393].txt
<Current directory>\520黑信\西北2[147].txt
<Current directory>\520黑信\西南1[948].txt
<Current directory>\520黑信\天津1[100].txt
<Current directory>\520黑信\四川4[189].txt
<Current directory>\520黑信\四川5[151].txt
<Current directory>\520黑信\四川6[128].txt
<Current directory>\520黑信\湖南5[251].txt
<Current directory>\520黑信\广东12[109].txt
<Current directory>\520黑信\广东13[136].txt
<Current directory>\520黑信\广东2[417].txt
<Current directory>\520黑信\广东11[96].txt
<Current directory>\520黑信\福建3[146].txt
<Current directory>\520黑信\广东1[582].txt
<Current directory>\520黑信\广东10[42].txt
<Current directory>\520黑信\广东3[424].txt
<Current directory>\520黑信\广东8[212].txt
<Current directory>\520黑信\广东9[102].txt
<Current directory>\520黑信\广西1[1011].txt
<Current directory>\520黑信\广东7[225].txt
<Current directory>\520黑信\广东4[292].txt
<Current directory>\520黑信\广东5[244].txt
<Current directory>\520黑信\广东6[217].txt
<Current directory>\520黑信\安徽2[303].txt
<Current directory>\520黑信\安徽3[155].txt
<Current directory>\520黑信\北京1[247].txt
<Current directory>\520黑信\安徽1[653].txt
%HOMEPATH%\Desktop\ТщµґІҐУ°КУµјєЅ.html
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\97jianzhan.taobao[1]
%HOMEPATH%\Desktop\Packed.exe
<Current directory>\520黑信\北京2[139].txt
<Current directory>\520黑信\东北4[19].txt
<Current directory>\520黑信\福建1[277].txt
<Current directory>\520黑信\福建2[145].txt
<Current directory>\520黑信\东北3[101].txt
<Current directory>\520黑信\北京3[38].txt
<Current directory>\520黑信\东北1[184].txt
<Current directory>\520黑信\东北2[156].txt
<Current directory>\520黑信\湖北2[191].txt
<Current directory>\520黑信\湖北3[148].txt
<Current directory>\520黑信\湖北4[140].txt
<Current directory>\520黑信\湖北1[291].txt
<Current directory>\520黑信\河南7[209].txt
<Current directory>\520黑信\黑龙江1[220].txt
<Current directory>\520黑信\黑龙江2[49].txt
<Current directory>\520黑信\湖北5[85].txt
<Current directory>\520黑信\湖南2[396].txt
<Current directory>\520黑信\湖南3[226].txt
<Current directory>\520黑信\湖南4[171].txt
<Current directory>\520黑信\湖南1[646].txt
<Current directory>\520黑信\湖北6[45].txt
<Current directory>\520黑信\湖北7[25].txt
<Current directory>\520黑信\湖北8[51].txt
<Current directory>\520黑信\贵州1[618].txt
<Current directory>\520黑信\河北1[703].txt
<Current directory>\520黑信\河北2[301].txt
<Current directory>\520黑信\广州1[356].txt
<Current directory>\520黑信\广西2[693].txt
<Current directory>\520黑信\广西3[617].txt
<Current directory>\520黑信\广西5[85].txt
<Current directory>\520黑信\河北4[137].txt
<Current directory>\520黑信\河南4[281].txt
<Current directory>\520黑信\河南5[183].txt
<Current directory>\520黑信\河南6[251].txt
<Current directory>\520黑信\河南3[390].txt
<Current directory>\520黑信\河北5[25].txt
<Current directory>\520黑信\河南1[885].txt
<Current directory>\520黑信\河南2[638].txt

Deletes the following files:

%HOMEPATH%\Desktop\Packed.exe

Network activity:

Connects to:

'www.97##g.com':80
'97#####han.taobao.com':80
'localhost':1035

TCP:

HTTP GET requests:

www.97##g.com/7298dy/loading.html
97#####han.taobao.com/

UDP:

DNS ASK www.97##g.com
DNS ASK 97#####han.taobao.com

Miscellaneous:

Searches for the following windows:

ClassName: '#32770' WindowName: '????????????????'
ClassName: '' WindowName: 'iexplore.exe'
ClassName: 'EDIT' WindowName: ''
ClassName: 'Internet Explorer_TridentDlgFrame' WindowName: 'Internet Explorer ????????'
ClassName: 'Shell_TrayWnd' WindowName: ''
ClassName: 'MS_AutodialMonitor' WindowName: ''
ClassName: 'MS_WebcheckMonitor' WindowName: ''

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial