JavaScript support is required for our site to be fully operational in your browser.
Trojan.StartPage1.6666
Added to the Dr.Web virus database:
2014-11-24
Virus description added:
2014-11-24
Technical Information
Malicious functions:
To bypass firewall, removes or modifies the following registry keys:
[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'
To complicate detection of its presence in the operating system,
blocks the following features:
Executes the following:
'<SYSTEM32>\wbem\wmiadap.exe' /R /T
Modifies settings of Windows Internet Explorer:
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1201' = '00000000'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1208' = '00000000'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1608' = '00000000'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1200' = '00000000'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1608' = '00000000'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1804' = '00000001'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2500' = '00000003'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1804' = '00000001'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] '1608' = '00000000'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] '1804' = '00000001'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] '2500' = '00000003'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] '1208' = '00000000'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '2500' = '00000003'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] '1200' = '00000000'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] '1201' = '00000000'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0] '1804' = '00000001'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0] '2500' = '00000003'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '1200' = '00000000'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0] '1608' = '00000000'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0] '1200' = '00000000'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0] '1201' = '00000000'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0] '1208' = '00000000'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '1201' = '00000000'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1200' = '00000000'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1201' = '00000000'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1208' = '00000000'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '2500' = '00000003'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '1208' = '00000000'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '1608' = '00000000'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '1804' = '00000001'
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system :
Creates the following files:
Deletes the following files:
<SYSTEM32>\PerfStringBackup.TMP
<SYSTEM32>\wbem\Performance\WmiApRpl.ini
Network activity:
Connects to:
'ol####vardosah.com':80
'ol####nuserdat.com':80
'io####byuauiler.com':80
'er####gtdewse.com':80
'hu####wepkaert.com':80
'we####herdobas.com':80
'localhost':1038
'bu####uganerka.com':80
'po####mkavertag.com':80
'ce####alionas.com':80
TCP:
HTTP GET requests:
io####byuauiler.com/e1Gwo0j2We5BxB0U4T2WQC0STB2vip
ol####vardosah.com/kd1v0OdE2yA5Ps0vT4Cz2erf0TC2Z
er####gtdewse.com/g1I0n2IO5w0wO4u2utQ0h2Uix
hu####wepkaert.com/Nz1y0k2w5jxF0Laf4JlA2x0WAP2X
ol####nuserdat.com/q1Y0nZl2HDQ5l0p4j2Co0rfl2d
bu####uganerka.com/p1R0r2Kp5YK0hX4V2gAo0f2nnX
we####herdobas.com/H1mq0VnO2keE5kkS0MC4uk2D0tu2U
po####mkavertag.com/K1mjW0t2RF5Lj0Yyh4TOz2qPu0mgE2h
ce####alionas.com/Lt1zcu0Vc2lac5A0Wd4E2uO0iy2ZJN
UDP:
DNS ASK io####byuauiler.com
DNS ASK ol####vardosah.com
DNS ASK er####gtdewse.com
DNS ASK hu####wepkaert.com
DNS ASK ol####nuserdat.com
DNS ASK bu####uganerka.com
DNS ASK we####herdobas.com
DNS ASK po####mkavertag.com
DNS ASK ce####alionas.com
Miscellaneous:
Searches for the following windows:
ClassName: 'Shell_TrayWnd' WindowName: ''
Curing recommendations
Windows
macOS
Linux
Android
If the operating system (OS) can be loaded (either normally or in safe mode), download Dr.Web Security Space and run a full scan of your computer and removable media you use. More about Dr.Web Security Space .
If you cannot boot the OS, change the BIOS settings to boot your system from a CD or USB drive. Download the image of the emergency system repair disk Dr.Web® LiveDisk , mount it on a USB drive or burn it to a CD/DVD. After booting up with this media, run a full scan and cure all the detected threats.
Use Dr.Web Anti-virus for macOS to run a full scan of your Mac.
If the mobile device is operating normally, download and install Dr.Web for Android. Run a full system scan and follow recommendations to neutralize the detected threats.
If the mobile device has been locked by Android.Locker ransomware (the message on the screen tells you that you have broken some law or demands a set ransom amount; or you will see some other announcement that prevents you from using the handheld normally), do the following:
Load your smartphone or tablet in the safe mode (depending on the operating system version and specifications of the particular mobile device involved, this procedure can be performed in various ways; seek clarification from the user guide that was shipped with the device, or contact its manufacturer);
Once you have activated safe mode, install the Dr.Web for Android onto the infected handheld and run a full scan of the system; follow the steps recommended for neutralizing the threats that have been detected;
Switch off your device and turn it on as normal.
Find out more about Dr.Web for Android
Download Dr.Web for Android
Free three-month trial
All protection features available
Renew your trial license in AppGallery/on Google Pay
By continuing to use this website, you are consenting to Doctor Web’s use of cookies and other technologies related to the collection of visitor statistics. Learn more
OK