Trojan.StartPage1.52153

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Yahoo! Messenger' = '%WINDIR%\nhac vang4.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Yahoo! Messenger' = '%WINDIR%\giai tri2.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Task Manager' = '<SYSTEM32>\phim1.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'explorer' = '%WINDIR%\phim1.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Yahoo! Messenger' = '%WINDIR%\phim1.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Task Manager' = '<SYSTEM32>\nhac tre5.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'explorer' = '%WINDIR%\nhac tre5.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Yahoo! Messenger' = '%WINDIR%\nhac tre5.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'explorer' = '%WINDIR%\giai tri2.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Task Manager' = '<SYSTEM32>\nhac0.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Yahoo! Messenger' = '%WINDIR%\nhac0.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Task Manager' = '<SYSTEM32>\hinh anh3.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'explorer' = '%WINDIR%\hinh anh3.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Yahoo! Messenger' = '%WINDIR%\hinh anh3.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'IEXPLORE.EXE' = 'http://bongma.6x.to/'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Task Manager' = '<SYSTEM32>\nhac vang4.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'explorer' = '%WINDIR%\nhac vang4.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'explorer' = '%WINDIR%\nhac0.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Task Manager' = '<SYSTEM32>\giai tri2.exe'

Creates the following files on removable media:

<Drive name for removable media>:\nhac vang0.exe
<Drive name for removable media>:\giai tri1.exe
<Drive name for removable media>:\giai tri0.exe
<Drive name for removable media>:\phim3.exe
<Drive name for removable media>:\phim2.exe
<Drive name for removable media>:\phim1.exe
<Drive name for removable media>:\phim0.exe
<Drive name for removable media>:\nhac tre3.exe
<Drive name for removable media>:\nhac tre2.exe
<Drive name for removable media>:\nhac tre1.exe
<Drive name for removable media>:\nhac tre0.exe
<Drive name for removable media>:\nhac3.exe
<Drive name for removable media>:\nhac2.exe
<Drive name for removable media>:\nhac1.exe
<Drive name for removable media>:\nhac0.exe
<Drive name for removable media>:\hinh anh3.exe
<Drive name for removable media>:\hinh anh2.exe
<Drive name for removable media>:\hinh anh1.exe
<Drive name for removable media>:\hinh anh0.exe
<Drive name for removable media>:\nhac vang3.exe
<Drive name for removable media>:\nhac vang2.exe
<Drive name for removable media>:\nhac vang1.exe
<Drive name for removable media>:\giai tri2.exe
<Drive name for removable media>:\giai tri3.exe

Malicious functions:

To complicate detection of its presence in the operating system,

forces the system hide from view:

hidden files

blocks execution of the following system utilities:

Windows Task Manager (Taskmgr)
Registry Editor (RegEdit)

modifies the following system settings:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoFolderOptions' = '00000001'

Modifies settings of Windows Internet Explorer:

[<HKCU>\Software\Microsoft\Internet Explorer\Main] 'Window Title' = 'Virus : V.RoBin 2.0'

Sets a new unauthorized home page for Windows Internet Explorer.

Modifies file system:

Creates the following files:

%WINDIR%\<File name>.exe
%WINDIR%\phim0.exe
C:\phim0.exe
<SYSTEM32>\nhac tre3.exe
%WINDIR%\nhac tre3.exe
C:\nhac tre3.exe
<SYSTEM32>\nhac tre2.exe
%WINDIR%\nhac tre2.exe
C:\nhac tre2.exe
<SYSTEM32>\nhac tre1.exe
%WINDIR%\nhac tre1.exe
C:\nhac tre1.exe
<SYSTEM32>\nhac tre0.exe
%WINDIR%\nhac tre0.exe
C:\nhac tre0.exe
<SYSTEM32>\nhac tre5.exe
<SYSTEM32>\phim0.exe
C:\phim1.exe
%WINDIR%\phim1.exe
<SYSTEM32>\phim1.exe
C:\giai tri3.exe
<SYSTEM32>\giai tri2.exe
%WINDIR%\giai tri2.exe
C:\giai tri2.exe
<SYSTEM32>\giai tri1.exe
%WINDIR%\giai tri1.exe
C:\giai tri1.exe
%WINDIR%\giai tri0.exe
<SYSTEM32>\giai tri0.exe
C:\giai tri0.exe
<SYSTEM32>\phim3.exe
%WINDIR%\phim3.exe
C:\phim3.exe
<SYSTEM32>\phim2.exe
%WINDIR%\phim2.exe
C:\phim2.exe
%WINDIR%\giai tri3.exe
<SYSTEM32>\nhac3.exe
%WINDIR%\nhac3.exe
C:\nhac3.exe
<SYSTEM32>\nhac vang3.exe
%WINDIR%\nhac vang3.exe
C:\nhac vang3.exe
<SYSTEM32>\nhac vang2.exe
%WINDIR%\nhac vang2.exe
C:\nhac vang2.exe
<SYSTEM32>\nhac vang1.exe
%WINDIR%\nhac vang1.exe
C:\nhac vang1.exe
<SYSTEM32>\nhac vang0.exe
%WINDIR%\nhac vang0.exe
C:\nhac vang0.exe
<Current directory>\Autorun.bat
<Current directory>\Autorun.inf
<SYSTEM32>\nhac vang4.exe
<SYSTEM32>\hinh anh3.exe
C:\hinh anh0.exe
%WINDIR%\hinh anh0.exe
<SYSTEM32>\hinh anh0.exe
%WINDIR%\nhac2.exe
C:\nhac2.exe
<SYSTEM32>\nhac1.exe
%WINDIR%\nhac1.exe
C:\nhac1.exe
%WINDIR%\nhac0.exe
C:\nhac0.exe
%WINDIR%\hinh anh3.exe
<SYSTEM32>\nhac0.exe
C:\hinh anh3.exe
<SYSTEM32>\hinh anh2.exe
%WINDIR%\hinh anh2.exe
C:\hinh anh2.exe
<SYSTEM32>\hinh anh1.exe
%WINDIR%\hinh anh1.exe
C:\hinh anh1.exe
<SYSTEM32>\nhac2.exe
<SYSTEM32>\giai tri3.exe

Deletes the following files:

<Current directory>\Autorun.inf
<SYSTEM32>\phim0.exe
%WINDIR%\phim0.exe
<Drive name for removable media>:\phim0.exe
C:\phim0.exe
<SYSTEM32>\nhac tre3.exe
%WINDIR%\nhac tre3.exe
<Drive name for removable media>:\nhac tre3.exe
C:\nhac tre3.exe
<SYSTEM32>\nhac tre2.exe
<Drive name for removable media>:\phim1.exe
C:\phim1.exe
C:\nhac tre2.exe
<SYSTEM32>\nhac tre1.exe
%WINDIR%\nhac tre1.exe
<Drive name for removable media>:\nhac tre1.exe
C:\nhac tre1.exe
<SYSTEM32>\nhac tre0.exe
%WINDIR%\nhac tre0.exe
<Drive name for removable media>:\nhac tre0.exe
C:\nhac tre0.exe
%WINDIR%\nhac tre2.exe
C:\hinh anh1.exe
%WINDIR%\phim1.exe
<Drive name for removable media>:\nhac3.exe
C:\nhac3.exe
<SYSTEM32>\nhac2.exe
%WINDIR%\nhac2.exe
<Drive name for removable media>:\nhac2.exe
C:\nhac2.exe
<SYSTEM32>\nhac1.exe
%WINDIR%\nhac1.exe
<Drive name for removable media>:\nhac1.exe
C:\nhac1.exe
%WINDIR%\nhac0.exe
<Drive name for removable media>:\nhac0.exe
C:\nhac0.exe
<SYSTEM32>\phim3.exe
%WINDIR%\phim3.exe
<Drive name for removable media>:\phim3.exe
C:\phim3.exe
<SYSTEM32>\phim2.exe
%WINDIR%\phim2.exe
<Drive name for removable media>:\phim2.exe
C:\phim2.exe
<SYSTEM32>\giai tri3.exe
<Drive name for removable media>:\nhac tre2.exe
%WINDIR%\giai tri3.exe
<Drive name for removable media>:\giai tri3.exe
C:\giai tri3.exe
C:\nhac vang2.exe
C:\hinh anh0.exe
<SYSTEM32>\nhac0.exe
<SYSTEM32>\nhac vang3.exe
%WINDIR%\nhac vang3.exe
<Drive name for removable media>:\nhac vang3.exe
C:\nhac vang3.exe
<SYSTEM32>\nhac vang2.exe
%WINDIR%\nhac vang2.exe
<Drive name for removable media>:\nhac vang2.exe
<SYSTEM32>\nhac vang1.exe
%WINDIR%\hinh anh0.exe
%WINDIR%\nhac vang1.exe
<Drive name for removable media>:\nhac vang1.exe
C:\nhac vang1.exe
<SYSTEM32>\nhac vang0.exe
%WINDIR%\nhac vang0.exe
<Drive name for removable media>:\nhac vang0.exe
C:\nhac vang0.exe
<SYSTEM32>\hinh anh3.exe
<Current directory>\Autorun.bat
%WINDIR%\nhac3.exe
<SYSTEM32>\phim1.exe
<SYSTEM32>\hinh anh0.exe
%WINDIR%\hinh anh1.exe
<Drive name for removable media>:\hinh anh0.exe
<SYSTEM32>\giai tri2.exe
%WINDIR%\giai tri2.exe
<Drive name for removable media>:\giai tri2.exe
C:\giai tri2.exe
<SYSTEM32>\giai tri1.exe
%WINDIR%\giai tri1.exe
<Drive name for removable media>:\giai tri1.exe
C:\giai tri1.exe
<SYSTEM32>\giai tri0.exe
%WINDIR%\giai tri0.exe
<Drive name for removable media>:\giai tri0.exe
C:\giai tri0.exe
%WINDIR%\hinh anh3.exe
<Drive name for removable media>:\hinh anh3.exe
C:\hinh anh3.exe
<SYSTEM32>\hinh anh2.exe
%WINDIR%\hinh anh2.exe
<Drive name for removable media>:\hinh anh2.exe
C:\hinh anh2.exe
<SYSTEM32>\hinh anh1.exe
<Drive name for removable media>:\hinh anh1.exe
<SYSTEM32>\nhac3.exe

Substitutes the following files:

<Current directory>\Autorun.inf
<SYSTEM32>\phim0.exe
%WINDIR%\phim0.exe
<Drive name for removable media>:\phim0.exe
C:\phim0.exe
<SYSTEM32>\nhac tre3.exe
%WINDIR%\nhac tre3.exe
<Drive name for removable media>:\nhac tre3.exe
C:\nhac tre3.exe
<SYSTEM32>\nhac tre2.exe
<Drive name for removable media>:\phim1.exe
C:\phim1.exe
C:\nhac tre2.exe
<SYSTEM32>\nhac tre1.exe
%WINDIR%\nhac tre1.exe
<Drive name for removable media>:\nhac tre1.exe
C:\nhac tre1.exe
<SYSTEM32>\nhac tre0.exe
%WINDIR%\nhac tre0.exe
<Drive name for removable media>:\nhac tre0.exe
C:\nhac tre0.exe
%WINDIR%\nhac tre2.exe
C:\hinh anh1.exe
%WINDIR%\phim1.exe
<Drive name for removable media>:\nhac3.exe
C:\nhac3.exe
<SYSTEM32>\nhac2.exe
%WINDIR%\nhac2.exe
<Drive name for removable media>:\nhac2.exe
C:\nhac2.exe
<SYSTEM32>\nhac1.exe
%WINDIR%\nhac1.exe
<Drive name for removable media>:\nhac1.exe
C:\nhac1.exe
%WINDIR%\nhac0.exe
<Drive name for removable media>:\nhac0.exe
C:\nhac0.exe
<SYSTEM32>\phim3.exe
%WINDIR%\phim3.exe
<Drive name for removable media>:\phim3.exe
C:\phim3.exe
<SYSTEM32>\phim2.exe
%WINDIR%\phim2.exe
<Drive name for removable media>:\phim2.exe
C:\phim2.exe
<SYSTEM32>\giai tri3.exe
<Drive name for removable media>:\nhac tre2.exe
%WINDIR%\giai tri3.exe
<Drive name for removable media>:\giai tri3.exe
C:\giai tri3.exe
C:\nhac vang2.exe
C:\hinh anh0.exe
<SYSTEM32>\nhac0.exe
<SYSTEM32>\nhac vang3.exe
%WINDIR%\nhac vang3.exe
<Drive name for removable media>:\nhac vang3.exe
C:\nhac vang3.exe
<SYSTEM32>\nhac vang2.exe
%WINDIR%\nhac vang2.exe
<Drive name for removable media>:\nhac vang2.exe
<SYSTEM32>\nhac vang1.exe
%WINDIR%\hinh anh0.exe
%WINDIR%\nhac vang1.exe
<Drive name for removable media>:\nhac vang1.exe
C:\nhac vang1.exe
<SYSTEM32>\nhac vang0.exe
%WINDIR%\nhac vang0.exe
<Drive name for removable media>:\nhac vang0.exe
C:\nhac vang0.exe
<SYSTEM32>\hinh anh3.exe
<Current directory>\Autorun.bat
%WINDIR%\nhac3.exe
<SYSTEM32>\phim1.exe
<SYSTEM32>\hinh anh0.exe
%WINDIR%\hinh anh1.exe
<Drive name for removable media>:\hinh anh0.exe
<SYSTEM32>\giai tri2.exe
%WINDIR%\giai tri2.exe
<Drive name for removable media>:\giai tri2.exe
C:\giai tri2.exe
<SYSTEM32>\giai tri1.exe
%WINDIR%\giai tri1.exe
<Drive name for removable media>:\giai tri1.exe
C:\giai tri1.exe
<SYSTEM32>\giai tri0.exe
%WINDIR%\giai tri0.exe
<Drive name for removable media>:\giai tri0.exe
C:\giai tri0.exe
%WINDIR%\hinh anh3.exe
<Drive name for removable media>:\hinh anh3.exe
C:\hinh anh3.exe
<SYSTEM32>\hinh anh2.exe
%WINDIR%\hinh anh2.exe
<Drive name for removable media>:\hinh anh2.exe
C:\hinh anh2.exe
<SYSTEM32>\hinh anh1.exe
<Drive name for removable media>:\hinh anh1.exe
<SYSTEM32>\nhac3.exe

Tecnologías

Términos

Formación y educación

Mitos

Technical Information

Curing recommendations

Free trial