VBS_STARTPGE.SMG

June 28, 2013
 Analysis by: Kathleen Notario
 PLATFORM:

Windows 2000, XP, Server 2003

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:

  • Threat Type: Trojan

  • Destructiveness: No

  • Encrypted: No

  • In the wild: Yes

  OVERVIEW

This Trojan may arrive bundled with malware packages as a malware component.

  TECHNICAL DETAILS

File Size:

Varies

File Type:

VBS

Memory Resident:

No

Initial Samples Received Date:

22 Sep 2010

Arrival Details

This Trojan may arrive bundled with malware packages as a malware component.

Dropping Routine

This Trojan drops the following files:

  • C:\Documents and Settings\All Users\Start Menu\³ÌÐò\Æô¶¯\ÌÚѶQQ.lnk - non-malicious file

Other Details

This Trojan does the following:

  • It searches for .LNK files (shortcut files) in the following locations:
    %Application Data%\Microsoft\Internet Explorer\Quick Launch
    %Desktop%
    %Start Menu%
    C:\Documents and Settings\All Users\Desktop
    C:\Documents and Settings\All Users\Start Menu

    It checks if the said shortcut files point to the following files:
    360SE.exe
    Maxthon.exe
    Maxthon2.exe
    SogouExplorer.exe
    TTraveler.exe
    TheWorld.exe

    If it finds a match, it then appends any of the following to the target path:
    %Program Files%\Common Files\winie.html;
    %Program Files%\NetMeeting\ie.html
    http://www.{BLOCKED}h.cn/?360
    http://www.{BLOCKED}dh.cn/?360
    http://www.{BLOCKED}dh.cn/?360
    http://www.78{BLOCKED}.cn/?361
    http://www.{BLOCKED}h.cn/?361
    http://www.{BLOCKED}dh.cn/?360
    http://www.{BLOCKED}q.com/?ss2
    http://www.{BLOCKED}60.cn

  SOLUTION

Minimum Scan Engine:

8.900

VSAPI OPR PATTERN File:

7.482.05

VSAPI OPR PATTERN Date:

22 Sep 2010

Step 1

Before doing any scans, Windows XP, Windows Vista, and Windows 7 users must disable System Restore to allow full scanning of their computers.

Step 2

Search and delete this file

[ Learn More ]
There may be some files that are hidden. Please make sure you check the Search Hidden Files and Folders checkbox in the "More advanced options" option to include all hidden files and folders in the search result. C:\Documents and Settings\All Users\Start Menu\³ÌÐò\Æô¶¯\ÌÚѶQQ.lnk

Step 3

Scan your computer with your Trend Micro product to delete files detected as VBS_STARTPGE.SMG. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.


Did this description help? Tell us how we did.