VBS_STARTPGE.SMG

This Trojan may arrive bundled with malware packages as a malware component.

Arrival Details

This Trojan may arrive bundled with malware packages as a malware component.

Dropping Routine

This Trojan drops the following files:

• C:\Documents and Settings\All Users\Start Menu\³ÌÐò\Æô¶¯\ÌÚѶQQ.lnk - non-malicious file

Other Details

This Trojan does the following:

• It searches for .LNK files (shortcut files) in the following locations:
  %Application Data%\Microsoft\Internet Explorer\Quick Launch
  %Desktop%
  %Start Menu%
  C:\Documents and Settings\All Users\Desktop
  C:\Documents and Settings\All Users\Start Menu

  It checks if the said shortcut files point to the following files:
  360SE.exe
  Maxthon.exe
  Maxthon2.exe
  SogouExplorer.exe
  TTraveler.exe
  TheWorld.exe

  If it finds a match, it then appends any of the following to the target path:
  %Program Files%\Common Files\winie.html;
  %Program Files%\NetMeeting\ie.html
  http://www.{BLOCKED}h.cn/?360
  http://www.{BLOCKED}dh.cn/?360
  http://www.{BLOCKED}dh.cn/?360
  http://www.78{BLOCKED}.cn/?361
  http://www.{BLOCKED}h.cn/?361
  http://www.{BLOCKED}dh.cn/?360
  http://www.{BLOCKED}q.com/?ss2
  http://www.{BLOCKED}60.cn