ユーザー向け情報

閉じる

マイライブラリ
マイライブラリ

+ マイライブラリに追加

検索
検索

電話
テクニカルサポート利用方法

問い合わせ

新規お問い合わせ

電話（英語）

+7 (495) 789-45-86

フォーラム（英語）

お問い合わせ履歴

新規お問い合わせ

電話（英語）

+7 (495) 789-45-86

Profile

JP

RU CN DE EN ES FR IT JP KZ UZ PL BY
閉じる
サービス
スキャナー
Dr.Web vxCube
トライアル
ウイルスライブラリ
ナレッジベース

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

ニュース

Trojan.StartPage1.2113

Added to the Dr.Web virus database: 2014-07-23

Virus description added:

Technical Information

Malicious functions:
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system :
Creates the following files:
  • <Current directory>\bmp\РВЅЗЙ«_їЄіЎНјЖ¬.bmp
  • <Current directory>\bmp\РВЅЗЙ«_їЄіЎНјЖ¬2.bmp
  • <Current directory>\bmp\ґґЅЁЅЗЙ«_№нЅЈКї.bmp
  • <Current directory>\bmp\РЎµШНј_УО±к4.bmp
  • <Current directory>\bmp\ЅзГж_ґґЅЁЅЗЙ«.bmp
  • <Current directory>\bmp\NPC_іцКЫ°ґЕҐ.bmp
  • <Current directory>\bmp\јјДЬ_Чоґу»ЇС§П°°ґЕҐ.bmp
  • <Current directory>\bmp\ИООсІЛµҐ_ТСНкіЙИООс.bmp
  • <Current directory>\bmp\ЧЄЦ°_НкіЙ.bmp
  • <Current directory>\bmp\ЦР¶П№«ёж.bmp
  • <Current directory>\bmp\ЧЄЦ°_їсХЅКї.bmp
  • <Current directory>\bmp\РЎµШНј_ДЬНщЙП1.bmp
  • <Current directory>\bmp\РЎµШНј_ДЬНщЙП2.bmp
  • <Current directory>\bmp\РЎµШНј_ДЬНщЙП.bmp
  • <Current directory>\bmp\РЎµШНј_ДЬНщУТ.bmp
  • <Current directory>\bmp\РЎµШНј_ДЬНщПВ.bmp
  • <Current directory>\bmp\РЎµШНј_ДЬНщЧу2.bmp
  • <Current directory>\bmp\РЎµШНј_УО±к2.bmp
  • <Current directory>\bmp\РЎµШНј_УО±к3.bmp
  • <Current directory>\bmp\РЎµШНј_УО±к1.bmp
  • <Current directory>\bmp\РЎµШНј_ДЬНщУТ1.bmp
  • <Current directory>\bmp\РЎµШНј_УО±к.bmp
  • <Current directory>\bmp\К±ЦУ_УАѕГНЈ·в.bmp
  • <Current directory>\bmp\К±ЦУ_Иэ·ЅИнјю.bmp
  • <Current directory>\bmp\№эНј±кјЗ.bmp
  • <Current directory>\bmp\GSDН·±к.bmp
  • <Current directory>\bmp\GSDЅЕ.bmp
  • <Current directory>\bmp\К±ЦУ_·вНЈИэМм.bmp
  • <SYSTEM32>\Dr.sys
  • <Current directory>\ini\QQОе±ККдИл·ЁґКїв.txt
  • <Current directory>\ini\chk.txt
  • <Current directory>\bmp\К±ЦУ_НшВзЦР¶П.bmp
  • <Current directory>\ini\zk.txt
  • <Current directory>\bmp\ґуµШНј_±кК¶.bmp
  • <Current directory>\bmp\ЅзГж№Ш±Х1.bmp
  • <Current directory>\bmp\РйИхЧґМ¬.bmp
  • <Current directory>\bmp\¶Ф»°їт_ENTER.bmp
  • <Current directory>\bmp\¶Ф»°їт_УТПВЅЗ.bmp
  • <Current directory>\bmp\ЅзГж№Ш±Х2.bmp
  • <Current directory>\bmp\јјДЬ_µЪТ»Ті.bmp
  • <Current directory>\bmp\ИООс_ЧЄЦ°.bmp
  • <Current directory>\bmp\јјДЬ_ЧоёЯµИј¶.bmp
  • <Current directory>\bmp\Ч°±ёАё_Г»УРОдЖч.bmp
  • <Current directory>\bmp\јјДЬ_јУµг°ґЕҐ.bmp
  • <Current directory>\bmp\ЅЗЙ«µЧЕМ.bmp
  • <Current directory>\bmp\ІЦївБмИЎ.bmp
  • <Current directory>\bmp\ЖµµА±¬Въ.bmp
  • <Current directory>\bmp\ЖµµАЖХНЁ.bmp
  • <Current directory>\bmp\ЖµµАУµј·.bmp
  • <Current directory>\bmp\ІЦїв±кјЗ.bmp
  • <Current directory>\bmp\ІЦїв№«ёж№Ш±Х.bmp
  • <Current directory>\bmp\ґтЙП№і.bmp
  • <Current directory>\bmp\ИьАцСЗ.bmp
  • <Current directory>\bmp\И·ИП°ґЕҐ.bmp
  • <Current directory>\bmp\їХёс±кјЗ.bmp
  • <Current directory>\Dial.bat
  • <Current directory>\bmp\µЗВЅУОП·°ґЕҐ.bmp
  • <Current directory>\UUWiseHelper.dll
  • %TEMP%\4B28998.res
  • <Current directory>\dm.dll
  • <Current directory>\bmp\ГЬВлКдИлїт.bmp
  • <Current directory>\bmp\ЖµµАЛіі©.bmp
  • <Current directory>\bmp\ЖµµАБјєГ.bmp
  • <Current directory>\bmp\ЖµµАЛўРВ.bmp
  • <Current directory>\bmp\СУіЩЗшИ·ИП.bmp
  • <Current directory>\bmp\їґІ»Зе.bmp
  • <Current directory>\bmp\µШНјДС¶И_Г°ПХ.bmp
  • <Current directory>\bmp\µШНјДС¶И_НхХЯ.bmp
  • <Current directory>\bmp\µШНјДС¶И_ЖХНЁ.bmp
  • <Current directory>\bmp\№Ц_ёзІјБЦ.bmp
  • <Current directory>\bmp\НјГЕїЪ.bmp
  • <Current directory>\bmp\ЛўНк_·µ»ШіЗХт.bmp
  • <Current directory>\bmp\РЎµШНј_ДЬНщЧу3.bmp
  • <Current directory>\bmp\РЎµШНј_ДЬНщЧу4.bmp
  • <Current directory>\bmp\РЎµШНј_ДЬНщЧу1.bmp
  • <Current directory>\bmp\ЖЈАН_їХ.bmp
  • <Current directory>\bmp\РЎµШНј_ДЬНщЧу.bmp
  • <Current directory>\bmp\µШНјУО±к.bmp
  • <Current directory>\bmp\ёсЧУЅ»Іж.bmp
  • <Current directory>\bmp\NPCїЁА¤.bmp
  • <Current directory>\bmp\ОпЖ·РЕПўАёЙПЅЗ.bmp
  • <Current directory>\bmp\NPCРБґп.bmp
  • <Current directory>\bmp\NPC°ь№ьїХёс±кјЗ.bmp
  • <Current directory>\bmp\ИЛОпЧш±к_LV.bmp
  • <Current directory>\bmp\µШНј_Ѕр±Т.bmp
  • <Current directory>\bmp\µШНј_ЕЈН·.bmp
  • <Current directory>\bmp\°ґЕҐ_·ЕЖъ.bmp
  • <Current directory>\bmp\°ь№ь_ёєЦШємМх.bmp
Deletes the following files:
  • %TEMP%\4B28998.res
Network activity:
Connects to:
  • 'co####.uudama.com':9000
  • 'localhost':1051
  • 'localhost':1047
  • 'localhost':1049
  • 'localhost':1053
  • 'localhost':1056
  • 'localhost':1058
  • 'localhost':1054
  • 'co####.uudati.com':9000
  • 'localhost':1038
  • 'localhost':1040
  • 'localhost':1035
  • 'co####.taskok.com':9000
  • 'co###n.utask.cn':9000
  • 'localhost':1045
  • 'co####.uuwise.com':9000
  • 'localhost':1042
  • 'localhost':1044
UDP:
  • DNS ASK co####.uudama.com
  • DNS ASK co####.uudati.com
  • DNS ASK co####.uuwise.com
  • DNS ASK co####.taskok.com
  • DNS ASK co###n.utask.cn

Curing recommendations

  1. If the operating system (OS) can be loaded (either normally or in safe mode), download Dr.Web Security Space and run a full scan of your computer and removable media you use. More about Dr.Web Security Space.
  2. If you cannot boot the OS, change the BIOS settings to boot your system from a CD or USB drive. Download the image of the emergency system repair disk Dr.Web® LiveDisk , mount it on a USB drive or burn it to a CD/DVD. After booting up with this media, run a full scan and cure all the detected threats.
Free trial

 

Download Dr.Web

Download by serial number

Use Dr.Web Anti-virus for macOS to run a full scan of your Mac.

Free trial

 

Download Dr.Web

Download by serial number

Download on App Store

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Free trial

 

Download Dr.Web

Download by serial number

  1. If the mobile device is operating normally, download and install Dr.Web for Android. Run a full system scan and follow recommendations to neutralize the detected threats.
  2. If the mobile device has been locked by Android.Locker ransomware (the message on the screen tells you that you have broken some law or demands a set ransom amount; or you will see some other announcement that prevents you from using the handheld normally), do the following:
    • Load your smartphone or tablet in the safe mode (depending on the operating system version and specifications of the particular mobile device involved, this procedure can be performed in various ways; seek clarification from the user guide that was shipped with the device, or contact its manufacturer);
    • Once you have activated safe mode, install the Dr.Web for Android onto the infected handheld and run a full scan of the system; follow the steps recommended for neutralizing the threats that have been detected;
    • Switch off your device and turn it on as normal.

Find out more about Dr.Web for Android

Free trial

14 days

Download now
Get it on Google Play