Technical Information
Malicious functions
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system
Creates the following files
- <Current directory>\gigasoft.dll
- %HOMEPATH%\favorites\gambling\poker.url
- %HOMEPATH%\favorites\gambling\online casinos.url
- %HOMEPATH%\favorites\pharmacy\breast enhancement.url
- %HOMEPATH%\favorites\pharmacy\acne control.url
- %HOMEPATH%\favorites\pharmacy\vicodin.url
- %HOMEPATH%\favorites\pharmacy\weight.url
- %HOMEPATH%\favorites\pharmacy\tramadol.url
- %HOMEPATH%\favorites\pharmacy\penis enlargement.url
- %HOMEPATH%\favorites\pharmacy\diet patch.url
- %HOMEPATH%\favorites\pharmacy\valium.url
- %HOMEPATH%\favorites\pharmacy\human growth hormone.url
- %HOMEPATH%\favorites\pharmacy\viagra.url
- %HOMEPATH%\favorites\travel\travel insurance.url
- %HOMEPATH%\favorites\travel\carnival cruises.url
- %HOMEPATH%\favorites\travel\vacation packages.url
- %HOMEPATH%\favorites\travel\caribbean cruises.url
- %HOMEPATH%\favorites\travel\rental cars.url
- %HOMEPATH%\favorites\travel\discount travel.url
- %HOMEPATH%\favorites\travel\hotels.url
- %HOMEPATH%\favorites\travel\air flight.url
- %HOMEPATH%\favorites\travel\hawaii vacation.url
- %HOMEPATH%\favorites\travel\cruise travel.url
- %HOMEPATH%\favorites\sport\fitness.url
- %HOMEPATH%\favorites\sport\golf.url
- %HOMEPATH%\favorites\sport\fishing.url
- %HOMEPATH%\favorites\sport\personal trainers.url
- %HOMEPATH%\favorites\sport\sport cars.url
- %HOMEPATH%\favorites\gambling\blackjack.url
- %HOMEPATH%\favorites\gambling\betting.url
- %HOMEPATH%\favorites\shopping\laptops.url
- %HOMEPATH%\favorites\shopping\trade shows.url
- %HOMEPATH%\favorites\shopping\books.url
- %HOMEPATH%\favorites\shopping\auto.url
- %HOMEPATH%\favorites\shopping\gifts.url
- %HOMEPATH%\favorites\shopping\cosmetics.url
- %HOMEPATH%\favorites\shopping\electronics.url
- %HOMEPATH%\favorites\shopping\skin care.url
- %HOMEPATH%\favorites\shopping\computers subaff.url
- %HOMEPATH%\favorites\shopping\clothing.url
- %HOMEPATH%\favorites\dating\adult dating.url
- %HOMEPATH%\favorites\dating\chat dating.url
- %HOMEPATH%\favorites\dating\singles.url
- %HOMEPATH%\favorites\real estate\home improvement.url
- %HOMEPATH%\favorites\dating\wedding.url
- %HOMEPATH%\favorites\dating\dating.url
- %HOMEPATH%\favorites\dating\matchmaking.url
- %HOMEPATH%\favorites\dating\romance.url
- %HOMEPATH%\favorites\dating\marriage.url
- %HOMEPATH%\favorites\dating\personals.url
- %HOMEPATH%\favorites\gambling\slot machines.url
- %HOMEPATH%\favorites\gambling\baccarat.url
- %HOMEPATH%\favorites\gambling\horse racing.url
- %HOMEPATH%\favorites\gambling\bingo.url
- %HOMEPATH%\favorites\gambling\sportsbook.url
- %HOMEPATH%\favorites\gambling\online roulette.url
- %HOMEPATH%\favorites\sport\football betting.url
- %HOMEPATH%\favorites\sport\horse racing.url
- %HOMEPATH%\favorites\sport\basketball betting.url
- %HOMEPATH%\favorites\computers and privacy\adware removal.url
- %HOMEPATH%\favorites\computers and privacy\spyware removal.url
- %HOMEPATH%\desktop\online dating.url
- %HOMEPATH%\desktop\home mortgages.url
- %HOMEPATH%\desktop\adware remover.url
- %HOMEPATH%\desktop\poker.url
- %HOMEPATH%\desktop\online pharmacy.url
- <Current directory>\spyware.ico
- <Current directory>\poker.ico
- <Current directory>\pharmacy.ico
- <Current directory>\mortgages.ico
- <Current directory>\dating.ico
- <Current directory>\thumbs.db
- <Current directory>\bmp00011.bmp
- <Current directory>\bmp00010.bmp
- <Current directory>\bmp00009.bmp
- <Current directory>\bmp00008.bmp
- <Current directory>\bmp00007.bmp
- <Current directory>\bmp00006.bmp
- <Current directory>\bmp00005.bmp
- <Current directory>\bmp00004.bmp
- <Current directory>\bmp00003.bmp
- <Current directory>\bmp00002.bmp
- <Current directory>\bmp00001.bmp
- %HOMEPATH%\favorites\computers and privacy\web design.url
- %HOMEPATH%\favorites\computers and privacy\dsl.url
- %HOMEPATH%\favorites\computers and privacy\popup blocker.url
- %HOMEPATH%\favorites\computers and privacy\cable.url
- %HOMEPATH%\favorites\sport\baseball betting.url
- %HOMEPATH%\favorites\computers and privacy\domain names.url
- %HOMEPATH%\favorites\sport\sportsbook.url
- %HOMEPATH%\favorites\finance\investerment.url
- %HOMEPATH%\favorites\finance\fast cash.url
- %HOMEPATH%\favorites\finance\student loan.url
- %HOMEPATH%\favorites\finance\bad credit.url
- %HOMEPATH%\favorites\finance\home business.url
- %HOMEPATH%\favorites\finance\payday loan.url
- %HOMEPATH%\favorites\finance\credit cards.url
- %HOMEPATH%\favorites\finance\home refinance.url
- %HOMEPATH%\favorites\finance\home mortgage.url
- %HOMEPATH%\favorites\finance\debt consolidation.url
- %HOMEPATH%\favorites\dating\chat flirt.url
- %HOMEPATH%\favorites\shopping\printers.url
- %HOMEPATH%\favorites\real estate\home business.url
- %HOMEPATH%\favorites\real estate\condominiums.url
- %HOMEPATH%\favorites\real estate\home equity loan.url
- %HOMEPATH%\favorites\real estate\commercial mortgage.url
- %HOMEPATH%\favorites\real estate\mortgage refinancing.url
- %HOMEPATH%\favorites\real estate\mortgage quote.url
- %HOMEPATH%\favorites\real estate\home insurance.url
- %HOMEPATH%\favorites\real estate\home mortgage.url
- %HOMEPATH%\favorites\computers and privacy\e commerce.url
- %HOMEPATH%\favorites\computers and privacy\broadband.url
- %HOMEPATH%\favorites\computers and privacy\internet access.url
- %HOMEPATH%\favorites\computers and privacy\domain hosting.url
- %HOMEPATH%\favorites\real estate\interior design.url
- %HOMEPATH%\favorites\shopping\wedding gift.url
Sets the 'hidden' attribute to the following files
- <Current directory>\thumbs.db
Moves the following files
- from <Current directory>\bmp00001.bmp to %WINDIR%\giga\bmp00001.bmp
- from <Current directory>\dating.ico to %WINDIR%\giga\dating.ico
- from <Current directory>\mortgages.ico to %WINDIR%\giga\mortgages.ico
- from <Current directory>\bmp00002.bmp to %WINDIR%\giga\bmp00002.bmp
- from <Current directory>\pharmacy.ico to %WINDIR%\giga\pharmacy.ico
- from <Current directory>\bmp00003.bmp to %WINDIR%\giga\bmp00003.bmp
- from <Current directory>\poker.ico to %WINDIR%\giga\poker.ico
- from <Current directory>\bmp00004.bmp to %WINDIR%\giga\bmp00004.bmp
- from <Current directory>\spyware.ico to %WINDIR%\giga\spyware.ico
- from <Current directory>\bmp00005.bmp to %WINDIR%\giga\bmp00005.bmp
- from <Current directory>\bmp00006.bmp to %WINDIR%\giga\bmp00006.bmp
- from <Current directory>\bmp00007.bmp to %WINDIR%\giga\bmp00007.bmp
- from <Current directory>\bmp00008.bmp to %WINDIR%\giga\bmp00008.bmp
- from <Current directory>\bmp00009.bmp to %WINDIR%\giga\bmp00009.bmp
- from <Current directory>\bmp00010.bmp to %WINDIR%\giga\bmp00010.bmp
- from <Current directory>\bmp00011.bmp to %WINDIR%\giga\bmp00011.bmp
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- '%WINDIR%\syswow64\cmd.exe' /C move /Y *.bmp %WINDIR%\Giga\' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C move /Y *.ico %WINDIR%\Giga\' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\regsvr32.exe' /s gigasoft.dll
- '%WINDIR%\syswow64\cmd.exe' /C move /Y *.bmp %WINDIR%\Giga\
- '%WINDIR%\syswow64\cmd.exe' /C move /Y *.ico %WINDIR%\Giga\
