用户服务中心

Close

Library
My library

+ Add to library

Search
Search

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

A query form

Call us

+7 (495) 789-45-86

Forum

Your tickets

New ticket

Call us

+7 (495) 789-45-86

Profile

CN

RU CN DE EN ES FR IT JP KZ UZ PL BY ID
Close
服务
扫描仪
Dr.Web vxCube
试用
病毒知识库
知识库

技术

术语

教育培训

误区

新闻

Trojan.Siggen32.26832

Added to the Dr.Web virus database: 2026-02-25

Virus description added:

Technical Information

To ensure autorun and distribution
Modifies the following registry keys
  • [HKLM\SOFTWARE\Classes\CLSID\{FCEA18FF-BC55-4E63-94D7-1B2EFBFE706F}\Shell\Open\Command] '' = '%ProgramFiles(x86)%\StartIsBack\StartIsBackCfg.exe'
  • [HKLM\SOFTWARE\Classes\sib-reactivate\shell\open\command] '' = '"%ProgramFiles(x86)%\StartIsBack\StartIsBackCfg.exe" /reactivate %1'
  • [HKLM\SOFTWARE\Classes\sib-activate\shell\open\command] '' = '"%ProgramFiles(x86)%\StartIsBack\StartIsBackCfg.exe" /activate %1'
Creates or modifies the following files
  • <SYSTEM32>\tasks\startisback health check
  • <SYSTEM32>\tasks\createexplorershellunelevatedtask
Malicious functions
Executes the following
  • '%WINDIR%\syswow64\taskkill.exe' /F /IM startscreen*
  • '%WINDIR%\syswow64\taskkill.exe' /F /IM explorer*
Modifies file system
Creates the following files
  • C:\kinghaze\w11\orbs\e1evenorb-pr.png
  • C:\kinghaze\w10_2\orbs\av_startisbackorbs_0100.bmp
  • C:\kinghaze\w10_2\orbs\av_startisbackorbs_0100a.bmp
  • C:\kinghaze\w10_2\orbs\av_startisbackorbs_0100b.bmp
  • C:\kinghaze\w10_2\orbs\av_startisbackorbs_0100c.bmp
  • C:\kinghaze\w10_2\orbs\av_startisbackorbs_0100ca.bmp
  • C:\kinghaze\w10_2\orbs\av_startisbackorbs_0200a.bmp
  • C:\kinghaze\w10_2\orbs\av_startisbackorbs_0200b.bmp
  • C:\kinghaze\w10_2\orbs\av_startisbackorbs_0285.bmp
  • C:\kinghaze\w10_2\orbs\av_startisbackorbs_0300a.bmp
  • C:\kinghaze\w10_2\orbs\av_startisbackorbs_0394.bmp
  • C:\kinghaze\w10_2\orbs\av_startisbackorbs_0395.bmp
  • C:\kinghaze\w10_2\orbs\av_startisbackorbs_0395a.bmp
  • C:\kinghaze\w10_2\orbs\av_startisbackorbs_0395d.bmp
  • C:\kinghaze\w10_2\orbs\av_startisbackorbs_0397.bmp
  • C:\kinghaze\w10_2\orbs\av_startisbackorbs_0400 (2).bmp
  • C:\kinghaze\w10_2\orbs\av_startisbackorbs_0400a (2).bmp
  • C:\kinghaze\w10_2\orbs\av_startisbackorbs_0400d.bmp
  • C:\kinghaze\w10_2\orbs\av_startisbackorbs_0500.bmp
  • C:\kinghaze\w10_2\orbs\av_startisbackorbs_0500a.bmp
  • C:\kinghaze\w10_2\orbs\av_startisbackorbs_0500b.bmp
  • C:\kinghaze\w10_2\orbs\av_startisbackorbs_0600.bmp
  • C:\kinghaze\w10_2\orbs\av_startisbackorbs_0700.bmp
  • C:\kinghaze\w10_2\orbs\av_startisbackorbs_0700a.bmp
  • C:\kinghaze\w10_2\orbs\av_startisbackorbs_0800.bmp
  • C:\kinghaze\w10_2\orbs\av_startisbackorbs_0800a.bmp
  • C:\kinghaze\w10_2\orbs\av_startisbackorbs_0900.bmp
  • C:\kinghaze\w10_2\orbs\av_startisbackorbs_1000.bmp
  • C:\kinghaze\w10_2\orbs\av_startisbackorbs_1095.bmp
  • C:\kinghaze\w10_2\orbs\av_startisbackorbs_1095a.bmp
  • C:\kinghaze\w10_2\orbs\av_startisbackorbs_1095b.bmp
  • C:\kinghaze\w10_2\orbs\av_startisbackorbs_1095d.bmp
  • C:\kinghaze\w10_2\orbs\av_startisbackorbs_1100.bmp
  • C:\kinghaze\w10_2\orbs\av_startisbackorbs_1189.bmp
  • C:\kinghaze\w10_2\orbs\av_startisbackorbs_1190.bmp
  • C:\kinghaze\w10_2\orbs\av_startisbackorbs_1200.bmp
  • C:\kinghaze\w10_2\orbs\av_startisbackorbs_1200a.bmp
  • C:\kinghaze\w10_2\orbs\av_startisbackorbs_1200b.bmp
  • C:\kinghaze\w10_2\orbs\av_startisbackorbs_1200c.bmp
  • C:\kinghaze\w10_2\orbs\av_startisbackorbs_1300.bmp
  • C:\kinghaze\w10_2\orbs\av_startisbackorbs_1400.bmp
  • C:\kinghaze\w10_2\orbs\av_startisbackorbs_1400a.bmp
  • C:\kinghaze\w10_2\orbs\av_startisbackorbs_1400b.bmp
  • C:\kinghaze\w10_2\orbs\av_startisbackorbs_1400c.bmp
  • C:\kinghaze\w10_2\orbs\av_startisbackorbs_1500.bmp
  • C:\kinghaze\w10_2\orbs\orb (01).bmp
  • C:\kinghaze\w10_2\orbs\orb (02).bmp
  • C:\kinghaze\w10_2\orbs\orb (03).bmp
  • C:\kinghaze\w10_2\orbs\orb (04).bmp
  • C:\kinghaze\w10_2\orbs\orb (05).bmp
  • C:\kinghaze\w10_2\orbs\orb (06).bmp
  • C:\kinghaze\w10_2\orbs\orb (07).bmp
  • C:\kinghaze\w10_2\orbs\orb (08).bmp
  • C:\kinghaze\w10_2\orbs\orb (09).bmp
  • C:\kinghaze\w10_2\orbs\orb (10).bmp
  • C:\kinghaze\w10_2\orbs\orb (11).bmp
  • C:\kinghaze\w10_2\orbs\orb (12).bmp
  • C:\kinghaze\w10_2\orbs\orb (13).bmp
  • C:\kinghaze\w10_2\orbs\orb (14).bmp
  • C:\kinghaze\w10_2\orbs\orb (15).bmp
  • C:\kinghaze\w10_2\orbs\orb (16).bmp
  • C:\kinghaze\w10_2\orbs\orb (17).bmp
  • C:\kinghaze\w10_2\orbs\orb (18).bmp
  • C:\kinghaze\w10_2\orbs\orb (19).bmp
  • C:\kinghaze\w10_2\orbs\orb (20).bmp
  • C:\kinghaze\w10_2\orbs\orb (21).bmp
  • C:\kinghaze\w10_2\orbs\orb (22).bmp
  • C:\kinghaze\w10_2\orbs\orb (23).bmp
  • C:\kinghaze\w10_2\orbs\orb (24).bmp
  • C:\kinghaze\w10_2\orbs\orb (25).bmp
  • C:\kinghaze\w10_2\orbs\orb (26).bmp
  • C:\kinghaze\w10_2\orbs\orb (27).bmp
  • C:\kinghaze\w10_2\orbs\orb (28).bmp
  • C:\kinghaze\w10_2\orbs\orb (29).bmp
  • C:\kinghaze\w10_2\orbs\orb (30).bmp
  • C:\kinghaze\w10_2\orbs\orb (31).bmp
  • C:\kinghaze\w10_2\orbs\orb (32).bmp
  • C:\kinghaze\w10_2\orbs\orb (33).bmp
  • C:\kinghaze\w10_2\orbs\orb (34).bmp
  • C:\kinghaze\w10_2\orbs\orb (35).bmp
  • C:\kinghaze\w10_2\orbs\orb (36).bmp
  • C:\kinghaze\w10_2\orbs\orb (37).bmp
  • C:\kinghaze\w10_2\orbs\orb (38).bmp
  • C:\kinghaze\w10_2\orbs\orb (39).bmp
  • C:\kinghaze\w10_2\orbs\orb (40).bmp
  • C:\kinghaze\w81\orbs\shamrock_106.bmp
  • C:\kinghaze\w81\orbs\shamrock_54.bmp
  • C:\kinghaze\w81\orbs\shamrock_66.bmp
  • C:\kinghaze\w81\orbs\shamrock_81.bmp
  • C:\kinghaze\w10_1\orbs\start3.bmp
  • C:\kinghaze\w8\orbs\start3.bmp
  • C:\kinghaze\w81\orbs\start3.bmp
  • C:\kinghaze\w10_2\orbs\startisback_ei8htorb_v2_by_painter.bmp
  • C:\kinghaze\w10_1\orbs\startisback_ei8htorb_v2_by_painter.bmp
  • C:\kinghaze\w8\orbs\startisback_ei8htorb_v2_by_painter.bmp
  • C:\kinghaze\w81\orbs\startisback_ei8htorb_v2_by_painter.bmp
  • C:\kinghaze\w8\orbs\win7_106.bmp
  • C:\kinghaze\w81\orbs\win7_106.bmp
  • C:\kinghaze\w8\orbs\win7_54.bmp
  • C:\kinghaze\w81\orbs\win7_54.bmp
  • C:\kinghaze\w8\orbs\win7_66.bmp
  • C:\kinghaze\w81\orbs\win7_66.bmp
  • C:\kinghaze\w8\orbs\win7_81.bmp
  • C:\kinghaze\w81\orbs\win7_81.bmp
  • C:\kinghaze\w8\orbs\win8_106.bmp
  • C:\kinghaze\w8\orbs\win8_54.bmp
  • C:\kinghaze\w8\orbs\win8_66.bmp
  • C:\kinghaze\w8\orbs\win8_81.bmp
  • C:\kinghaze\w11\ribbon\theme-dark\accessmedia.svg
  • C:\kinghaze\w11\ribbon\theme-light\accessmedia.svg
  • C:\kinghaze\w11\orbs\clover.svg
  • C:\kinghaze\w11\ribbon\theme-light\easyaccess.svg
  • C:\kinghaze\w11\ribbon\theme-dark\easyaccess.svg
  • C:\kinghaze\w11\orbs\w8logo.svg
  • C:\kinghaze\w11\ribbon\theme-light\windows.addremoveprograms.svg
  • C:\kinghaze\w11\ribbon\theme-dark\windows.addremoveprograms.svg
  • C:\kinghaze\w11\ribbon\theme-dark\windows.computer.manage.svg
  • C:\kinghaze\w11\ribbon\theme-light\windows.computer.manage.svg
  • C:\kinghaze\w11\ribbon\theme-light\windows.copytomenu.svg
  • C:\kinghaze\w11\ribbon\theme-dark\windows.copytomenu.svg
  • C:\kinghaze\w11\ribbon\theme-light\windows.edit.svg
  • C:\kinghaze\w11\ribbon\theme-light\windows.email.svg
  • C:\kinghaze\w11\ribbon\theme-dark\windows.folderoptions.svg
  • C:\kinghaze\w11\ribbon\theme-light\windows.folderoptions.svg
  • C:\kinghaze\w11\ribbon\theme-light\windows.help.svg
  • C:\kinghaze\w11\ribbon\theme-dark\windows.help.svg
  • C:\kinghaze\w11\ribbon\theme-light\windows.layout.svg
  • C:\kinghaze\w11\ribbon\theme-dark\windows.layout.svg
  • C:\kinghaze\w11\ribbon\theme-light\windows.movetomenu.svg
  • C:\kinghaze\w11\ribbon\theme-dark\windows.movetomenu.svg
  • C:\kinghaze\w11\ribbon\theme-light\windows.multiverb.cmd.svg
  • C:\kinghaze\w11\ribbon\theme-dark\windows.multiverb.cmd.svg
  • C:\kinghaze\w11\ribbon\theme-light\windows.multiverb.cmdpromptasadministrator.svg
  • C:\kinghaze\w11\ribbon\theme-dark\windows.multiverb.cmdpromptasadministrator.svg
  • C:\kinghaze\w11\ribbon\theme-light\windows.open.svg
  • C:\kinghaze\w11\ribbon\theme-dark\windows.open.svg
  • C:\kinghaze\w11\ribbon\theme-dark\windows.opencontrolpanel.svg
  • C:\kinghaze\w11\ribbon\theme-light\windows.opencontrolpanel.svg
  • C:\kinghaze\w11\ribbon\theme-dark\windows.pastelink.svg
  • C:\kinghaze\w11\ribbon\theme-light\windows.pastelink.svg
  • C:\kinghaze\w11\ribbon\theme-light\windows.removeproperties.svg
  • C:\kinghaze\w11\ribbon\theme-dark\windows.removeproperties.svg
  • C:\kinghaze\w11\ribbon\theme-light\windows.ribbonpermissionsdialog.svg
  • C:\kinghaze\w11\ribbon\theme-dark\windows.ribbonpermissionsdialog.svg
  • C:\kinghaze\w11\ribbon\theme-light\windows.shareprivate.svg
  • C:\kinghaze\w11\ribbon\theme-dark\windows.shareprivate.svg
  • C:\kinghaze\w11\ribbon\theme-light\windows.slideshow.svg
  • C:\kinghaze\w11\ribbon\theme-dark\windows.slideshow.svg
  • C:\kinghaze\w11\ribbon\theme-dark\windows.systemproperties.svg
  • C:\kinghaze\w11\ribbon\theme-light\windows.systemproperties.svg
  • C:\kinghaze\w11\ribbon\theme-dark\windows.troubleshoot.svg
  • C:\kinghaze\w11\ribbon\theme-light\windows.troubleshoot.svg
  • C:\kinghaze\w8\styles\aero 8.msstyles
  • C:\kinghaze\w81\styles\aero 8.msstyles
  • C:\kinghaze\w10_2\styles\aero 8.msstyles
  • C:\kinghaze\w8\styles\aerobydesign.msstyles
  • C:\kinghaze\w81\styles\aerobydesign.msstyles
  • C:\kinghaze\w10_2\styles\aerobydesign.msstyles
  • C:\kinghaze\w10_2\styles\aerosquared.msstyles
  • C:\kinghaze\w10_2\styles\g10sp.msstyles
  • C:\kinghaze\w10_1\styles\plain10.msstyles
  • C:\kinghaze\w10_2\styles\plain10.msstyles
  • C:\kinghaze\w8\styles\plain8.msstyles
  • C:\kinghaze\w81\styles\plain8.msstyles
  • C:\kinghaze\w10_1\styles\plain8.msstyles
  • C:\kinghaze\w10_2\styles\plain8.msstyles
  • C:\kinghaze\w11\styles\plain8.msstyles
  • C:\kinghaze\w81\styles\windows 7.msstyles
  • C:\kinghaze\w10_1\styles\windows 7.msstyles
  • C:\kinghaze\w10_2\styles\windows 7.msstyles
  • C:\kinghaze\w11\styles\windows 7.msstyles
  • C:\kinghaze\w10_2\orbs\shamrock.orb
  • C:\kinghaze\w10_1\orbs\shamrock.orb
  • C:\kinghaze\w10_2\orbs\windows 7.orb
  • C:\kinghaze\w10_1\orbs\windows 7.orb
  • C:\kinghaze\w11\orbs\windows 7.orb
  • C:\kinghaze\w11\darkmagicloaderx64.exe
  • C:\kinghaze\w11\darkmagicloaderx86.exe
  • C:\kinghaze\kur.exe
  • C:\kinghaze\w11\startallbackcfg.exe
  • C:\kinghaze\w8\startisbackcfg.exe
  • C:\kinghaze\w81\startisbackcfg.exe
  • C:\kinghaze\w10_1\startisbackcfg.exe
  • C:\kinghaze\w10_2\startisbackcfg.exe
  • C:\kinghaze\w8\startscreen.exe
  • C:\kinghaze\w81\startscreen.exe
  • C:\kinghaze\w10_1\startscreen.exe
  • C:\kinghaze\w10_2\startscreen.exe
  • C:\kinghaze\w10_2\updatecheck.exe
  • C:\kinghaze\w11\updatecheck.exe
  • C:\kinghaze\w11\darkmagicx64.dll
  • C:\kinghaze\w11\darkmagicx86.dll
  • C:\kinghaze\w11\startallbackloaderx64.dll
  • C:\kinghaze\w11\startallbackx64.dll
  • C:\kinghaze\w8\startisback32.dll
  • C:\kinghaze\w81\startisback32.dll
  • C:\kinghaze\w10_1\startisback32.dll
  • C:\kinghaze\w10_2\startisback32.dll
  • C:\kinghaze\w8\startisback64.dll
  • C:\kinghaze\w81\startisback64.dll
  • C:\kinghaze\w10_1\startisback64.dll
  • C:\kinghaze\w10_2\startisback64.dll
  • %ProgramFiles(x86)%\startisback\startisback32.dll
  • %ProgramFiles(x86)%\startisback\startisbackcfg.exe
  • %ProgramFiles(x86)%\startisback\startscreen.exe
  • %ProgramFiles(x86)%\startisback\updatecheck.exe
  • %ProgramFiles(x86)%\startisback\startisback64.dll
  • %ProgramFiles(x86)%\startisback\orbs\av_startisbackorbs_0100.bmp
  • %ProgramFiles(x86)%\startisback\orbs\av_startisbackorbs_0100a.bmp
  • %ProgramFiles(x86)%\startisback\orbs\av_startisbackorbs_0100b.bmp
  • %ProgramFiles(x86)%\startisback\orbs\av_startisbackorbs_0100c.bmp
  • %ProgramFiles(x86)%\startisback\orbs\av_startisbackorbs_0100ca.bmp
  • %ProgramFiles(x86)%\startisback\orbs\av_startisbackorbs_0200a.bmp
  • %ProgramFiles(x86)%\startisback\orbs\av_startisbackorbs_0200b.bmp
  • %ProgramFiles(x86)%\startisback\orbs\av_startisbackorbs_0285.bmp
  • %ProgramFiles(x86)%\startisback\orbs\av_startisbackorbs_0300a.bmp
  • %ProgramFiles(x86)%\startisback\orbs\av_startisbackorbs_0394.bmp
  • %ProgramFiles(x86)%\startisback\orbs\av_startisbackorbs_0395.bmp
  • %ProgramFiles(x86)%\startisback\orbs\av_startisbackorbs_0395a.bmp
  • %ProgramFiles(x86)%\startisback\orbs\av_startisbackorbs_0395d.bmp
  • %ProgramFiles(x86)%\startisback\orbs\av_startisbackorbs_0397.bmp
  • %ProgramFiles(x86)%\startisback\orbs\av_startisbackorbs_0400 (2).bmp
  • %ProgramFiles(x86)%\startisback\orbs\av_startisbackorbs_0400a (2).bmp
  • %ProgramFiles(x86)%\startisback\orbs\av_startisbackorbs_0400d.bmp
  • %ProgramFiles(x86)%\startisback\orbs\av_startisbackorbs_0500.bmp
  • %ProgramFiles(x86)%\startisback\orbs\av_startisbackorbs_0500a.bmp
  • %ProgramFiles(x86)%\startisback\orbs\av_startisbackorbs_0500b.bmp
  • %ProgramFiles(x86)%\startisback\orbs\av_startisbackorbs_0600.bmp
  • %ProgramFiles(x86)%\startisback\orbs\av_startisbackorbs_0700.bmp
  • %ProgramFiles(x86)%\startisback\orbs\av_startisbackorbs_0700a.bmp
  • %ProgramFiles(x86)%\startisback\orbs\av_startisbackorbs_0800.bmp
  • %ProgramFiles(x86)%\startisback\orbs\av_startisbackorbs_0800a.bmp
  • %ProgramFiles(x86)%\startisback\orbs\av_startisbackorbs_0900.bmp
  • %ProgramFiles(x86)%\startisback\orbs\av_startisbackorbs_1000.bmp
  • %ProgramFiles(x86)%\startisback\orbs\av_startisbackorbs_1095.bmp
  • %ProgramFiles(x86)%\startisback\orbs\av_startisbackorbs_1095a.bmp
  • %ProgramFiles(x86)%\startisback\orbs\av_startisbackorbs_1095b.bmp
  • %ProgramFiles(x86)%\startisback\orbs\av_startisbackorbs_1095d.bmp
  • %ProgramFiles(x86)%\startisback\orbs\av_startisbackorbs_1100.bmp
  • %ProgramFiles(x86)%\startisback\orbs\av_startisbackorbs_1189.bmp
  • %ProgramFiles(x86)%\startisback\orbs\av_startisbackorbs_1190.bmp
  • %ProgramFiles(x86)%\startisback\orbs\av_startisbackorbs_1200.bmp
  • %ProgramFiles(x86)%\startisback\orbs\av_startisbackorbs_1200a.bmp
  • %ProgramFiles(x86)%\startisback\orbs\av_startisbackorbs_1200b.bmp
  • %ProgramFiles(x86)%\startisback\orbs\av_startisbackorbs_1200c.bmp
  • %ProgramFiles(x86)%\startisback\orbs\av_startisbackorbs_1300.bmp
  • %ProgramFiles(x86)%\startisback\orbs\av_startisbackorbs_1400.bmp
  • %ProgramFiles(x86)%\startisback\orbs\av_startisbackorbs_1400a.bmp
  • %ProgramFiles(x86)%\startisback\orbs\av_startisbackorbs_1400b.bmp
  • %ProgramFiles(x86)%\startisback\orbs\av_startisbackorbs_1400c.bmp
  • %ProgramFiles(x86)%\startisback\orbs\av_startisbackorbs_1500.bmp
  • %ProgramFiles(x86)%\startisback\orbs\orb (01).bmp
  • %ProgramFiles(x86)%\startisback\orbs\orb (02).bmp
  • %ProgramFiles(x86)%\startisback\orbs\orb (03).bmp
  • %ProgramFiles(x86)%\startisback\orbs\orb (04).bmp
  • %ProgramFiles(x86)%\startisback\orbs\orb (05).bmp
  • %ProgramFiles(x86)%\startisback\orbs\orb (06).bmp
  • %ProgramFiles(x86)%\startisback\orbs\orb (07).bmp
  • %ProgramFiles(x86)%\startisback\orbs\orb (08).bmp
  • %ProgramFiles(x86)%\startisback\orbs\orb (09).bmp
  • %ProgramFiles(x86)%\startisback\orbs\orb (10).bmp
  • %ProgramFiles(x86)%\startisback\orbs\orb (11).bmp
  • %ProgramFiles(x86)%\startisback\orbs\orb (12).bmp
  • %ProgramFiles(x86)%\startisback\orbs\orb (13).bmp
  • %ProgramFiles(x86)%\startisback\orbs\orb (14).bmp
  • %ProgramFiles(x86)%\startisback\orbs\orb (15).bmp
  • %ProgramFiles(x86)%\startisback\orbs\orb (16).bmp
  • %ProgramFiles(x86)%\startisback\orbs\orb (17).bmp
  • %ProgramFiles(x86)%\startisback\orbs\orb (18).bmp
  • %ProgramFiles(x86)%\startisback\orbs\orb (19).bmp
  • %ProgramFiles(x86)%\startisback\orbs\orb (20).bmp
  • %ProgramFiles(x86)%\startisback\orbs\orb (21).bmp
  • %ProgramFiles(x86)%\startisback\orbs\orb (22).bmp
  • %ProgramFiles(x86)%\startisback\orbs\orb (23).bmp
  • %ProgramFiles(x86)%\startisback\orbs\orb (24).bmp
  • %ProgramFiles(x86)%\startisback\orbs\orb (25).bmp
  • %ProgramFiles(x86)%\startisback\orbs\orb (26).bmp
  • %ProgramFiles(x86)%\startisback\orbs\orb (27).bmp
  • %ProgramFiles(x86)%\startisback\orbs\orb (28).bmp
  • %ProgramFiles(x86)%\startisback\orbs\orb (29).bmp
  • %ProgramFiles(x86)%\startisback\orbs\orb (30).bmp
  • %ProgramFiles(x86)%\startisback\orbs\orb (31).bmp
  • %ProgramFiles(x86)%\startisback\orbs\orb (32).bmp
  • %ProgramFiles(x86)%\startisback\orbs\orb (33).bmp
  • %ProgramFiles(x86)%\startisback\orbs\orb (34).bmp
  • %ProgramFiles(x86)%\startisback\orbs\orb (35).bmp
  • %ProgramFiles(x86)%\startisback\orbs\orb (36).bmp
  • %ProgramFiles(x86)%\startisback\orbs\orb (37).bmp
  • %ProgramFiles(x86)%\startisback\orbs\orb (38).bmp
  • %ProgramFiles(x86)%\startisback\orbs\orb (39).bmp
  • %ProgramFiles(x86)%\startisback\orbs\orb (40).bmp
  • %ProgramFiles(x86)%\startisback\orbs\shamrock.orb
  • %ProgramFiles(x86)%\startisback\orbs\startisback_ei8htorb_v2_by_painter.bmp
  • %ProgramFiles(x86)%\startisback\orbs\windows 7.orb
  • %ProgramFiles(x86)%\startisback\styles\aero 8.msstyles
  • %ProgramFiles(x86)%\startisback\styles\aerobydesign.msstyles
  • %ProgramFiles(x86)%\startisback\styles\aerosquared.msstyles
  • %ProgramFiles(x86)%\startisback\styles\g10sp.msstyles
  • %ProgramFiles(x86)%\startisback\styles\plain10.msstyles
  • %ProgramFiles(x86)%\startisback\styles\plain8.msstyles
  • %ProgramFiles(x86)%\startisback\styles\windows 7.msstyles
  • %TEMP%\sibtask.xml
  • %TEMP%\startscreen\startscreen.lnk
  • %TEMP%\startscreen\desktop.ini
  • %LOCALAPPDATA%\startisback\cache\appsfolder.dat.new
Deletes following files that it created itself
  • %TEMP%\startscreen\startscreen.lnk
  • C:\kinghaze\kur.exe
  • C:\kinghaze\w10_1\orbs\shamrock.orb
  • C:\kinghaze\w10_1\orbs\start3.bmp
  • C:\kinghaze\w10_1\orbs\startisback_ei8htorb_v2_by_painter.bmp
  • C:\kinghaze\w10_1\orbs\windows 7.orb
  • C:\kinghaze\w10_1\startisback32.dll
  • C:\kinghaze\w10_1\startisback64.dll
  • C:\kinghaze\w10_1\startisbackcfg.exe
  • C:\kinghaze\w10_1\startscreen.exe
  • C:\kinghaze\w10_1\styles\plain10.msstyles
  • C:\kinghaze\w10_1\styles\plain8.msstyles
  • C:\kinghaze\w10_1\styles\windows 7.msstyles
  • C:\kinghaze\w10_2\orbs\av_startisbackorbs_0100.bmp
  • C:\kinghaze\w10_2\orbs\av_startisbackorbs_0100a.bmp
  • C:\kinghaze\w10_2\orbs\av_startisbackorbs_0100b.bmp
  • C:\kinghaze\w10_2\orbs\av_startisbackorbs_0100c.bmp
  • C:\kinghaze\w10_2\orbs\av_startisbackorbs_0100ca.bmp
  • C:\kinghaze\w10_2\orbs\av_startisbackorbs_0200a.bmp
  • C:\kinghaze\w10_2\orbs\av_startisbackorbs_0200b.bmp
  • C:\kinghaze\w10_2\orbs\av_startisbackorbs_0285.bmp
  • C:\kinghaze\w10_2\orbs\av_startisbackorbs_0300a.bmp
  • C:\kinghaze\w10_2\orbs\av_startisbackorbs_0394.bmp
  • C:\kinghaze\w10_2\orbs\av_startisbackorbs_0395.bmp
  • C:\kinghaze\w10_2\orbs\av_startisbackorbs_0395a.bmp
  • C:\kinghaze\w10_2\orbs\av_startisbackorbs_0395d.bmp
  • C:\kinghaze\w10_2\orbs\av_startisbackorbs_0397.bmp
  • C:\kinghaze\w10_2\orbs\av_startisbackorbs_0400 (2).bmp
  • C:\kinghaze\w10_2\orbs\av_startisbackorbs_0400a (2).bmp
  • C:\kinghaze\w10_2\orbs\av_startisbackorbs_0400d.bmp
  • C:\kinghaze\w10_2\orbs\av_startisbackorbs_0500.bmp
  • C:\kinghaze\w10_2\orbs\av_startisbackorbs_0500a.bmp
  • C:\kinghaze\w10_2\orbs\av_startisbackorbs_0500b.bmp
  • C:\kinghaze\w10_2\orbs\av_startisbackorbs_0600.bmp
  • C:\kinghaze\w10_2\orbs\av_startisbackorbs_0700.bmp
  • C:\kinghaze\w10_2\orbs\av_startisbackorbs_0700a.bmp
  • C:\kinghaze\w10_2\orbs\av_startisbackorbs_0800.bmp
  • C:\kinghaze\w10_2\orbs\av_startisbackorbs_0800a.bmp
  • C:\kinghaze\w10_2\orbs\av_startisbackorbs_0900.bmp
  • C:\kinghaze\w10_2\orbs\av_startisbackorbs_1000.bmp
  • C:\kinghaze\w10_2\orbs\av_startisbackorbs_1095.bmp
  • C:\kinghaze\w10_2\orbs\av_startisbackorbs_1095a.bmp
  • C:\kinghaze\w10_2\orbs\av_startisbackorbs_1095b.bmp
  • C:\kinghaze\w10_2\orbs\av_startisbackorbs_1095d.bmp
  • C:\kinghaze\w10_2\orbs\av_startisbackorbs_1100.bmp
  • C:\kinghaze\w10_2\orbs\av_startisbackorbs_1189.bmp
  • C:\kinghaze\w10_2\orbs\av_startisbackorbs_1190.bmp
  • C:\kinghaze\w10_2\orbs\av_startisbackorbs_1200.bmp
  • C:\kinghaze\w10_2\orbs\av_startisbackorbs_1200a.bmp
  • C:\kinghaze\w10_2\orbs\av_startisbackorbs_1200b.bmp
  • C:\kinghaze\w10_2\orbs\av_startisbackorbs_1200c.bmp
  • C:\kinghaze\w10_2\orbs\av_startisbackorbs_1300.bmp
  • C:\kinghaze\w10_2\orbs\av_startisbackorbs_1400.bmp
  • C:\kinghaze\w10_2\orbs\av_startisbackorbs_1400a.bmp
  • C:\kinghaze\w10_2\orbs\av_startisbackorbs_1400b.bmp
  • C:\kinghaze\w10_2\orbs\av_startisbackorbs_1400c.bmp
  • C:\kinghaze\w10_2\orbs\av_startisbackorbs_1500.bmp
  • C:\kinghaze\w10_2\orbs\orb (01).bmp
  • C:\kinghaze\w10_2\orbs\orb (02).bmp
  • C:\kinghaze\w10_2\orbs\orb (03).bmp
  • C:\kinghaze\w10_2\orbs\orb (04).bmp
  • C:\kinghaze\w10_2\orbs\orb (05).bmp
  • C:\kinghaze\w10_2\orbs\orb (06).bmp
  • C:\kinghaze\w10_2\orbs\orb (07).bmp
  • C:\kinghaze\w10_2\orbs\orb (08).bmp
  • C:\kinghaze\w10_2\orbs\orb (09).bmp
  • C:\kinghaze\w10_2\orbs\orb (10).bmp
  • C:\kinghaze\w10_2\orbs\orb (11).bmp
  • C:\kinghaze\w10_2\orbs\orb (12).bmp
  • C:\kinghaze\w10_2\orbs\orb (13).bmp
  • C:\kinghaze\w10_2\orbs\orb (14).bmp
  • C:\kinghaze\w10_2\orbs\orb (15).bmp
  • C:\kinghaze\w10_2\orbs\orb (16).bmp
  • C:\kinghaze\w10_2\orbs\orb (17).bmp
  • C:\kinghaze\w10_2\orbs\orb (18).bmp
  • C:\kinghaze\w10_2\orbs\orb (19).bmp
  • C:\kinghaze\w10_2\orbs\orb (20).bmp
  • C:\kinghaze\w10_2\orbs\orb (21).bmp
  • C:\kinghaze\w10_2\orbs\orb (22).bmp
  • C:\kinghaze\w10_2\orbs\orb (23).bmp
  • C:\kinghaze\w10_2\orbs\orb (24).bmp
  • C:\kinghaze\w10_2\orbs\orb (25).bmp
  • C:\kinghaze\w10_2\orbs\orb (26).bmp
  • C:\kinghaze\w10_2\orbs\orb (27).bmp
  • C:\kinghaze\w10_2\orbs\orb (28).bmp
  • C:\kinghaze\w10_2\orbs\orb (29).bmp
  • C:\kinghaze\w10_2\orbs\orb (30).bmp
  • C:\kinghaze\w10_2\orbs\orb (31).bmp
  • C:\kinghaze\w10_2\orbs\orb (32).bmp
  • C:\kinghaze\w10_2\orbs\orb (33).bmp
  • C:\kinghaze\w10_2\orbs\orb (34).bmp
  • C:\kinghaze\w10_2\orbs\orb (35).bmp
  • C:\kinghaze\w10_2\orbs\orb (36).bmp
  • C:\kinghaze\w10_2\orbs\orb (37).bmp
  • C:\kinghaze\w10_2\orbs\orb (38).bmp
  • C:\kinghaze\w10_2\orbs\orb (39).bmp
  • C:\kinghaze\w10_2\orbs\orb (40).bmp
  • C:\kinghaze\w10_2\orbs\shamrock.orb
  • C:\kinghaze\w10_2\orbs\startisback_ei8htorb_v2_by_painter.bmp
  • C:\kinghaze\w10_2\orbs\windows 7.orb
  • C:\kinghaze\w10_2\startisback32.dll
  • C:\kinghaze\w10_2\startisback64.dll
  • C:\kinghaze\w10_2\startisbackcfg.exe
  • C:\kinghaze\w10_2\startscreen.exe
  • C:\kinghaze\w10_2\styles\aero 8.msstyles
  • C:\kinghaze\w10_2\styles\aerobydesign.msstyles
  • C:\kinghaze\w10_2\styles\aerosquared.msstyles
  • C:\kinghaze\w10_2\styles\g10sp.msstyles
  • C:\kinghaze\w10_2\styles\plain10.msstyles
  • C:\kinghaze\w10_2\styles\plain8.msstyles
  • C:\kinghaze\w10_2\styles\windows 7.msstyles
  • C:\kinghaze\w10_2\updatecheck.exe
  • C:\kinghaze\w11\darkmagicloaderx64.exe
  • C:\kinghaze\w11\darkmagicloaderx86.exe
  • C:\kinghaze\w11\darkmagicx64.dll
  • C:\kinghaze\w11\darkmagicx86.dll
  • C:\kinghaze\w11\orbs\clover.svg
  • C:\kinghaze\w11\orbs\e1evenorb-pr.png
  • C:\kinghaze\w11\orbs\w8logo.svg
  • C:\kinghaze\w11\orbs\windows 7.orb
  • C:\kinghaze\w11\ribbon\theme-dark\accessmedia.svg
  • C:\kinghaze\w11\ribbon\theme-dark\easyaccess.svg
  • C:\kinghaze\w11\ribbon\theme-dark\windows.addremoveprograms.svg
  • C:\kinghaze\w11\ribbon\theme-dark\windows.computer.manage.svg
  • C:\kinghaze\w11\ribbon\theme-dark\windows.copytomenu.svg
  • C:\kinghaze\w11\ribbon\theme-dark\windows.folderoptions.svg
  • C:\kinghaze\w11\ribbon\theme-dark\windows.help.svg
  • C:\kinghaze\w11\ribbon\theme-dark\windows.layout.svg
  • C:\kinghaze\w11\ribbon\theme-dark\windows.movetomenu.svg
  • C:\kinghaze\w11\ribbon\theme-dark\windows.multiverb.cmd.svg
  • C:\kinghaze\w11\ribbon\theme-dark\windows.multiverb.cmdpromptasadministrator.svg
  • C:\kinghaze\w11\ribbon\theme-dark\windows.open.svg
  • C:\kinghaze\w11\ribbon\theme-dark\windows.opencontrolpanel.svg
  • C:\kinghaze\w11\ribbon\theme-dark\windows.pastelink.svg
  • C:\kinghaze\w11\ribbon\theme-dark\windows.removeproperties.svg
  • C:\kinghaze\w11\ribbon\theme-dark\windows.ribbonpermissionsdialog.svg
  • C:\kinghaze\w11\ribbon\theme-dark\windows.shareprivate.svg
  • C:\kinghaze\w11\ribbon\theme-dark\windows.slideshow.svg
  • C:\kinghaze\w11\ribbon\theme-dark\windows.systemproperties.svg
  • C:\kinghaze\w11\ribbon\theme-dark\windows.troubleshoot.svg
  • C:\kinghaze\w11\ribbon\theme-light\accessmedia.svg
  • C:\kinghaze\w11\ribbon\theme-light\easyaccess.svg
  • C:\kinghaze\w11\ribbon\theme-light\windows.addremoveprograms.svg
  • C:\kinghaze\w11\ribbon\theme-light\windows.computer.manage.svg
  • C:\kinghaze\w11\ribbon\theme-light\windows.copytomenu.svg
  • C:\kinghaze\w11\ribbon\theme-light\windows.edit.svg
  • C:\kinghaze\w11\ribbon\theme-light\windows.email.svg
  • C:\kinghaze\w11\ribbon\theme-light\windows.folderoptions.svg
  • C:\kinghaze\w11\ribbon\theme-light\windows.help.svg
  • C:\kinghaze\w11\ribbon\theme-light\windows.layout.svg
  • C:\kinghaze\w11\ribbon\theme-light\windows.movetomenu.svg
  • C:\kinghaze\w11\ribbon\theme-light\windows.multiverb.cmd.svg
  • C:\kinghaze\w11\ribbon\theme-light\windows.multiverb.cmdpromptasadministrator.svg
  • C:\kinghaze\w11\ribbon\theme-light\windows.open.svg
  • C:\kinghaze\w11\ribbon\theme-light\windows.opencontrolpanel.svg
  • C:\kinghaze\w11\ribbon\theme-light\windows.pastelink.svg
  • C:\kinghaze\w11\ribbon\theme-light\windows.removeproperties.svg
  • C:\kinghaze\w11\ribbon\theme-light\windows.ribbonpermissionsdialog.svg
  • C:\kinghaze\w11\ribbon\theme-light\windows.shareprivate.svg
  • C:\kinghaze\w11\ribbon\theme-light\windows.slideshow.svg
  • C:\kinghaze\w11\ribbon\theme-light\windows.systemproperties.svg
  • C:\kinghaze\w11\ribbon\theme-light\windows.troubleshoot.svg
  • C:\kinghaze\w11\startallbackcfg.exe
  • C:\kinghaze\w11\startallbackloaderx64.dll
  • C:\kinghaze\w11\startallbackx64.dll
  • C:\kinghaze\w11\styles\plain8.msstyles
  • C:\kinghaze\w11\styles\windows 7.msstyles
  • C:\kinghaze\w11\updatecheck.exe
  • C:\kinghaze\w8\orbs\start3.bmp
  • C:\kinghaze\w8\orbs\startisback_ei8htorb_v2_by_painter.bmp
  • C:\kinghaze\w8\orbs\win7_106.bmp
  • C:\kinghaze\w8\orbs\win7_54.bmp
  • C:\kinghaze\w8\orbs\win7_66.bmp
  • C:\kinghaze\w8\orbs\win7_81.bmp
  • C:\kinghaze\w8\orbs\win8_106.bmp
  • C:\kinghaze\w8\orbs\win8_54.bmp
  • C:\kinghaze\w8\orbs\win8_66.bmp
  • C:\kinghaze\w8\orbs\win8_81.bmp
  • C:\kinghaze\w8\startisback32.dll
  • C:\kinghaze\w8\startisback64.dll
  • C:\kinghaze\w8\startisbackcfg.exe
  • C:\kinghaze\w8\startscreen.exe
  • C:\kinghaze\w8\styles\aero 8.msstyles
  • C:\kinghaze\w8\styles\aerobydesign.msstyles
  • C:\kinghaze\w8\styles\plain8.msstyles
  • C:\kinghaze\w81\orbs\shamrock_106.bmp
  • C:\kinghaze\w81\orbs\shamrock_54.bmp
  • C:\kinghaze\w81\orbs\shamrock_66.bmp
  • C:\kinghaze\w81\orbs\shamrock_81.bmp
  • C:\kinghaze\w81\orbs\start3.bmp
  • C:\kinghaze\w81\orbs\startisback_ei8htorb_v2_by_painter.bmp
  • C:\kinghaze\w81\orbs\win7_106.bmp
  • C:\kinghaze\w81\orbs\win7_54.bmp
  • C:\kinghaze\w81\orbs\win7_66.bmp
  • C:\kinghaze\w81\orbs\win7_81.bmp
  • C:\kinghaze\w81\startisback32.dll
  • C:\kinghaze\w81\startisback64.dll
  • C:\kinghaze\w81\startisbackcfg.exe
  • C:\kinghaze\w81\startscreen.exe
  • C:\kinghaze\w81\styles\aero 8.msstyles
  • C:\kinghaze\w81\styles\aerobydesign.msstyles
  • C:\kinghaze\w81\styles\plain8.msstyles
  • C:\kinghaze\w81\styles\windows 7.msstyles
Moves the following files
  • from %LOCALAPPDATA%\startisback\cache\appsfolder.dat.new to %LOCALAPPDATA%\startisback\cache\appsfolder.dat
Modifies the following files
  • %LOCALAPPDATA%\microsoft\penworkspace\discovercachedata.dat
Network activity
Connects to
  • '<DNS_SERVER>':53
Miscellaneous
Searches for the following windows
  • ClassName: '' WindowName: ''
  • ClassName: 'Progman' WindowName: ''
  • ClassName: 'Proxy Desktop' WindowName: ''
  • ClassName: 'ReBarWindow32' WindowName: ''
  • ClassName: 'MSTaskSwWClass' WindowName: ''
  • ClassName: 'MSTaskListWClass' WindowName: ''
  • ClassName: 'PeopleBand' WindowName: ''
  • ClassName: 'TrayButton' WindowName: ''
  • ClassName: 'Shell_SecondaryTrayWnd' WindowName: ''
  • ClassName: 'TrayDummySearchControl' WindowName: ''
  • ClassName: 'Edit' WindowName: ''
  • ClassName: 'Static' WindowName: ''
  • ClassName: 'Button' WindowName: ''
  • ClassName: 'ToolbarWindow32' WindowName: ''
  • ClassName: 'DynamicContent1' WindowName: ''
  • ClassName: 'TrayNotifyWnd' WindowName: ''
  • ClassName: 'TrayShowDesktopButtonWClass' WindowName: ''
  • ClassName: 'PenWorkspaceButton' WindowName: ''
  • ClassName: 'TIPBand' WindowName: ''
  • ClassName: 'TrayClockWClass' WindowName: ''
  • ClassName: 'VirtualTouchpad' WindowName: ''
  • ClassName: 'CopilotButton' WindowName: ''
  • ClassName: 'TrayInputIndicatorWClass' WindowName: ''
  • ClassName: 'InputIndicatorButton' WindowName: ''
  • ClassName: 'IMEModeButton' WindowName: ''
  • ClassName: 'DynamicContent2' WindowName: ''
  • ClassName: 'NotifyIconOverflowWindow' WindowName: ''
  • ClassName: 'TaskListThumbnailWnd' WindowName: ''
  • ClassName: 'SysPager' WindowName: ''
  • ClassName: 'tooltips_class32' WindowName: ''
  • ClassName: 'Start' WindowName: ''
  • ClassName: '' WindowName: 'Network Flyout'
  • ClassName: 'SysTreeView32' WindowName: ''
  • ClassName: 'ApplicationFrameWindow' WindowName: ''
  • ClassName: 'SystemTray_Main' WindowName: ''
  • ClassName: 'BluetoothNotificationAreaIconWindowClass' WindowName: 'BluetoothNotificationAreaIconWindowClass'
  • ClassName: 'BluetoothNotificationAreaIconWindowClass' WindowName: ''
  • ClassName: 'ShellDLL_DefView' WindowName: ''
Creates and executes the following
  • 'C:\kinghaze\kur.exe'
  • 'C:\kinghaze\w10_2\startisbackcfg.exe' /install /elevated /silent
  • 'C:\kinghaze\w10_2\startscreen.exe' /stop
  • '%ProgramFiles(x86)%\startisback\startscreen.exe' /unpin
  • '%ProgramFiles(x86)%\startisback\startisbackcfg.exe' /welcome
Executes the following
  • '%WINDIR%\syswow64\schtasks.exe' /Create /TN "\StartIsBack health check" /XML "%TEMP%\sibtask.xml"
  • '%WINDIR%\explorer.exe'
  • '%WINDIR%\explorer.exe' /NoUACCheck
  • 'C:\kinghaze\w10_2\startscreen.exe' /stop' (with hidden window)
  • '%WINDIR%\syswow64\taskkill.exe' /F /IM startscreen*' (with hidden window)
  • '%WINDIR%\syswow64\taskkill.exe' /F /IM explorer*' (with hidden window)
  • '%WINDIR%\syswow64\schtasks.exe' /Create /TN "\StartIsBack health check" /XML "%TEMP%\sibtask.xml"' (with hidden window)

Curing recommendations

  1. If the operating system (OS) can be loaded (either normally or in safe mode), download Dr.Web Security Space and run a full scan of your computer and removable media you use. More about Dr.Web Security Space.
  2. If you cannot boot the OS, change the BIOS settings to boot your system from a CD or USB drive. Download the image of the emergency system repair disk Dr.Web® LiveDisk , mount it on a USB drive or burn it to a CD/DVD. After booting up with this media, run a full scan and cure all the detected threats.
Free trial

 

Download Dr.Web

Download by serial number

Use Dr.Web Anti-virus for macOS to run a full scan of your Mac.

Free trial

 

Download Dr.Web

Download by serial number

Download on App Store

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Free trial

 

Download Dr.Web

Download by serial number

  1. If the mobile device is operating normally, download and install Dr.Web for Android. Run a full system scan and follow recommendations to neutralize the detected threats.
  2. If the mobile device has been locked by Android.Locker ransomware (the message on the screen tells you that you have broken some law or demands a set ransom amount; or you will see some other announcement that prevents you from using the handheld normally), do the following:
    • Load your smartphone or tablet in the safe mode (depending on the operating system version and specifications of the particular mobile device involved, this procedure can be performed in various ways; seek clarification from the user guide that was shipped with the device, or contact its manufacturer);
    • Once you have activated safe mode, install the Dr.Web for Android onto the infected handheld and run a full scan of the system; follow the steps recommended for neutralizing the threats that have been detected;
    • Switch off your device and turn it on as normal.

Find out more about Dr.Web for Android

Free trial

14 days

Download now
Get it on Google Play
Wechat