Technical Information
To ensure autorun and distribution:
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Schedule] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\Spooler] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\WZCSVC] 'Start' = '00000002'
Malicious functions:
To complicate detection of its presence in the operating system,
forces the system hide from view:
- file extensions
blocks the following features:
- System Restore (SR)
- Windows Security Center
Modifies settings of Windows Explorer:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoSMHelp' = '00000001'
Modifies settings of Windows Internet Explorer:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '160A' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1C00' = '{00,00,01,00}'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1601' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] 'CurrentLevel' = '00000000'
Forces autoplay for removable media.
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system :
Creates the following files:
- %TEMP%\temp.ini
- %TEMP%\uninst.exe
- %TEMP%\nsx2.tmp
- %TEMP%\nss3.tmp\System.dll
Deletes the following files:
- %WINDIR%\KB942288-v3.log
- %TEMP%\nss3.tmp\System.dll
- %WINDIR%\Temp\Perflib_Perfdata_7e8.dat
- %TEMP%\temp.ini
- %TEMP%\uninst.exe
