Trojan.DownLoad1.60527

Technical Information

To ensure autorun and distribution:

Creates or modifies the following files:

%ALLUSERSPROFILE%\Start Menu\Programs\Startup\moviemk.exe.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Startup\PINBALL.EXE.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Startup\updater.exe.lnk

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\ccosmSrv] 'Start' = '00000002'
[<HKLM>\SYSTEM\ControlSet001\Services\ErrorPolice] 'Start' = '00000002'

Substitutes the following executable system files:

<SYSTEM32>\dllcache\wabmig.exe with <SYSTEM32>\dllcache\wabmig.exe.new
<SYSTEM32>\dllcache\msimn.exe with <SYSTEM32>\dllcache\msimn.exe.new
<SYSTEM32>\dllcache\conf.exe with <SYSTEM32>\dllcache\conf.exe.new
<SYSTEM32>\dllcache\mplayer2.exe with <SYSTEM32>\dllcache\mplayer2.exe.new
<SYSTEM32>\dllcache\pinball.exe with <SYSTEM32>\dllcache\pinball.exe.new
<SYSTEM32>\dllcache\dialer.exe with <SYSTEM32>\dllcache\dialer.exe.new
<SYSTEM32>\dllcache\wmplayer.exe with <SYSTEM32>\dllcache\wmplayer.exe.new
<SYSTEM32>\dllcache\isignup.exe with <SYSTEM32>\dllcache\isignup.exe.new
<SYSTEM32>\dllcache\icwconn2.exe with <SYSTEM32>\dllcache\icwconn2.exe.new
<SYSTEM32>\dllcache\msinfo32.exe with <SYSTEM32>\dllcache\msinfo32.exe.new
<SYSTEM32>\dllcache\iexplore.exe with <SYSTEM32>\dllcache\iexplore.exe.new
<SYSTEM32>\dllcache\rvsezm.exe with <SYSTEM32>\dllcache\rvsezm.exe.new
<SYSTEM32>\dllcache\chkrzm.exe with <SYSTEM32>\dllcache\chkrzm.exe.new
<SYSTEM32>\dllcache\moviemk.exe with <SYSTEM32>\dllcache\moviemk.exe.new

Malicious functions:

Creates and executes the following:

%PROGRAM_FILES%\TimeYahoo.exe
C:\InputXpath.exe rb
C:\InputXpath.exe <Full path to virus>

Executes the following:

<SYSTEM32>\regsvr32.exe /u /s shimgvw.dll
<SYSTEM32>\reg.exe ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v "Display Inline Videos" /t REG_SZ /d no /F
<SYSTEM32>\reg.exe ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v DisableScriptDebuggerIE /t REG_SZ /d yes /F
<SYSTEM32>\regsvr32.exe /u /s scrrun.dll
<SYSTEM32>\reg.exe ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v "Disable Script Debugger" /t REG_SZ /d yes /F
<SYSTEM32>\sc.exe create ccosmSrv BinPath= "%PROGRAM_FILES%\StormII\stormSrv.exe /asservice" type= own type= interact start= auto DisplayName= XpathLink
<SYSTEM32>\sc.exe description ccosmSrv "Contrl Center of Storm Media"
<SYSTEM32>\reg.exe delete HKLM\SYSTEM\ControlSet001\Control\SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318} /F
<SYSTEM32>\regsvr32.exe /u /s vbscript.dll
<SYSTEM32>\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{D27CDB6E-AE6D-11cf-96B8-444553540000}" /v "Compatibility Flags" /t REG_SZ /d 00000400 /F
<SYSTEM32>\reg.exe ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v Play_Background_Sounds /t REG_SZ /d no /F
<SYSTEM32>\cmd.exe /c "%PROGRAM_FILES%\PathGoogle.bat"
<SYSTEM32>\reg.exe ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v "Enable AutoImageResize" /t REG_SZ /d no /F
<SYSTEM32>\reg.exe delete HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318} /F
<SYSTEM32>\reg.exe delete HKLM\Software\Microsoft\Windows\CurrentVersion\Run /F
<SYSTEM32>\regsvr32.exe /s jscript.dll
<SYSTEM32>\regsvr32.exe /u /s itss.dll
<SYSTEM32>\reg.exe ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v "Display Inline Images" /t REG_SZ /d yes /F

Modifies file system :

Creates the following files:

<SYSTEM32>\dllcache\iexplore.exe.new
<SYSTEM32>\dllcache\isignup.exe.new
<SYSTEM32>\dllcache\chkrzm.exe.new
<SYSTEM32>\dllcache\moviemk.exe.new
%PROGRAM_FILES%\Windows NT\Pinball\pinball.exe.new
%PROGRAM_FILES%\Windows NT\dialer.exe.new
<SYSTEM32>\dllcache\icwconn2.exe.new
<SYSTEM32>\dllcache\msinfo32.exe.new
<SYSTEM32>\dllcache\rvsezm.exe.new
<SYSTEM32>\dllcache\wmplayer.exe.new
%TEMP%\RGI1.tmp
<SYSTEM32>\dllcache\pinball.exe.new
<SYSTEM32>\dllcache\dialer.exe.new
<SYSTEM32>\dllcache\msimn.exe.new
<SYSTEM32>\dllcache\conf.exe.new
<SYSTEM32>\dllcache\mplayer2.exe.new
<SYSTEM32>\dllcache\wabmig.exe.new
%CommonProgramFiles%\Microsoft Shared\MSInfo\msinfo32.exe.new
%PROGRAM_FILES%\TimeYahoo.exe
%PROGRAM_FILES%\Internet Explorer\Connection Wizard\isignup.exe.new
%PROGRAM_FILES%\Internet Explorer\Connection Wizard\icwconn2.exe.new
%PROGRAM_FILES%\StormII\stormSrv.exe
C:\InputXpath.exe
%WINDIR%\WinRGBError.exe
%PROGRAM_FILES%\PathGoogle.bat
%PROGRAM_FILES%\Internet Explorer\iexplore.exe.new
%PROGRAM_FILES%\Outlook Express\wabmig.exe.new
%PROGRAM_FILES%\Outlook Express\msimn.exe.new
%PROGRAM_FILES%\Windows Media Player\wmplayer.exe.new
%PROGRAM_FILES%\Windows Media Player\mplayer2.exe.new
%PROGRAM_FILES%\MSN Gaming Zone\Windows\chkrzm.exe.new
%PROGRAM_FILES%\Movie Maker\moviemk.exe.new
%PROGRAM_FILES%\NetMeeting\conf.exe.new
%PROGRAM_FILES%\MSN Gaming Zone\Windows\rvsezm.exe.new

Sets the 'hidden' attribute to the following files:

%ALLUSERSPROFILE%\Start Menu\Programs\Startup\moviemk.exe.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Startup\PINBALL.EXE.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Startup\updater.exe.lnk

Deletes the following files:

%TEMP%\RGI1.tmp

Miscellaneous:

Searches for the following windows:

ClassName: 'ZROALVKHXLGCDL' WindowName: 'lflaxwwipkwfvn'

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial