Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\МЁНеК®°ЛГАЕ®.LNK
Malicious functions:
Creates and executes the following:
- %PROGRAM_FILES%\МЁНеК®°ЛГАЕ®\МЁНеК®°ЛГАЕ®.exe
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system :
Creates the following files:
- %TEMP%\nsj3.tmp\KillProcDLL.dll
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\НшЦ·ґуИ«.url
- %HOMEPATH%\Desktop\МЁНеК®°ЛГАЕ®.lnk
- %HOMEPATH%\Start Menu\Programs\МЁНеК®°ЛГАЕ®\МЁНеК®°ЛГАЕ®.lnk
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\ёЯЗеЕЪ,ёЯЗеµзУ°ФЪПЯ.url
- %HOMEPATH%\Start Menu\Programs\МЁНеК®°ЛГАЕ®\НшЦ·ґуИ«.url
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\МФ±¦Нш.url
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\КУЖµНµЕД_Иэ°ЛФЪПЯ.url
- %HOMEPATH%\Start Menu\МЁНеК®°ЛГАЕ®.lnk
- %PROGRAM_FILES%\МЁНеК®°ЛГАЕ®\uninst.exe
- %TEMP%\nsj3.tmp\rfshdktp.dll
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\go[1].html
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\МЁНеК®°ЛГАЕ®.lnk
- %HOMEPATH%\Start Menu\Programs\МЁНеК®°ЛГАЕ®.lnk
- %HOMEPATH%\Favorites\МФ±¦Нш - МФЈЎОТПІ»¶.url
- %HOMEPATH%\Favorites\НшЦ·ґуИ«.url
- %HOMEPATH%\Start Menu\Programs\МЁНеК®°ЛГАЕ®\МФ±¦Нш.url
- %HOMEPATH%\Desktop\МФ±¦Нш.url
- %HOMEPATH%\Desktop\КУЖµНµЕД_Иэ°ЛФЪПЯ.url
- %HOMEPATH%\Start Menu\Programs\ёЯЗеЕЪ,ёЯЗеµзУ°ФЪПЯ.url
- %HOMEPATH%\Desktop\НшЦ·ґуИ«.url
- %PROGRAM_FILES%\МЁНеК®°ЛГАЕ®\МЁНеК®°ЛГАЕ®.exe
- %TEMP%\nss2.tmp
- %HOMEPATH%\Desktop\ёЯЗеЕЪ,ёЯЗеµзУ°ФЪПЯ.url
- <SYSTEM32>\shop.ico
- %HOMEPATH%\Start Menu\Programs\КУЖµНµЕД_Иэ°ЛФЪПЯ.url
- %HOMEPATH%\Start Menu\НшЦ·ґуИ«.url
- %HOMEPATH%\Start Menu\МФ±¦Нш.url
- %HOMEPATH%\Start Menu\Programs\МЁНеК®°ЛГАЕ®\КУЖµНµЕД_Иэ°ЛФЪПЯ.url
- %HOMEPATH%\Start Menu\Programs\МЁНеК®°ЛГАЕ®\ёЯЗеЕЪ,ёЯЗеµзУ°ФЪПЯ.url
- %HOMEPATH%\Start Menu\Programs\НшЦ·ґуИ«.url
- %HOMEPATH%\Start Menu\Programs\МФ±¦Нш.url
- %HOMEPATH%\Start Menu\КУЖµНµЕД_Иэ°ЛФЪПЯ.url
- %HOMEPATH%\Start Menu\ёЯЗеЕЪ,ёЯЗеµзУ°ФЪПЯ.url
Deletes the following files:
- %TEMP%\nsj3.tmp\rfshdktp.dll
- %TEMP%\nsj3.tmp\KillProcDLL.dll
Network activity:
Connects to:
- 'go.##ywow.com':80
- 'localhost':1036
TCP:
HTTP GET requests:
- go.##ywow.com/go.html
UDP:
- DNS ASK go.##ywow.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'MDIClient' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'SysPager' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'TrayNotifyWnd' WindowName: ''
- ClassName: 'ToolBarWindow32' WindowName: ''
