Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- C:\xbnnphvxbc.tmpx
Malicious functions:
Executes the following:
- '<SYSTEM32>\monlaueejrra\explorer.exe'
- '<SYSTEM32>\tvfmkjvavhdu\smss.exe'
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\cmd.exe
Modifies file system:
Creates the following files:
- C:\..F11S\svchost.exe
- <SYSTEM32>\dydy.ico
- <SYSTEM32>\ttao.ico
- %ProgramFiles%\Outlook Express\msimn.exe.new
- C:\xbnnphvxbc.tmpx
- <SYSTEM32>\dllcache\msimn.exe.new
- C:\..F11S\ctfmon.exe
- C:\fxwcjqtwmi.tmp6
- C:\vvnxeyptbw.tmp1
- <SYSTEM32>\monlaueejrra\explorer.exe
- <SYSTEM32>\tvfmkjvavhdu\smss.exe
- C:\lmhvguloss.tmp2
- C:\tntiihloiv.tmp5
- C:\ltbyflfdqg.tmp4
- C:\iirrqmadlo.tmp3
Sets the 'hidden' attribute to the following files:
- C:\..F11S\ctfmon.exe
- C:\..F11S\svchost.exe
- <SYSTEM32>\tvfmkjvavhdu\smss.exe
- <SYSTEM32>\monlaueejrra\explorer.exe
Deletes the following files:
- C:\tntiihloiv.tmp5
- C:\fxwcjqtwmi.tmp6
- C:\ltbyflfdqg.tmp4
- C:\lmhvguloss.tmp2
- C:\iirrqmadlo.tmp3
Moves the following files:
- from C:\vvnxeyptbw.tmp1 to %ALLUSERSPROFILE%\Desktop\Internet. Explorer..lnk
Miscellaneous:
Searches for the following windows:
- ClassName: 'Maxthon2_Frame' WindowName: ''
- ClassName: '360se_Frame' WindowName: ''
- ClassName: 'IEFrame' WindowName: ''
- ClassName: '_____TTFrameWnd__101__' WindowName: ''
