Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Classes\cmdfile\shell\open\command] '' = '"%1" %*'
- [<HKLM>\SOFTWARE\Classes\comfile\shell\open\command] '' = '"%1" %*'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'WebScan' = '%PROGRAM_FILES%\Acceleration Software\Anti-Virus\DEFSCA~1.EXE -k'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'WebScan' = '%PROGRAM_FILES%\Acceleration Software\Anti-Virus\defscangui.exe -k'
- [<HKLM>\SOFTWARE\Classes\batfile\shell\open\command] '' = '"%1" %*'
- [<HKLM>\SOFTWARE\Classes\regfile\shell\open\command] '' = 'regedit.exe "%1"'
- [<HKLM>\SOFTWARE\Classes\exefile\shell\open\command] '' = '"%1" %*'
- [<HKLM>\SOFTWARE\Classes\scrfile\shell\open\command] '' = '"%1" /S'
- [<HKLM>\SOFTWARE\Classes\piffile\shell\open\command] '' = '"%1" %*'
Malicious functions:
Creates and executes the following:
- %PROGRAM_FILES%\Acceleration Software\Anti-Virus\defscangui.exe /RegServer
- %PROGRAM_FILES%\Acceleration Software\Anti-Virus\defscangui.exe Software\Anti-Virus\DEFSCA~1.EXE -startmin
- %PROGRAM_FILES%\Acceleration Software\Anti-Virus\defscangui.exe Software\Anti-Virus\DEFSCA~1.EXE -k
- %TEMP%\EAC2211530672_00000000\regsvr32.exe /s "%PROGRAM_FILES%\Acceleration Software\Anti-Virus\dsshell.dll"
- %TEMP%\EAC2211530672_00000000\setup.exe /Cmd <Full path to virus> <Full path to virus>
- %TEMP%\EAC2211530672_00000000\regsvr32.exe /s "%PROGRAM_FILES%\Acceleration Software\Anti-Virus\scancore.dll"
- %TEMP%\EAC2211530672_00000000\regsvr32.exe /s "%PROGRAM_FILES%\Acceleration Software\Anti-Virus\eac_mindef.dll"
- %TEMP%\EANTHM~1.EXE (downloaded from the Internet)
Modifies file system :
Creates the following files:
- %PROGRAM_FILES%\Acceleration Software\Anti-Virus\exp_head01.gif
- %PROGRAM_FILES%\Acceleration Software\Anti-Virus\exp_head02.gif
- %PROGRAM_FILES%\Acceleration Software\Anti-Virus\skins.ini
- %PROGRAM_FILES%\Acceleration Software\Anti-Virus\sc_mail.gif
- %PROGRAM_FILES%\Acceleration Software\Anti-Virus\sc_firewall.gif
- %PROGRAM_FILES%\Acceleration Software\Anti-Virus\sc_baseline.gif
- %PROGRAM_FILES%\Acceleration Software\Anti-Virus\ealook.dll
- %PROGRAM_FILES%\Acceleration Software\Anti-Virus\scancore.dll.chk
- %PROGRAM_FILES%\Acceleration Software\Anti-Virus\ws_uninst.exe
- %PROGRAM_FILES%\Acceleration Software\Anti-Virus\defscangui.exe
- %PROGRAM_FILES%\Acceleration Software\Anti-Virus\shexclude.dat
- %PROGRAM_FILES%\Acceleration Software\Anti-Virus\clnrchk.dat
- %PROGRAM_FILES%\Acceleration Software\Anti-Virus\stop-sign_icon03.gif
- %PROGRAM_FILES%\Acceleration Software\Anti-Virus\sc_spam.gif
- %ALLUSERSPROFILE%\Start Menu\Programs\eAcceleration\Stop-Sign\Start Scan.lnk
- %HOMEPATH%\Desktop\Scan Now for Viruses and Threats.lnk
- %PROGRAM_FILES%\Acceleration Software\Anti-Virus\dsshell.dll
- %TEMP%\eanthmngr_update.exe
- %ALLUSERSPROFILE%\Start Menu\Programs\eAcceleration\Stop-Sign\Threat Cleaner.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\eAcceleration\Stop-Sign\Threat Scanner Settings.lnk
- %PROGRAM_FILES%\Acceleration Software\Anti-Virus\eac_mindef.dll
- %PROGRAM_FILES%\Acceleration Software\Anti-Virus\lspfix.txt
- %PROGRAM_FILES%\Acceleration Software\Anti-Virus\lspfix.exe
- %PROGRAM_FILES%\Acceleration Software\Anti-Virus\cure_rslt01.gif
- %PROGRAM_FILES%\Acceleration Software\Anti-Virus\scancore.dll
- %PROGRAM_FILES%\Acceleration Software\Anti-Virus\xprestore.vbs
- %PROGRAM_FILES%\Acceleration Software\Anti-Virus\restore_instructions.txt
- %TEMP%\EAC2211530672_00000000\dsshell.dll
- %TEMP%\EAC2211530672_00000000\clnrchk.dat
- %TEMP%\EAC2211530672_00000000\stop-sign_icon03.gif
- %TEMP%\EAC2211530672_00000000\shexclude.dat
- %TEMP%\EAC2211530672_00000000\InstRvn.exe
- %TEMP%\EAC2211530672_00000000\comp.chk
- %TEMP%\EAC2211530672_00000000\eac_mindef.dll
- %TEMP%\EAC2211530672_00000000\scancore.dll
- %TEMP%\EAC2211530672_00000000\defscangui.exe
- %TEMP%\EAC2211530672_00000000\setup.ini
- %TEMP%\EAC2211530672_00000000\setup.exe
- %TEMP%\EAC2211530672_00000000\ws_uninst.exe
- %TEMP%\EAC2211530672_00000000\regsvr32.exe
- %TEMP%\EAC2211530672_00000000\ealook.dll
- %TEMP%\EAC2211530672_00000000\lspfix.txt
- %TEMP%\EAC2211530672_00000000\lspfix.exe
- %TEMP%\EAC2211530672_00000000\cure_rslt01.gif
- %PROGRAM_FILES%\Acceleration Software\Anti-Virus\regsvr32.exe
- %TEMP%\EAC2211530672_00000000\xprestore.vbs
- %TEMP%\EAC2211530672_00000000\restore_instructions.txt
- %TEMP%\EAC2211530672_00000000\sc_spam.gif
- %TEMP%\EAC2211530672_00000000\exp_head01.gif
- %TEMP%\EAC2211530672_00000000\exp_head02.gif
- %TEMP%\EAC2211530672_00000000\skins.ini
- %TEMP%\EAC2211530672_00000000\sc_mail.gif
- %TEMP%\EAC2211530672_00000000\sc_firewall.gif
- %TEMP%\EAC2211530672_00000000\sc_baseline.gif
Deletes the following files:
- %TEMP%\EAC2211530672_00000000\sc_mail.gif
- %TEMP%\EAC2211530672_00000000\sc_spam.gif
- %TEMP%\EAC2211530672_00000000\setup.exe
- %TEMP%\EAC2211530672_00000000\sc_firewall.gif
- %TEMP%\EAC2211530672_00000000\scancore.dll
- %TEMP%\EAC2211530672_00000000\scancore.dll.chk
- %TEMP%\EAC2211530672_00000000\sc_baseline.gif
- %TEMP%\EAC2211530672_00000000\stop-sign_icon03.gif
- %TEMP%\EAC2211530672_00000000\ws_uninst.exe
- %TEMP%\EAC2211530672_00000000\xprestore.vbs
- %TEMP%\EAC2211530672_00000000\skins.ini
- %TEMP%\EAC2211530672_00000000\setup.ini
- %TEMP%\EAC2211530672_00000000\shexclude.dat
- %TEMP%\EAC2211530672_00000000\shexclude.dat.chk
- %TEMP%\EAC2211530672_00000000\restore_instructions.txt
- %TEMP%\EAC2211530672_00000000\defscangui.exe
- %TEMP%\EAC2211530672_00000000\dsshell.dll
- %TEMP%\EAC2211530672_00000000\eac_mindef.dll
- %TEMP%\EAC2211530672_00000000\cure_rslt01.gif
- %TEMP%\EAC2211530672_00000000\clnrchk.dat
- %TEMP%\EAC2211530672_00000000\clnrchk.dat.chk
- %TEMP%\EAC2211530672_00000000\comp.chk
- %TEMP%\EAC2211530672_00000000\lspfix.exe
- %TEMP%\EAC2211530672_00000000\lspfix.txt
- %TEMP%\EAC2211530672_00000000\regsvr32.exe
- %TEMP%\EAC2211530672_00000000\InstRvn.exe
- %TEMP%\EAC2211530672_00000000\ealook.dll
- %TEMP%\EAC2211530672_00000000\exp_head01.gif
- %TEMP%\EAC2211530672_00000000\exp_head02.gif
Network activity:
Connects to:
- 'de#########wnloads.eacceleration.com':80
TCP:
HTTP GET requests:
- de#########wnloads.eacceleration.com/defender/UPDATES/eanthmngr_update.exe?x=##########
UDP:
- DNS ASK de#########wnloads.eacceleration.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'EaccelerationInstall_DataReceivingWindowClass' WindowName: ''
