Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'csrss' = '"%ALLUSERSPROFILE%\Sun\Java\Java Update\csrss.exe"'
- [<HKLM>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe, "%ALLUSERSPROFILE%\Sun\Java\Java Update\csrss.exe"'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'wininit' = '"%ALLUSERSPROFILE%\Desktop\wininit.exe"'
- [<HKLM>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe, "%ALLUSERSPROFILE%\Sun\Java\Java Update\csrss.exe", "%ALLUSERSPROFILE%\Desktop\wininit.exe"'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'explorer' = '"%ProgramFiles(x86)%\Microsoft Office\Office14\explorer.exe"'
- [<HKLM>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe, "%ALLUSERSPROFILE%\Sun\Java\Java Update\csrss.exe", "%ALLUSERSPROFILE%\Desktop\wininit.exe", "%ProgramFil...
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'dwm' = '"%ProgramFiles%\CavApp\dwm.exe"'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] '<File name>' = '"C:\Documents and Settings\<File name>.exe"'
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'Idle' = '"C:\Far2\Addons\SetUp\Idle.exe"'
Creates or modifies the following files
- <SYSTEM32>\tasks\ayp3csrss
- <SYSTEM32>\tasks\kfxoidle
- <SYSTEM32>\tasks\<File name>
- <SYSTEM32>\tasks\25rfidle
- <SYSTEM32>\tasks\gdnw<File name>
- <SYSTEM32>\tasks\7iyc<File name>
- <SYSTEM32>\tasks\vp4r<File name>
- <SYSTEM32>\tasks\dwm
- <SYSTEM32>\tasks\lnfhdwm
- <SYSTEM32>\tasks\sptxdwm
- <SYSTEM32>\tasks\3hnfdwm
- <SYSTEM32>\tasks\explorer
- <SYSTEM32>\tasks\nkonexplorer
- <SYSTEM32>\tasks\w9npexplorer
- <SYSTEM32>\tasks\gn9eexplorer
- <SYSTEM32>\tasks\wininit
- <SYSTEM32>\tasks\xwc1wininit
- <SYSTEM32>\tasks\ofyrwininit
- <SYSTEM32>\tasks\g754wininit
- <SYSTEM32>\tasks\mpfdcsrss
- <SYSTEM32>\tasks\csrss
- <SYSTEM32>\tasks\vcyfcsrss
- <SYSTEM32>\tasks\s2x8idle
- <SYSTEM32>\tasks\idle
Malicious functions
To complicate detection of its presence in the operating system,
blocks the following features:
- User Account Control (UAC)
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\sun\java\java update\csrss.exe
- C:\documents and settings\rcxdddb.tmp
- C:\documents and settings\rcxdc25.tmp
- %ProgramFiles%\cavapp\rcxd8ea.tmp
- %ProgramFiles%\cavapp\rcxd791.tmp
- %ProgramFiles(x86)%\microsoft office\office14\rcxd427.tmp
- %ProgramFiles(x86)%\microsoft office\office14\rcxd242.tmp
- %ALLUSERSPROFILE%\desktop\rcxce6a.tmp
- %ALLUSERSPROFILE%\desktop\rcxcd22.tmp
- %ALLUSERSPROFILE%\sun\java\java update\rcxca05.tmp
- %ALLUSERSPROFILE%\sun\java\java update\rcxc8bd.tmp
- <Current directory>\rcxc5ee.tmp
- <Current directory>\rcxc541.tmp
- C:\far2\addons\setup\6ccacd8608530f
- C:\far2\addons\setup\idle.exe
- C:\documents and settings\a87477d6070a16
- C:\documents and settings\<File name>.exe
- %ProgramFiles%\cavapp\6cb0b6c459d5d3
- %ProgramFiles%\cavapp\dwm.exe
- %ProgramFiles(x86)%\microsoft office\office14\7a0fd90576e088
- %ProgramFiles(x86)%\microsoft office\office14\explorer.exe
- %ALLUSERSPROFILE%\desktop\56085415360792
- %ALLUSERSPROFILE%\desktop\wininit.exe
- %ALLUSERSPROFILE%\sun\java\java update\886983d96e3d3e
- C:\far2\addons\setup\rcxe117.tmp
- C:\far2\addons\setup\rcxe240.tmp
Sets the 'hidden' attribute to the following files
- <Full path to file>
- %ALLUSERSPROFILE%\sun\java\java update\csrss.exe
- %ALLUSERSPROFILE%\desktop\wininit.exe
- %ProgramFiles(x86)%\microsoft office\office14\explorer.exe
- %ProgramFiles%\cavapp\dwm.exe
- C:\documents and settings\<File name>.exe
- C:\far2\addons\setup\idle.exe
Moves the following files
- from <Current directory>\rcxc5ee.tmp to <Full path to file>
- from %ALLUSERSPROFILE%\sun\java\java update\rcxc8bd.tmp to %ALLUSERSPROFILE%\sun\java\java update\csrss.exe
- from %ALLUSERSPROFILE%\sun\java\java update\rcxca05.tmp to %ALLUSERSPROFILE%\sun\java\java update\csrss.exe
- from %ALLUSERSPROFILE%\desktop\rcxcd22.tmp to %ALLUSERSPROFILE%\desktop\wininit.exe
- from %ALLUSERSPROFILE%\desktop\rcxce6a.tmp to %ALLUSERSPROFILE%\desktop\wininit.exe
- from %ProgramFiles(x86)%\microsoft office\office14\rcxd242.tmp to %ProgramFiles(x86)%\microsoft office\office14\explorer.exe
- from %ProgramFiles(x86)%\microsoft office\office14\rcxd427.tmp to %ProgramFiles(x86)%\microsoft office\office14\explorer.exe
- from %ProgramFiles%\cavapp\rcxd791.tmp to %ProgramFiles%\cavapp\dwm.exe
- from %ProgramFiles%\cavapp\rcxd8ea.tmp to %ProgramFiles%\cavapp\dwm.exe
- from C:\documents and settings\rcxdc25.tmp to C:\documents and settings\<File name>.exe
- from C:\documents and settings\rcxdddb.tmp to C:\documents and settings\<File name>.exe
- from C:\far2\addons\setup\rcxe117.tmp to C:\far2\addons\setup\idle.exe
- from C:\far2\addons\setup\rcxe240.tmp to C:\far2\addons\setup\idle.exe
Modifies the HOSTS file.
Miscellaneous
Creates and executes the following
- '%ProgramFiles%\cavapp\dwm.exe'
- '%ProgramFiles%\cavapp\dwm.exe' ' (with hidden window)
Executes the following
- '<SYSTEM32>\schtasks.exe' /create /tn "aYP3csrss" /sc MINUTE /mo 7 /tr "'%ALLUSERSPROFILE%\Sun\Java\Java Update\csrss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "kFXOIdle" /sc ONLOGON /tr "'C:\Far2\Addons\SetUp\Idle.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "25rFIdle" /sc MINUTE /mo 9 /tr "'C:\Far2\Addons\SetUp\Idle.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "<File name>" /sc MINUTE /mo 9 /tr "'C:\Documents and Settings\<File name>.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "gDnw<File name>" /sc ONSTART /tr "'C:\Documents and Settings\<File name>.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "7iyC<File name>" /sc ONLOGON /tr "'C:\Documents and Settings\<File name>.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "vP4r<File name>" /sc MINUTE /mo 8 /tr "'C:\Documents and Settings\<File name>.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "dwm" /sc MINUTE /mo 12 /tr "'%ProgramFiles%\CavApp\dwm.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "lNFHdwm" /sc ONSTART /tr "'%ProgramFiles%\CavApp\dwm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "sptxdwm" /sc ONLOGON /tr "'%ProgramFiles%\CavApp\dwm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "3hNfdwm" /sc MINUTE /mo 5 /tr "'%ProgramFiles%\CavApp\dwm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "explorer" /sc MINUTE /mo 13 /tr "'%ProgramFiles(x86)%\Microsoft Office\Office14\explorer.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "nkOnexplorer" /sc ONSTART /tr "'%ProgramFiles(x86)%\Microsoft Office\Office14\explorer.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "W9npexplorer" /sc ONLOGON /tr "'%ProgramFiles(x86)%\Microsoft Office\Office14\explorer.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "gn9eexplorer" /sc MINUTE /mo 7 /tr "'%ProgramFiles(x86)%\Microsoft Office\Office14\explorer.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "wininit" /sc MINUTE /mo 5 /tr "'%ALLUSERSPROFILE%\Desktop\wininit.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "xwc1wininit" /sc ONSTART /tr "'%ALLUSERSPROFILE%\Desktop\wininit.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "OfYrwininit" /sc ONLOGON /tr "'%ALLUSERSPROFILE%\Desktop\wininit.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "g754wininit" /sc MINUTE /mo 11 /tr "'%ALLUSERSPROFILE%\Desktop\wininit.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "csrss" /sc MINUTE /mo 6 /tr "'%ALLUSERSPROFILE%\Sun\Java\Java Update\csrss.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "vcYfcsrss" /sc ONSTART /tr "'%ALLUSERSPROFILE%\Sun\Java\Java Update\csrss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "mpfDcsrss" /sc ONLOGON /tr "'%ALLUSERSPROFILE%\Sun\Java\Java Update\csrss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "s2X8Idle" /sc ONSTART /tr "'C:\Far2\Addons\SetUp\Idle.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "Idle" /sc MINUTE /mo 9 /tr "'C:\Far2\Addons\SetUp\Idle.exe'" /f
