Technical Information
Malicious functions:
Executes the following:
- '<SYSTEM32>\wsqmcons.exe'
- '<SYSTEM32>\rundll32.exe' dfdts.dll,DfdGetDefaultPolicyAndSMART
- '<SYSTEM32>\schtasks.exe' /delete /f /TN "Microsoft\Windows\Customer Experience Improvement Program\Uploader"
- '<SYSTEM32>\sc.exe' start w32time task_started
- '<SYSTEM32>\sdclt.exe' /CONFIGNOTIFICATION
- '<SYSTEM32>\taskhost.exe' $(Arg0)
Modifies file system :
Creates the following files:
- C:\ProgramData\Microsoft\RAC\Temp\sqlF45D.tmp
- C:\ProgramData\Microsoft\RAC\Temp\sqlF102.tmp
Deletes the following files:
- C:\ProgramData\Microsoft\RAC\Temp\sqlF102.tmp
- C:\ProgramData\Microsoft\RAC\Temp\sqlF45D.tmp
Network activity:
UDP:
- DNS ASK dn#.##ftncsi.com
- DNS ASK ti##.#indows.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'SkinWnd' WindowName: '(null)'
- ClassName: 'Google Talk - Google Xmpp Client GUI Window' WindowName: 'Google Talk'
- ClassName: 'Miranda' WindowName: '(null)'
- ClassName: 'SEINFELD_SUPERMAN' WindowName: 'PaltalkScene'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'tSkMainForm.UnicodeClass' WindowName: '(null)'
- ClassName: 'tSkMainForm' WindowName: '(null)'
- ClassName: 'MRAContactList2' WindowName: '(null)'
- ClassName: 'ContactsHostWindowICQ' WindowName: '(null)'
- ClassName: 'ContactsHostWindow' WindowName: '(null)'
- ClassName: 'MRA_SENDRECEIVE' WindowName: '(null)'
- ClassName: '__oxFrame.class__' WindowName: 'ICQ'
- ClassName: 'YahooBuddyMain' WindowName: '(null)'
- ClassName: 'icoTrilly' WindowName: '(null)'
