Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\Software\Classes\GoogleDesktop.search\shell\open\command] '' = '"%ProgramFiles(x86)%\Google\Google Desktop Search\GoogleDesktop.exe" /search "%1"'
- [HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows] 'AppInit_DLLs' = '%ProgramFiles%\Google\GOOGLE~1\GO36F4~1.DLL'
- [HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows] 'LoadAppInit_DLLs' = '00000001'
- [HKLM\Software\Classes\GoogleGadget\shell\open\command] '' = '"%ProgramFiles(x86)%\Google\Google Desktop Search\GoogleDesktop.exe" /display /load "%1"'
- [HKLM\Software\Classes\GoogleGadgetContainer\shell\open\command] '' = '"%ProgramFiles(x86)%\Google\Google Desktop Search\GoogleDesktop.exe" /display /load "%1"'
- [HKLM\Software\Classes\GoogleGadgetManifest\shell\open\command] '' = '"%ProgramFiles(x86)%\Google\Google Desktop Search\GoogleDesktop.exe" /display /load "%1"'
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\GoogleDesktopManager-051210-111108] 'ImagePath' = '"%ProgramFiles(x86)%\Google\Google Desktop Search\GoogleDesktop.exe"'
Creates the following services
- 'tunnel' system32\DRIVERS\tunnel.sys
- 'GoogleDesktopManager-051210-111108' %ProgramFiles(x86)%\Google\Google Desktop Search\GoogleDesktop.exe
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\explorer.exe
Installs hooks to intercept notifications
on keystrokes:
- Handler for all processes: %ProgramFiles(x86)%\Google\Google Desktop Search\GoogleServices.DLL
Modifies file system
Creates the following files
- %WINDIR%\googled@7.exe
- %WINDIR%\googled.exe
- %ProgramFiles(x86)%\google\google desktop search\gcdtmp1\googledesktopresources_en.dll
- %ProgramFiles(x86)%\google\google desktop search\gcdtmp1\googledesktopcommon.dll
- %TEMP%\config.txt
- %ProgramFiles(x86)%\google\google desktop search\gcdtmp1\googledesktopsetuphelper.exe
- %ProgramFiles(x86)%\google\google desktop search\gcdtmp1\googleservices.dll
- %ALLUSERSPROFILE%\51m5t\3eb93@7\b
- %ALLUSERSPROFILE%\51m5t\3eb93@7\px.txt
- %ALLUSERSPROFILE%\51m5t\3eb93@7\qqsetupex.exe
- %ALLUSERSPROFILE%\51m5t\3eb93@7\v
- %ProgramFiles(x86)%\google\google desktop search\favicon.ico
- %ProgramFiles(x86)%\google\google desktop search\_new_googledesktopresources_en.dll
- %ProgramFiles(x86)%\google\google desktop search\_new_googledesktop.exe
- %ProgramFiles(x86)%\google\google desktop search\_new_googledesktopie.dll
- %ProgramFiles(x86)%\google\google desktop search\_new_googledesktopapi2.dll
- %ProgramFiles(x86)%\google\google desktop search\_new_googledesktopoffice.dll
- %ProgramFiles(x86)%\google\google desktop search\_new_gzlib.dll
- %ProgramFiles(x86)%\google\google desktop search\_new_googledesktopcommon.dll
- %ProgramFiles(x86)%\google\google desktop search\_new_googledesktopmozilla.dll
- %ProgramFiles(x86)%\google\google desktop search\_new_googledesktopmozillastub.js
- %ProgramFiles(x86)%\google\google desktop search\_new_googledesktopmozillastub.xpt
- %ProgramFiles(x86)%\google\google desktop search\_new_googledesktopdeskbar2.dll
- %ProgramFiles(x86)%\google\google desktop search\_new_googledesktopmail.dll
- %ProgramFiles(x86)%\google\google desktop search\_new_googledesktophyper.dll
- %ProgramFiles(x86)%\google\google desktop search\_new_googledesktopnetwork3.dll
- %ProgramFiles(x86)%\google\google desktop search\_new_plugin_common.js
- %ProgramFiles(x86)%\google\google desktop search\_new_plugin_common.vbs
- %ProgramFiles(x86)%\google\google desktop search\_new_topic_sites.dat
- %ProgramFiles(x86)%\google\google desktop search\_new_googledesktopssd.dll
- %ProgramFiles(x86)%\google\google desktop search\_new_googleuiengine.dll
- %ProgramFiles(x86)%\google\google desktop search\_new_analogclock_en.gg_new_
- %ProgramFiles(x86)%\google\google desktop search\_new_weather_en.gg_new_
- %ProgramFiles(x86)%\google\google desktop search\_new_gpac.xml
- %ProgramFiles(x86)%\google\google desktop search\_new_googleservices.dll
- %ProgramFiles(x86)%\google\google desktop search\_new_sites.txt
- %ProgramFiles(x86)%\google\google desktop search\_new_googledesktop64bit.dll
- %ProgramFiles(x86)%\google\google desktop search\_new_googledesktop64bitlaunch.exe
- %ProgramFiles(x86)%\google\google desktop search\googledesktopsetup.exe
- %ProgramFiles(x86)%\google\google desktop search\aa ### warning - do not
- %ProgramFiles(x86)%\google\google desktop search\ab ### move or delete these
- %ProgramFiles(x86)%\google\google desktop search\ac ### files - your system
- %ProgramFiles(x86)%\google\google desktop search\ad ### may stop working
- %ProgramFiles(x86)%\google\google desktop search\ae ###
- %ProgramFiles(x86)%\google\google desktop search\af ### to uninstall use
- %ProgramFiles(x86)%\google\google desktop search\ag ### add-remove programs
- %ProgramFiles(x86)%\google\google desktop search\ah ### in the control panel
- %ProgramFiles(x86)%\google\google desktop search\ai ### or run
- %ProgramFiles(x86)%\google\google desktop search\aj ###
- %ProgramFiles(x86)%\google\google desktop search\ak ### googledesktopsetup.exe -uninstall
- %ProgramFiles(x86)%\google\google desktop search\al ###
- %ALLUSERSPROFILE%\ccrn.url
- %ProgramFiles(x86)%\google\google desktop search\gcdtmp1\googledesktop.exe
- %ProgramFiles(x86)%\google\google desktop search\googledesktopresources_en.dll
- %ProgramFiles(x86)%\google\google desktop search\googledesktop.exe
- %ProgramFiles(x86)%\google\google desktop search\googledesktopie.dll
- %ProgramFiles(x86)%\google\google desktop search\googledesktopapi2.dll
- %ProgramFiles(x86)%\google\google desktop search\googledesktopoffice.dll
- %ProgramFiles(x86)%\google\google desktop search\gzlib.dll
- %ProgramFiles(x86)%\google\google desktop search\googledesktopcommon.dll
- %ProgramFiles(x86)%\google\google desktop search\googledesktopmozilla.dll
- %ProgramFiles(x86)%\google\google desktop search\googledesktopdeskbar2.dll
- %ProgramFiles(x86)%\google\google desktop search\googledesktopmail.dll
- %ProgramFiles(x86)%\google\google desktop search\googledesktophyper.dll
- %ProgramFiles(x86)%\google\google desktop search\googledesktopnetwork3.dll
- %ProgramFiles(x86)%\google\google desktop search\googledesktopssd.dll
- %ProgramFiles(x86)%\google\google desktop search\googleuiengine.dll
- %ProgramFiles(x86)%\google\google desktop search\googleservices.dll
- %ProgramFiles(x86)%\google\google desktop search\googledesktop64bit.dll
- %ProgramFiles(x86)%\google\google desktop search\googledesktop64bitlaunch.exe
- %LOCALAPPDATA%\google\custom buttons\googledesktop.xml
- %LOCALAPPDATA%\google\google desktop\df0515461116\dbeao
- %LOCALAPPDATA%\google\google desktop\df0515461116\dbdao
- %LOCALAPPDATA%\google\google desktop\df0515461116\dbu2d.ht1
- %LOCALAPPDATA%\google\google desktop\df0515461116\dbc2e.ht1
- %LOCALAPPDATA%\google\google desktop\df0515461116\dbvmh.ht1
- %LOCALAPPDATA%\google\google desktop\df0515461116\dbvm.cf1
- %LOCALAPPDATA%\google\google desktop\df0515461116\dbm
- %LOCALAPPDATA%\google\google desktop\df0515461116\fiih.ht1
- %LOCALAPPDATA%\google\google desktop\df0515461116\fii.cf1
- %LOCALAPPDATA%\google\google desktop\df0515461116\fiid-tmp
- %LOCALAPPDATA%\google\google desktop\df0515461116\rpmh.ht1
- %LOCALAPPDATA%\google\google desktop\df0515461116\rpm.cf1
- %LOCALAPPDATA%\google\google desktop\df0515461116\rpm1mh.ht1
- %LOCALAPPDATA%\google\google desktop\df0515461116\rpm1m.cf1
- %LOCALAPPDATA%\google\google desktop\df0515461116\hpt2i.ht1
- %LOCALAPPDATA%\google\google desktop\df0515461116\hp
Deletes the following files
- %ALLUSERSPROFILE%\ccrn.url
- %ALLUSERSPROFILE%\51m5t\3eb93@7\v
- %ALLUSERSPROFILE%\51m5t\3eb93@7\b
Moves the following files
- from %ProgramFiles(x86)%\google\google desktop search\_new_googledesktopresources_en.dll to %ProgramFiles(x86)%\google\google desktop search\googledesktopresources_en.dll
- from %ProgramFiles(x86)%\google\google desktop search\_new_googledesktop.exe to %ProgramFiles(x86)%\google\google desktop search\googledesktop.exe
- from %ProgramFiles(x86)%\google\google desktop search\_new_googledesktopie.dll to %ProgramFiles(x86)%\google\google desktop search\googledesktopie.dll
- from %ProgramFiles(x86)%\google\google desktop search\_new_googledesktopapi2.dll to %ProgramFiles(x86)%\google\google desktop search\googledesktopapi2.dll
- from %ProgramFiles(x86)%\google\google desktop search\_new_googledesktopoffice.dll to %ProgramFiles(x86)%\google\google desktop search\googledesktopoffice.dll
- from %ProgramFiles(x86)%\google\google desktop search\_new_gzlib.dll to %ProgramFiles(x86)%\google\google desktop search\gzlib.dll
- from %ProgramFiles(x86)%\google\google desktop search\_new_googledesktopcommon.dll to %ProgramFiles(x86)%\google\google desktop search\googledesktopcommon.dll
- from %ProgramFiles(x86)%\google\google desktop search\_new_googledesktopmozilla.dll to %ProgramFiles(x86)%\google\google desktop search\googledesktopmozilla.dll
- from %ProgramFiles(x86)%\google\google desktop search\_new_googledesktopmozillastub.js to %ProgramFiles(x86)%\google\google desktop search\googledesktopmozillastub.js
- from %ProgramFiles(x86)%\google\google desktop search\_new_googledesktopmozillastub.xpt to %ProgramFiles(x86)%\google\google desktop search\googledesktopmozillastub.xpt
- from %ProgramFiles(x86)%\google\google desktop search\_new_googledesktopdeskbar2.dll to %ProgramFiles(x86)%\google\google desktop search\googledesktopdeskbar2.dll
- from %ProgramFiles(x86)%\google\google desktop search\_new_googledesktopmail.dll to %ProgramFiles(x86)%\google\google desktop search\googledesktopmail.dll
- from %ProgramFiles(x86)%\google\google desktop search\_new_googledesktophyper.dll to %ProgramFiles(x86)%\google\google desktop search\googledesktophyper.dll
- from %ProgramFiles(x86)%\google\google desktop search\_new_googledesktopnetwork3.dll to %ProgramFiles(x86)%\google\google desktop search\googledesktopnetwork3.dll
- from %ProgramFiles(x86)%\google\google desktop search\_new_plugin_common.js to %ProgramFiles(x86)%\google\google desktop search\plugin_common.js
- from %ProgramFiles(x86)%\google\google desktop search\_new_plugin_common.vbs to %ProgramFiles(x86)%\google\google desktop search\plugin_common.vbs
- from %ProgramFiles(x86)%\google\google desktop search\_new_topic_sites.dat to %ProgramFiles(x86)%\google\google desktop search\topic_sites.dat
- from %ProgramFiles(x86)%\google\google desktop search\_new_googledesktopssd.dll to %ProgramFiles(x86)%\google\google desktop search\googledesktopssd.dll
- from %ProgramFiles(x86)%\google\google desktop search\_new_googleuiengine.dll to %ProgramFiles(x86)%\google\google desktop search\googleuiengine.dll
- from %ProgramFiles(x86)%\google\google desktop search\_new_analogclock_en.gg_new_ to %ProgramFiles(x86)%\google\google desktop search\analogclock_en.gg
- from %ProgramFiles(x86)%\google\google desktop search\_new_weather_en.gg_new_ to %ProgramFiles(x86)%\google\google desktop search\weather_en.gg
- from %ProgramFiles(x86)%\google\google desktop search\_new_gpac.xml to %ProgramFiles(x86)%\google\google desktop search\gpac.xml
- from %ProgramFiles(x86)%\google\google desktop search\_new_googleservices.dll to %ProgramFiles(x86)%\google\google desktop search\googleservices.dll
- from %ProgramFiles(x86)%\google\google desktop search\_new_sites.txt to %ProgramFiles(x86)%\google\google desktop search\sites.txt
- from %ProgramFiles(x86)%\google\google desktop search\_new_googledesktop64bit.dll to %ProgramFiles(x86)%\google\google desktop search\googledesktop64bit.dll
- from %ProgramFiles(x86)%\google\google desktop search\_new_googledesktop64bitlaunch.exe to %ProgramFiles(x86)%\google\google desktop search\googledesktop64bitlaunch.exe
- from %LOCALAPPDATA%\google\google desktop\df0515461116\fiid-tmp to %LOCALAPPDATA%\google\google desktop\df0515461116\fiid
Network activity
Connects to
- 'localhost':4664
TCP
Other
- '34.##9.100.209':443
UDP
- 'localhost':50712
- 'localhost':64819
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
- ClassName: '_GD_MonMD' WindowName: ''
- ClassName: 'Progman' WindowName: ''
- ClassName: '_GD_Sidebar' WindowName: ''
- ClassName: 'IEFrame' WindowName: ''
Creates and executes the following
- '%WINDIR%\googled.exe'
- '%WINDIR%\googled@7.exe'
- '%ProgramFiles(x86)%\google\google desktop search\gcdtmp1\googledesktopsetuphelper.exe' /mdo
- '%ProgramFiles(x86)%\google\google desktop search\googledesktop.exe' /system /regserver /quit
- '%ProgramFiles(x86)%\google\google desktop search\gcdtmp1\googledesktop.exe' /manager /service /path "%ProgramFiles(x86)%\Google\Google Desktop Search\"
- '%ALLUSERSPROFILE%\51m5t\3eb93@7\qqsetupex.exe'
- '%ProgramFiles(x86)%\google\google desktop search\googledesktop.exe' /display /regserver /quit
- '%ProgramFiles(x86)%\google\google desktop search\googledesktop.exe' /system /gdupdate /quit /system
- '%ProgramFiles(x86)%\google\google desktop search\googledesktop64bitlaunch.exe' 00430072006500610074006500500072006F0063006500730073 000004DC 0043003A005C00500072006F006700720061006D002000460069006C00650073002000280078003800360029005C0047006F006F0067006C0065005C0047006F006...
- '%ProgramFiles(x86)%\google\google desktop search\googledesktop.exe'
- '%ProgramFiles(x86)%\google\google desktop search\googledesktop.exe' /display /userreg /quit
