Technical Information
Malicious functions:
Creates and executes the following:
- '<SYSTEM32>\AppData.exe'
Executes the following:
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\7ZSfx000.cmd" "
- '<SYSTEM32>\regini.exe' regset.ini
- '<SYSTEM32>\ping.exe' 127.0.0.1 -n 1
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system :
Creates the following files:
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\cwdgt0y8.default\localstore.rdf
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\cwdgt0y8.default\mimeTypes.rdf
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\cwdgt0y8.default\permissions.sqlite
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\cwdgt0y8.default\key3.db
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions.ini
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions.sqlite
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\cwdgt0y8.default\formhistory.sqlite
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\cwdgt0y8.default\places.sqlite
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\cwdgt0y8.default\secmod.db
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\cwdgt0y8.default\sessionstore.bak
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\cwdgt0y8.default\sessionstore.js
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\cwdgt0y8.default\search.sqlite
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\cwdgt0y8.default\pluginreg.dat
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\cwdgt0y8.default\prefs.js
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\cwdgt0y8.default\search.json
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\cwdgt0y8.default\downloads.sqlite
- %APPDATA%\CoralExplorer\Users\Default\StartPageConfig.data
- %APPDATA%\Tencent\QQBrowser\webkit_cache\2\Local Storage\__0.localstorage
- %TEMP%\7ZSfx000.cmd
- %APPDATA%\CoralExplorer\Users\Default\Favorites.data
- %APPDATA%\SogouExplorer\Favorite2.dat
- %APPDATA%\Maxthon3\Users\guest\QuickAccess\QaConfig.dat
- %APPDATA%\Tencent\TencentTraveler\100\TtConf.dat
- C:\Documents and Settings\Default User\Application Data\winscp.rnd
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\cwdgt0y8.default\compatibility.ini
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\cwdgt0y8.default\content-prefs.sqlite
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\cwdgt0y8.default\cookies.sqlite
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\cwdgt0y8.default\chromeappsstore.sqlite
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\profiles.ini
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\cwdgt0y8.default\bookmarks.html
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\cwdgt0y8.default\cert8.db
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\cwdgt0y8.default\signons.sqlite
- C:\Documents and Settings\Default User\Favorites\特价飞机票.url
- C:\Documents and Settings\Default User\Favorites\系统之家-最新系统下载.url
- C:\Documents and Settings\Default User\Favorites\链接\3699小游戏.url
- C:\Documents and Settings\Default User\Favorites\淘宝皇冠店铺.url
- C:\Documents and Settings\Default User\Favorites\好吃-别流口水.url
- C:\Documents and Settings\Default User\Favorites\时尚女人专柜.url
- C:\Documents and Settings\Default User\Favorites\淘宝每日低价商品抢购中！.url
- C:\Documents and Settings\Default User\Favorites\链接\9233安全网址导航.url
- C:\Documents and Settings\Default User\Favorites\链接\淘宝皇冠店铺.url
- C:\Documents and Settings\Default User\Favorites\链接\特价飞机票.url
- C:\Documents and Settings\Default User\Favorites\链接\系统之家-最新系统下载.url
- C:\Documents and Settings\Default User\Favorites\链接\淘宝每日低价商品抢购中！.url
- C:\Documents and Settings\Default User\Favorites\链接\Win7之家-各种Windows系统下载.url
- C:\Documents and Settings\Default User\Favorites\链接\好吃-别流口水.url
- C:\Documents and Settings\Default User\Favorites\链接\时尚女人专柜.url
- C:\Documents and Settings\Default User\Favorites\Win7之家-各种Windows系统下载.url
- C:\Documents and Settings\Default User\Application Data\Microsoft\Windows\Themes\Custom.theme
- C:\Documents and Settings\Default User\Application Data\Microsoft\Media Player\0007F0B7.wpl
- C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\Desktop.htt
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\cwdgt0y8.default\bookmarkbackups\bookmarks-2011-11-10.json
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\cwdgt0y8.default\webappsstore.sqlite
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\userChrome-example.css
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\userContent-example.css
- C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini
- C:\Documents and Settings\Default User\Application Data\Microsoft\Address Book\%USERNAME%.wab~
- C:\Documents and Settings\Default User\Favorites\3699小游戏.url
- C:\Documents and Settings\Default User\Favorites\9233安全网址导航.url
- C:\Documents and Settings\Default User\Application Data\Microsoft\Address Book\%USERNAME%.wab
- C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
- C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf
- C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk
- %TEMP%\autB.tmp
- %HOMEPATH%\Favorites\好吃-别流口水.url
- %TEMP%\autC.tmp
- %HOMEPATH%\Favorites\时尚女人专柜.url
- %TEMP%\aut9.tmp
- %HOMEPATH%\Favorites\淘宝皇冠店铺.url
- %TEMP%\autA.tmp
- %HOMEPATH%\Favorites\链接\9233安全网址导航.url
- %TEMP%\autF.tmp
- %HOMEPATH%\Favorites\链接\特价飞机票.url
- %TEMP%\aut10.tmp
- %HOMEPATH%\Favorites\链接\系统之家-最新系统下载.url
- %TEMP%\autD.tmp
- %HOMEPATH%\Favorites\链接\淘宝每日低价商品抢购中！.url
- %TEMP%\autE.tmp
- %HOMEPATH%\Favorites\Win7之家-各种Windows系统下载.url
- %TEMP%\aut3.tmp
- %HOMEPATH%\Favorites\9233安全网址导航.url
- %TEMP%\aut4.tmp
- <SYSTEM32>\regset.ini
- %TEMP%\aut1.tmp
- <SYSTEM32>\AppData.exe
- %TEMP%\aut2.tmp
- %HOMEPATH%\Favorites\淘宝每日低价商品抢购中！.url
- %TEMP%\aut7.tmp
- %HOMEPATH%\Favorites\3699小游戏.url
- %TEMP%\aut8.tmp
- %HOMEPATH%\Favorites\系统之家-最新系统下载.url
- %TEMP%\aut5.tmp
- %HOMEPATH%\Favorites\特价飞机票.url
- %TEMP%\aut6.tmp
- %HOMEPATH%\Favorites\链接\3699小游戏.url
- %APPDATA%\360se\seup.ini
- %APPDATA%\360se\stat.ini
- %APPDATA%\360se\data\switch.ini
- %APPDATA%\360se\data\guardconfig.ini
- %APPDATA%\360se\360se_s.ini
- %APPDATA%\360se\data\BlankData.ini
- %APPDATA%\Maxthon3\Users\guest\Config\config.ini
- %APPDATA%\360se\data\URLTitle.ini
- %APPDATA%\CoralExplorer\Users\Default\Default.cfg
- %APPDATA%\Maxthon3\Users\guest\Config\config.dat
- %APPDATA%\Maxthon3\Users\guest\Favorite\Favorite.dat
- %APPDATA%\Tencent\TencentTraveler\100\navinfo.db
- %APPDATA%\360se\data\360sefav.db
- %APPDATA%\Tencent\QQBrowser\user_data\0\config.db
- %APPDATA%\SogouExplorer\HistoryUrl.db
- %APPDATA%\360se\360seie6.ini
- %TEMP%\aut13.tmp
- %HOMEPATH%\Favorites\链接\时尚女人专柜.url
- %TEMP%\aut14.tmp
- %HOMEPATH%\Favorites\链接\淘宝皇冠店铺.url
- %TEMP%\aut11.tmp
- %HOMEPATH%\Favorites\链接\Win7之家-各种Windows系统下载.url
- %TEMP%\aut12.tmp
- %HOMEPATH%\Favorites\链接\好吃-别流口水.url
- %APPDATA%\SogouExplorer\config.xml
- %APPDATA%\SogouExplorer\y.txt
- %APPDATA%\360se\360SE.ini
- %APPDATA%\SogouExplorer\CommCfg.xml
- %TEMP%\aut15.tmp
- <SYSTEM32>\NTUSER.DAT
- %APPDATA%\Tencent\QQBrowser\user_data\0\Bookmarks
Sets the 'hidden' attribute to the following files:
- %APPDATA%\CoralExplorer\Users\Default\StartPageConfig.data
Deletes the following files:
- %TEMP%\aut10.tmp
- %TEMP%\aut11.tmp
- %TEMP%\aut12.tmp
- %TEMP%\autD.tmp
- %TEMP%\autE.tmp
- %TEMP%\autF.tmp
- <SYSTEM32>\AppData.exe
- %TEMP%\7ZSfx000.cmd
- <SYSTEM32>\regset.ini
- %TEMP%\aut13.tmp
- %TEMP%\aut14.tmp
- %TEMP%\aut15.tmp
- %TEMP%\aut4.tmp
- %TEMP%\aut5.tmp
- %TEMP%\aut6.tmp
- %TEMP%\aut1.tmp
- %TEMP%\aut2.tmp
- %TEMP%\aut3.tmp
- %TEMP%\autA.tmp
- %TEMP%\autB.tmp
- %TEMP%\autC.tmp
- %TEMP%\aut7.tmp
- %TEMP%\aut8.tmp
- %TEMP%\aut9.tmp
Moves the following files:
- from <SYSTEM32>\NTUSER.DAT to C:\Documents and Settings\Default User\NTUSER.DAT
Deletes itself.
