Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'services' = '%WINDIR%\services.exe'
Malicious functions:
Creates and executes the following:
- '%WINDIR%\services.exe'
Executes the following:
- '<SYSTEM32>\wlrmdr.exe' -1 -f 2 -t You are about to be logged off -m Windows has encountered a critical problem and will restart automatically in one minute. Please save your work now. -a 3
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\services.exe
Modifies file system :
Creates the following files:
- %WINDIR%\MSWINSCK.OCX
- %WINDIR%\setupconfig.dat
- %WINDIR%\services.exe
- %WINDIR%\afprj.dll
- %WINDIR%\afire.dll
Sets the 'hidden' attribute to the following files:
- %WINDIR%\services.exe
- %WINDIR%\afire.dll
Network activity:
UDP:
- DNS ASK ac.##lemci.us
- DNS ASK gk##.#logdns.com
- DNS ASK www.is##mci.us
- DNS ASK dn#.##ftncsi.com
