Technical Information
To ensure autorun and distribution:
Substitutes the following executable system files:
- <SYSTEM32>\dllcache\sapisvr.exe with <SYSTEM32>\dllcache\sapisvr.exe.new
- <SYSTEM32>\dllcache\msinfo32.exe with <SYSTEM32>\dllcache\msinfo32.exe.new
Malicious functions:
Creates and executes the following:
- <Current directory>\<Virus name>.com
Modifies file system :
Creates the following files:
- <SYSTEM32>\dllcache\msinfo32.exe.new
- <SYSTEM32>\dllcache\sapisvr.exe.new
- %CommonProgramFiles%\Microsoft Shared\Speech\sapisvr.exe.new
- <Current directory>\<Virus name>.com
- %CommonProgramFiles%\Microsoft Shared\MSInfo\msinfo32.exe.new
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
