Technical Information
Malicious functions:
Executes the following:
- <SYSTEM32>\net1.exe stop "Norton Internet Security Proxy Srvice"
- <SYSTEM32>\net.exe stop "Norton Internet Security Proxy Srvice"
- <SYSTEM32>\net.exe stop "Norton Internet Security service"
- <SYSTEM32>\net.exe stop "Norton AntiVirus Server"
- <SYSTEM32>\net1.exe stop "Norton Internet Security service"
- <SYSTEM32>\net.exe stop "Symantec Event Manager"
- <SYSTEM32>\net1.exe stop "Symantec Proxy Service"
- <SYSTEM32>\net1.exe stop "Symantec Event Manager"
- <SYSTEM32>\net1.exe stop "Norton Internet Security Accounts Manager"
- <SYSTEM32>\net.exe stop "Norton Internet Security Accounts Manager"
- <SYSTEM32>\net1.exe stop "Norton AntiVirus Server"
- <SYSTEM32>\net.exe stop "ViRobot Professional Monitoring"
- <SYSTEM32>\net1.exe stop "Norton AntiVirus Corporate Edition"
- <SYSTEM32>\net1.exe stop "ViRobot Professional Monitoring"
- <SYSTEM32>\net1.exe stop "PC-cillin Personal Firewall"
- <SYSTEM32>\net.exe stop "PC-cillin Personal Firewall"
- <SYSTEM32>\net1.exe stop "Norton AntiVirus Auto Protect Service"
- <SYSTEM32>\net.exe stop "Norton AntiVirus Auto Protect Service"
- <SYSTEM32>\net.exe stop "Norton AntiVirus Client"
- <SYSTEM32>\net.exe stop "Norton AntiVirus Corporate Edition"
- <SYSTEM32>\net1.exe stop "Norton AntiVirus Client"
- <SYSTEM32>\net.exe stop "Symantec Proxy Service"
- <SYSTEM32>\net1.exe stop "rising process communication center"
- <SYSTEM32>\net.exe stop "rising process communication center"
- <SYSTEM32>\net.exe stop "rising realtime monitor service"
- <SYSTEM32>\net.exe stop "OfficeScanNT Monitor"
- <SYSTEM32>\net1.exe stop "rising realtime monitor service"
- <SYSTEM32>\net.exe stop "Turbo Vaccine Monitoring Service"
- <SYSTEM32>\cmd.exe /c <SYSTEM32>\feafvc.bat
- <SYSTEM32>\net1.exe stop "Turbo Vaccine Monitoring Service"
- <SYSTEM32>\net1.exe stop "MonSvcNT"
- <SYSTEM32>\net.exe stop "MonSvcNT"
- <SYSTEM32>\net1.exe stop "OfficeScanNT Monitor"
- <SYSTEM32>\net.exe stop "ZoneAlarm"
- <SYSTEM32>\net1.exe stop "Panda Antivirus"
- <SYSTEM32>\net1.exe stop "ZoneAlarm"
- <SYSTEM32>\net1.exe stop "Detector de OfficeScanNT"
- <SYSTEM32>\net.exe stop "Detector de OfficeScanNT"
- <SYSTEM32>\net1.exe stop "RemoteAgent"
- <SYSTEM32>\net.exe stop "RemoteAgent"
- <SYSTEM32>\net.exe stop "Ahnlab Task Scheduler"
- <SYSTEM32>\net.exe stop "Panda Antivirus"
- <SYSTEM32>\net1.exe stop "Ahnlab Task Scheduler"
Hides the following processes:
- <Full path to virus>
Modifies file system :
Creates the following files:
- %PROGRAM_FILES%\MSN Gaming Zone\Windows\RCX28.tmp
- %PROGRAM_FILES%\MSN Gaming Zone\Windows\RCX27.tmp
- %PROGRAM_FILES%\MSN Gaming Zone\Windows\RCX26.tmp
- %PROGRAM_FILES%\MSN Gaming Zone\Windows\RCX29.tmp
- %PROGRAM_FILES%\NetMeeting\RCX2C.tmp
- %PROGRAM_FILES%\NetMeeting\RCX2B.tmp
- %PROGRAM_FILES%\MSN Gaming Zone\Windows\RCX2A.tmp
- %PROGRAM_FILES%\MSN Gaming Zone\Windows\RCX25.tmp
- %PROGRAM_FILES%\Messenger\RCX20.tmp
- %PROGRAM_FILES%\Internet Explorer\Connection Wizard\RCX1F.tmp
- %PROGRAM_FILES%\Internet Explorer\Connection Wizard\RCX1E.tmp
- %PROGRAM_FILES%\Movie Maker\RCX21.tmp
- %PROGRAM_FILES%\MSN\MSNCoreFiles\Install\MSN9Components\RCX24.tmp
- %PROGRAM_FILES%\MSN\MSNCoreFiles\Install\MSN9Components\RCX23.tmp
- %PROGRAM_FILES%\MSN\MSNCoreFiles\Install\RCX22.tmp
- %PROGRAM_FILES%\Windows NT\RCX37.tmp
- %PROGRAM_FILES%\Windows Media Player\RCX36.tmp
- %PROGRAM_FILES%\Windows Media Player\RCX35.tmp
- %PROGRAM_FILES%\Windows NT\RCX38.tmp
- <Auxiliary element>
- %PROGRAM_FILES%\Windows NT\Pinball\RCX3A.tmp
- %PROGRAM_FILES%\Windows NT\Accessories\RCX39.tmp
- %PROGRAM_FILES%\Windows Media Player\RCX34.tmp
- %PROGRAM_FILES%\Outlook Express\RCX2F.tmp
- %PROGRAM_FILES%\Outlook Express\RCX2E.tmp
- %PROGRAM_FILES%\NetMeeting\RCX2D.tmp
- %PROGRAM_FILES%\Outlook Express\RCX30.tmp
- %PROGRAM_FILES%\Windows Media Player\RCX33.tmp
- %PROGRAM_FILES%\Outlook Express\RCX32.tmp
- %PROGRAM_FILES%\Outlook Express\RCX31.tmp
- %PROGRAM_FILES%\Internet Explorer\Connection Wizard\RCX1D.tmp
- %CommonProgramFiles%\Microsoft Shared\Speech\RCX9.tmp
- %CommonProgramFiles%\Microsoft Shared\MSInfo\RCX8.tmp
- %CommonProgramFiles%\Microsoft Shared\DW\RCX7.tmp
- %PROGRAM_FILES%\FireFox\RCXA.tmp
- %PROGRAM_FILES%\FireFox\RCXD.tmp
- %PROGRAM_FILES%\FireFox\RCXC.tmp
- %PROGRAM_FILES%\FireFox\RCXB.tmp
- %CommonProgramFiles%\Microsoft Shared\DW\RCX6.tmp
- <Current directory>\RCX1.tmp
- <SYSTEM32>\feafvc.bat
- <SYSTEM32>\to.ico
- C:\Far\RCX2.tmp
- %CommonProgramFiles%\Microsoft Shared\DW\RCX5.tmp
- C:\Far\Plugins\RCX4.tmp
- C:\Far\RCX3.tmp
- %PROGRAM_FILES%\Internet Explorer\RCX18.tmp
- %PROGRAM_FILES%\FireFox\uninstall\RCX17.tmp
- %PROGRAM_FILES%\FireFox\RCX16.tmp
- %PROGRAM_FILES%\Internet Explorer\RCX19.tmp
- %PROGRAM_FILES%\Internet Explorer\Connection Wizard\RCX1C.tmp
- %PROGRAM_FILES%\Internet Explorer\Connection Wizard\RCX1B.tmp
- %PROGRAM_FILES%\Internet Explorer\Connection Wizard\RCX1A.tmp
- %PROGRAM_FILES%\FireFox\RCX15.tmp
- %PROGRAM_FILES%\FireFox\RCX10.tmp
- %PROGRAM_FILES%\FireFox\RCXF.tmp
- %PROGRAM_FILES%\FireFox\RCXE.tmp
- %PROGRAM_FILES%\FireFox\RCX11.tmp
- %PROGRAM_FILES%\FireFox\RCX14.tmp
- %PROGRAM_FILES%\FireFox\RCX13.tmp
- %PROGRAM_FILES%\FireFox\RCX12.tmp
Deletes the following files:
- %PROGRAM_FILES%\FireFox\HACK-Aver____z ejmoswasgduxafikbgiloqmtoxoruxcmenchmputietwz fiptvz ceieqqmbfjmppjsknsuz enwkoquz .exe
- %CommonProgramFiles%\Microsoft Shared\DW\HACK-Aver____z ejmoswasgduxafikbgiloqmtoxoruxcmenchmpu.exe
Deletes itself.
