Technical Information
Malicious functions:
Creates and executes the following:
- '%TEMP%\645e15da\NltGBJol.exe'
Terminates or attempts to terminate
the following user processes:
- iexplore.exe
- firefox.exe
- chrome.exe
Modifies file system :
Creates the following files:
- C:\Documents and Settings\Guest\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\nliockpfodkfaimgpeemnbikphomgnog\2.0\background.html
- C:\Documents and Settings\ASPNET\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\nliockpfodkfaimgpeemnbikphomgnog\2.0\W.js
- C:\Documents and Settings\Guest\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\nliockpfodkfaimgpeemnbikphomgnog\2.0\lsdb.js
- C:\Documents and Settings\Guest\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\nliockpfodkfaimgpeemnbikphomgnog\2.0\content.js
- C:\Documents and Settings\ASPNET\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\nliockpfodkfaimgpeemnbikphomgnog\2.0\manifest.json
- C:\Documents and Settings\ASPNET\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\nliockpfodkfaimgpeemnbikphomgnog\2.0\background.html
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\nliockpfodkfaimgpeemnbikphomgnog\2.0\W.js
- C:\Documents and Settings\ASPNET\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\nliockpfodkfaimgpeemnbikphomgnog\2.0\lsdb.js
- C:\Documents and Settings\ASPNET\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\nliockpfodkfaimgpeemnbikphomgnog\2.0\content.js
- C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\nliockpfodkfaimgpeemnbikphomgnog\2.0\W.js
- C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\nliockpfodkfaimgpeemnbikphomgnog\2.0\manifest.json
- C:\Documents and Settings\SUPPORT_388945a0\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\nliockpfodkfaimgpeemnbikphomgnog\2.0\content.js
- C:\Documents and Settings\SUPPORT_388945a0\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\nliockpfodkfaimgpeemnbikphomgnog\2.0\background.html
- C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\nliockpfodkfaimgpeemnbikphomgnog\2.0\lsdb.js
- C:\Documents and Settings\Guest\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\nliockpfodkfaimgpeemnbikphomgnog\2.0\W.js
- C:\Documents and Settings\Guest\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\nliockpfodkfaimgpeemnbikphomgnog\2.0\manifest.json
- C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\nliockpfodkfaimgpeemnbikphomgnog\2.0\content.js
- C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\nliockpfodkfaimgpeemnbikphomgnog\2.0\background.html
- %TEMP%\645e15da\ooe_guf@jjolt.edu\install.rdf
- %TEMP%\645e15da\ooe_guf@jjolt.edu\content\bg.js
- %TEMP%\645e15da\ooe_guf@jjolt.edu\bootstrap.js
- %TEMP%\645e15da\ooe_guf@jjolt.edu\chrome.manifest
- %TEMP%\645e15da\jnAZ1Ai.dll
- %TEMP%\645e15da\NltGBJol.exe
- %TEMP%\645e15da\NltGBJol.dat
- %TEMP%\645e15da\jnAZ1Ai.tlb
- %TEMP%\645e15da\jnAZ1Ai.x64.dll
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\nliockpfodkfaimgpeemnbikphomgnog\2.0\content.js
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\nliockpfodkfaimgpeemnbikphomgnog\2.0\background.html
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\nliockpfodkfaimgpeemnbikphomgnog\2.0\manifest.json
- <LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\nliockpfodkfaimgpeemnbikphomgnog\2.0\lsdb.js
- %TEMP%\645e15da\nliockpfodkfaimgpeemnbikphomgnog\W.js
- %TEMP%\645e15da\nliockpfodkfaimgpeemnbikphomgnog\content.js
- %TEMP%\645e15da\nliockpfodkfaimgpeemnbikphomgnog\lsdb.js
- %TEMP%\645e15da\nliockpfodkfaimgpeemnbikphomgnog\background.html
- %TEMP%\645e15da\nliockpfodkfaimgpeemnbikphomgnog\manifest.json
