Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- %ALLUSERSPROFILE%\Start Menu\Programs\Startup\helper.exe.pif
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\F1B60IIQ] 'Start' = '00000002'
Malicious functions:
Creates and executes the following:
- '%PROGRAM_FILES%\FAV7O2AGF97.exe' rb
- '%PROGRAM_FILES%\FAV7O2AGF97.exe' <Full path to virus>
Executes the following:
- '<SYSTEM32>\reg.exe' ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v "Display Inline Videos" /t REG_SZ /d no /F
- '<SYSTEM32>\reg.exe' ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v Play_Animations /t REG_SZ /d no /F
- '<SYSTEM32>\reg.exe' ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v Play_Background_Sounds /t REG_SZ /d no /F
- '<SYSTEM32>\reg.exe' ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v "Display Inline Images" /t REG_SZ /d yes /F
- '<SYSTEM32>\reg.exe' delete HKLM\Software\Microsoft\Windows\CurrentVersion\Run /F
- '<SYSTEM32>\reg.exe' ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v "Disable Script Debugger" /t REG_SZ /d yes /F
- '<SYSTEM32>\reg.exe' ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v DisableScriptDebuggerIE /t REG_SZ /d yes /F
- '<SYSTEM32>\regsvr32.exe' /u /s shimgvw.dll
- '<SYSTEM32>\sc.exe' create KIRIL8JE3DCBinPath= "%PROGRAM_FILES%\F3E751\8CMXDE.exe -start" type= own type= interact start= auto DisplayName= DVG7H
- '<SYSTEM32>\cmd.exe' /c "%PROGRAM_FILES%\PSKGAGDLSCS.bat"
- '<SYSTEM32>\regsvr32.exe' /u /s itss.dll
- '<SYSTEM32>\regsvr32.exe' /s jscript.dll
- '<SYSTEM32>\regsvr32.exe' /u /s vbscript.dll
- '<SYSTEM32>\regsvr32.exe' /u /s scrrun.dll
Modifies file system :
Creates the following files:
- %WINDIR%\7YD7894.exe
- %TEMP%\RGI1.tmp
- %PROGRAM_FILES%\PSKGAGDLSCS.bat
- %PROGRAM_FILES%\FAV7O2AGF97.exe
- %PROGRAM_FILES%\F3E751\8CMXDE.exe
Sets the 'hidden' attribute to the following files:
- <Full path to virus>
Deletes the following files:
- %WINDIR%\Media\Windows XP Logon Sound.wav
- %WINDIR%\Media\Windows XP Logoff Sound.wav
- %WINDIR%\Media\Windows XP Minimize.wav
- %WINDIR%\Media\Windows XP Menu Command.wav
- %WINDIR%\Media\Windows XP Information Bar.wav
- %WINDIR%\Media\Windows XP Hardware Fail.wav
- %WINDIR%\Media\Windows XP Exclamation.wav
- %WINDIR%\Media\Windows XP Hardware Remove.wav
- %WINDIR%\Media\Windows XP Hardware Insert.wav
- %WINDIR%\Media\Windows XP Notify.wav
- %WINDIR%\Media\Windows XP Shutdown.wav
- %WINDIR%\Media\Windows XP Ringout.wav
- %WINDIR%\Media\Windows XP Startup.wav
- %WINDIR%\Media\Windows XP Start.wav
- %WINDIR%\Media\Windows XP Ringin.wav
- %WINDIR%\Media\Windows XP Print complete.wav
- %WINDIR%\Media\Windows XP Pop-up Blocked.wav
- %WINDIR%\Media\Windows XP Restore.wav
- %WINDIR%\Media\Windows XP Recycle.wav
- %WINDIR%\Media\Windows XP Error.wav
- %WINDIR%\Media\onestop.mid
- %WINDIR%\Media\notify.wav
- %WINDIR%\Media\ringin.wav
- %WINDIR%\Media\recycle.wav
- %WINDIR%\Media\flourish.mid
- %WINDIR%\Media\chimes.wav
- %TEMP%\RGI1.tmp
- %WINDIR%\Media\ding.wav
- %WINDIR%\Media\chord.wav
- %WINDIR%\Media\ringout.wav
- %WINDIR%\Media\Windows XP Critical Stop.wav
- %WINDIR%\Media\Windows XP Battery Low.wav
- %WINDIR%\Media\Windows XP Ding.wav
- %WINDIR%\Media\Windows XP Default.wav
- %WINDIR%\Media\Windows XP Battery Critical.wav
- %WINDIR%\Media\tada.wav
- %WINDIR%\Media\start.wav
- %WINDIR%\Media\Windows XP Balloon.wav
- %WINDIR%\Media\town.mid
Network activity:
Connects to:
- '58.#9.58.27':443
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'EGKEJPGXOUV' WindowName: 'ptieurryytl'
