Technical Information
To ensure autorun and distribution:
Substitutes the following executable system files:
- <SYSTEM32>\jgdw400.dll with %TEMP%\19.tmp
- <SYSTEM32>\WindowsCodecs.dll with %TEMP%\1B.tmp
- <SYSTEM32>\mfc71u.dll with %TEMP%\14.tmp
- <SYSTEM32>\mapistub.dll with %TEMP%\17.tmp
- <SYSTEM32>\cliconfg.dll with %TEMP%\21.tmp
- <SYSTEM32>\prntvpt.dll with %TEMP%\23.tmp
- <SYSTEM32>\xpsshhdr.dll with %TEMP%\1D.tmp
- <SYSTEM32>\cliconfg.exe with %TEMP%\1F.tmp
- <SYSTEM32>\ir32_32.dll with %TEMP%\12.tmp
- <SYSTEM32>\taskman.exe with %TEMP%\6.tmp
- <SYSTEM32>\dbnmpntw.dll with %TEMP%\8.tmp
- <SYSTEM32>\libmysql.dll with %TEMP%\2.tmp
- <SYSTEM32>\liblwres.dll with %TEMP%\4.tmp
- <SYSTEM32>\WMPhoto.dll with %TEMP%\E.tmp
- <SYSTEM32>\mapi32.dll with %TEMP%\10.tmp
- <SYSTEM32>\hypertrm.dll with %TEMP%\A.tmp
- <SYSTEM32>\odbcbcp.dll with %TEMP%\C.tmp
Modifies master boot record (MBR).
Malicious functions:
Creates and executes the following:
- %TEMP%\WLXPL.exe \444x
Modifies file system :
Creates the following files:
- %TEMP%\WLXPL.exe
- %WINDIR%\udeqp.bcx
- %TEMP%\WLXPhotoLibraryMain.dll
Deletes the following files:
- %TEMP%\18.tmp
- %TEMP%\1A.tmp
- %TEMP%\15.tmp
- %TEMP%\16.tmp
- %TEMP%\1C.tmp
- %TEMP%\22.tmp
- %TEMP%\24.tmp
- %TEMP%\1E.tmp
- %TEMP%\20.tmp
- %TEMP%\7.tmp
- %TEMP%\9.tmp
- %TEMP%\3.tmp
- %TEMP%\5.tmp
- %TEMP%\B.tmp
- %TEMP%\11.tmp
- %TEMP%\13.tmp
- %TEMP%\D.tmp
- %TEMP%\F.tmp
Moves the following system files:
- from <SYSTEM32>\jgdw400.dll to %TEMP%\1A.tmp
- from <SYSTEM32>\WindowsCodecs.dll to %TEMP%\1C.tmp
- from <SYSTEM32>\mfc71u.dll to %TEMP%\15.tmp
- from <SYSTEM32>\mapistub.dll to %TEMP%\18.tmp
- from <SYSTEM32>\cliconfg.dll to %TEMP%\22.tmp
- from <SYSTEM32>\prntvpt.dll to %TEMP%\24.tmp
- from <SYSTEM32>\xpsshhdr.dll to %TEMP%\1E.tmp
- from <SYSTEM32>\cliconfg.exe to %TEMP%\20.tmp
- from <SYSTEM32>\ir32_32.dll to %TEMP%\13.tmp
- from <SYSTEM32>\taskman.exe to %TEMP%\7.tmp
- from <SYSTEM32>\dbnmpntw.dll to %TEMP%\9.tmp
- from <SYSTEM32>\libmysql.dll to %TEMP%\3.tmp
- from <SYSTEM32>\liblwres.dll to %TEMP%\5.tmp
- from <SYSTEM32>\WMPhoto.dll to %TEMP%\F.tmp
- from <SYSTEM32>\mapi32.dll to %TEMP%\11.tmp
- from <SYSTEM32>\hypertrm.dll to %TEMP%\B.tmp
- from <SYSTEM32>\odbcbcp.dll to %TEMP%\D.tmp
Moves itself:
- from <Full path to virus> to %TEMP%\1.tmp
