Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'ctivctr' = '<SYSTEM32>\vmfatevet.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'mtstrscab' = '<SYSTEM32>\rorvmet.exe'
Malicious functions:
Creates and executes the following:
- <SYSTEM32>\dvpguietup.exe (downloaded from the Internet)
- <SYSTEM32>\dmtmlor.exe (downloaded from the Internet)
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system :
Creates the following files:
- %HOMEPATH%\Favorites\Online Gambling\Internet Poker.url
- %HOMEPATH%\Favorites\Online Gambling\Online Casino Poker.url
- %HOMEPATH%\Favorites\Online Gambling\Online Casinos.url
- %HOMEPATH%\Favorites\Online Gambling\Online Gambling.url
- %HOMEPATH%\Favorites\Online Pharmacy\Hydrocodone Order.url
- %HOMEPATH%\Favorites\Online Pharmacy\About Tramadol.url
- %HOMEPATH%\Favorites\Online Gambling\Internet Casino.url
- %HOMEPATH%\Favorites\Online Pharmacy\Tramadol Online.url
- %HOMEPATH%\Favorites\Online Gambling\Empire Poker.url
- %HOMEPATH%\Favorites\Free Hardcore Porn\Bandage.url
- %HOMEPATH%\Favorites\Free Hardcore Porn\Youg Porn.url
- %HOMEPATH%\Favorites\Free Hardcore Porn\Pussy.url
- %HOMEPATH%\Favorites\Free Hardcore Porn\Black Girls.url
- %HOMEPATH%\Favorites\Online Gambling\PartyPoker.url
- %HOMEPATH%\Favorites\Online Gambling\PacificPoker.url
- %HOMEPATH%\Favorites\Free Hardcore Porn\Interracial.url
- %HOMEPATH%\Favorites\Anti-Spyware, Antivirus\Spyware.url
- %HOMEPATH%\Favorites\FREE ANIMAL SEX, INCEST, TEEN SEX, MATURE SEX AND MORE!.url
- %HOMEPATH%\Favorites\Spyware remover.url
- %HOMEPATH%\Favorites\E-Business News\Affiliate Program.url
- %HOMEPATH%\Favorites\E-Business News\Domain Names.url
- %HOMEPATH%\Favorites\Anal Rape (raped teens).url
- %HOMEPATH%\Favorites\incest sex (Dad and daughter, Mom and son).url
- %HOMEPATH%\Favorites\Antivirus.url
- %HOMEPATH%\Favorites\Animal sex.url
- %HOMEPATH%\Favorites\E-Business News\Web Hosting.url
- %HOMEPATH%\Favorites\Online Pharmacy\Buy Soma.url
- %HOMEPATH%\Favorites\Online Pharmacy\Lortab.url
- %HOMEPATH%\Favorites\Online Pharmacy\Vicodin.url
- %HOMEPATH%\Favorites\Online Pharmacy\Buy Ambien.url
- %HOMEPATH%\Favorites\E-Business News\Internet.url
- %HOMEPATH%\Favorites\E-Business News\Web Site Design.url
- %HOMEPATH%\Favorites\Online Pharmacy\Zovirax.url
- %HOMEPATH%\Favorites\E-Business News\Online Trading.url
- %HOMEPATH%\Favorites\Free Hardcore Porn\Mature.url
- <SYSTEM32>\favico.dat
- %HOMEPATH%\Favorites\Free Hardcore Porn\Animal Sex.url
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\1[1].exe
- <SYSTEM32>\dvpguietup.exe
- %HOMEPATH%\Favorites\Free Hardcore Porn\Sex Video.url
- %HOMEPATH%\Favorites\Free Hardcore Porn\Zoo.url
- %HOMEPATH%\Favorites\Free Hardcore Porn\Sex.url
- %HOMEPATH%\Favorites\Free Hardcore Porn\Penis Enlargement.url
- <SYSTEM32>\dmtmlor.exe
- <SYSTEM32>\resbognt.dll
- <SYSTEM32>\cdcate.dll
- <SYSTEM32>\rorvmet.exe
- <SYSTEM32>\vmfatevet.exe
- <Current directory>\<Virus name>.dat
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\pd27[1].exe
- <SYSTEM32>\mmdrypcui.dll
- <SYSTEM32>\ppmile.dll
- %HOMEPATH%\Favorites\Free Hardcore Porn\Teen Sex.url
- %HOMEPATH%\Favorites\Free Hardcore Porn\Anal.url
- %HOMEPATH%\Favorites\Free Hardcore Porn\Adult Chat.url
- %HOMEPATH%\Favorites\Free Hardcore Porn\Shelames.url
- %HOMEPATH%\Favorites\Free Hardcore Porn\Pamela Anderson Nude.url
- %HOMEPATH%\Favorites\Free Hardcore Porn\Free Porn.url
- %HOMEPATH%\Favorites\Free Hardcore Porn\ Cheap Viagra.url
- %HOMEPATH%\Favorites\Free Hardcore Porn\XXX Movies.url
- %HOMEPATH%\Favorites\Free Hardcore Porn\Porn Video.url
- %HOMEPATH%\Favorites\Free Hardcore Porn\Anal Rape.url
- %HOMEPATH%\Favorites\Free Hardcore Porn\BDSM.url
- %HOMEPATH%\Favorites\Free Hardcore Porn\Incest Porn.url
- %HOMEPATH%\Favorites\Free Hardcore Porn\Rape.url
- %HOMEPATH%\Favorites\Free Hardcore Porn\Oral Sex.url
- %HOMEPATH%\Favorites\Free Hardcore Porn\Adult Friend Finder.url
- %HOMEPATH%\Favorites\Free Hardcore Porn\Free Sex.url
- %HOMEPATH%\Favorites\Free Hardcore Porn\Escort.url
Deletes the following files:
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\1[1].exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\pd27[1].exe
Network activity:
Connects to:
- 'po####lesearch.biz':80
- 'sm####ebsearch.info':80
- 'www.pr####e-dialer.biz':80
TCP:
HTTP GET requests:
- po####lesearch.biz/?gv###########################################
- sm####ebsearch.info/1.exe
- www.pr####e-dialer.biz/pd/pd27.exe
UDP:
- DNS ASK po####lesearch.biz
- DNS ASK sm####ebsearch.info
- DNS ASK www.pr####e-dialer.biz
- '<Private IP address>':1036
- '<Private IP address>':1035
Miscellaneous:
Searches for the following windows:
- ClassName: 'Indicator' WindowName: ''
