Trojan.DownLoad.62206

Technical Information

To ensure autorun and distribution:

Creates or modifies the following files:

%ALLUSERSPROFILE%\Start Menu\Programs\Startup\wordpad.exe.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Startup\hypertrm.exe.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Startup\isignup.exe.lnk

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\PersonalMini] 'Start' = '00000002'

Substitutes the following executable system files:

<SYSTEM32>\dllcache\msimn.exe with <SYSTEM32>\dllcache\msimn.exe.new
<SYSTEM32>\dllcache\conf.exe with <SYSTEM32>\dllcache\conf.exe.new
<SYSTEM32>\dllcache\rvsezm.exe with <SYSTEM32>\dllcache\rvsezm.exe.new
<SYSTEM32>\dllcache\wordpad.exe with <SYSTEM32>\dllcache\wordpad.exe.new
<SYSTEM32>\dllcache\setup_wm.exe with <SYSTEM32>\dllcache\setup_wm.exe.new
<SYSTEM32>\dllcache\wabmig.exe with <SYSTEM32>\dllcache\wabmig.exe.new
<SYSTEM32>\dllcache\isignup.exe with <SYSTEM32>\dllcache\isignup.exe.new
<SYSTEM32>\dllcache\icwconn2.exe with <SYSTEM32>\dllcache\icwconn2.exe.new
<SYSTEM32>\dllcache\msinfo32.exe with <SYSTEM32>\dllcache\msinfo32.exe.new
<SYSTEM32>\dllcache\chkrzm.exe with <SYSTEM32>\dllcache\chkrzm.exe.new
<SYSTEM32>\dllcache\moviemk.exe with <SYSTEM32>\dllcache\moviemk.exe.new
<SYSTEM32>\dllcache\iexplore.exe with <SYSTEM32>\dllcache\iexplore.exe.new

Malicious functions:

Creates and executes the following:

%PROGRAM_FILES%\ErrorMini.exe
C:\DateKavsp.exe rb
C:\DateKavsp.exe <Full path to virus>

Executes the following:

<SYSTEM32>\reg.exe ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v DisableScriptDebuggerIE /t REG_SZ /d yes /F
<SYSTEM32>\reg.exe ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v "Disable Script Debugger" /t REG_SZ /d yes /F
<SYSTEM32>\reg.exe delete HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318} /F
<SYSTEM32>\reg.exe delete HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318} /F
<SYSTEM32>\reg.exe ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v Play_Animations /t REG_SZ /d no /F
<SYSTEM32>\sc.exe create ccosmSrv BinPath= "%PROGRAM_FILES%\StormII\stormSrv.exe /asservice" type= own type= interact start= auto DisplayName= SpecialGoogle
<SYSTEM32>\reg.exe delete HKLM\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318} /F
<SYSTEM32>\reg.exe delete HKLM\SYSTEM\ControlSet001\Control\SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318} /F
<SYSTEM32>\reg.exe ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v "Display Inline Images" /t REG_SZ /d yes /F
<SYSTEM32>\reg.exe delete HKLM\Software\Microsoft\Windows\CurrentVersion\Run /F
<SYSTEM32>\regsvr32.exe /u /s shimgvw.dll
<SYSTEM32>\cmd.exe /c "%PROGRAM_FILES%\GooglePath.bat"
<SYSTEM32>\reg.exe ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v "Display Inline Videos" /t REG_SZ /d no /F
<SYSTEM32>\regsvr32.exe /u /s scrrun.dll
<SYSTEM32>\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{D27CDB6E-AE6D-11cf-96B8-444553540000}" /v "Compatibility Flags" /t REG_SZ /d 00000400 /F
<SYSTEM32>\regsvr32.exe /u /s vbscript.dll
<SYSTEM32>\regsvr32.exe /s jscript.dll

Modifies file system :

Creates the following files:

<SYSTEM32>\dllcache\icwconn2.exe.new
<SYSTEM32>\dllcache\isignup.exe.new
<SYSTEM32>\dllcache\iexplore.exe.new
<SYSTEM32>\dllcache\msinfo32.exe.new
%PROGRAM_FILES%\Outlook Express\wabmig.exe.new
%PROGRAM_FILES%\Windows Media Player\setup_wm.exe.new
%PROGRAM_FILES%\Windows NT\Accessories\wordpad.exe.new
<SYSTEM32>\dllcache\moviemk.exe.new
<SYSTEM32>\dllcache\wabmig.exe.new
<SYSTEM32>\dllcache\setup_wm.exe.new
<SYSTEM32>\dllcache\wordpad.exe.new
<SYSTEM32>\dllcache\msimn.exe.new
<SYSTEM32>\dllcache\chkrzm.exe.new
<SYSTEM32>\dllcache\rvsezm.exe.new
<SYSTEM32>\dllcache\conf.exe.new
%PROGRAM_FILES%\ErrorMini.exe
%TEMP%\RGI1.tmp
%CommonProgramFiles%\Microsoft Shared\MSInfo\msinfo32.exe.new
%WINDIR%\TimePolice.exe
C:\DateKavsp.exe
%PROGRAM_FILES%\StormII\stormSrv.exe
%PROGRAM_FILES%\GooglePath.bat
%PROGRAM_FILES%\Internet Explorer\Connection Wizard\icwconn2.exe.new
%PROGRAM_FILES%\MSN Gaming Zone\Windows\rvsezm.exe.new
%PROGRAM_FILES%\NetMeeting\conf.exe.new
%PROGRAM_FILES%\Outlook Express\msimn.exe.new
%PROGRAM_FILES%\MSN Gaming Zone\Windows\chkrzm.exe.new
%PROGRAM_FILES%\Internet Explorer\Connection Wizard\isignup.exe.new
%PROGRAM_FILES%\Internet Explorer\iexplore.exe.new
%PROGRAM_FILES%\Movie Maker\moviemk.exe.new

Sets the 'hidden' attribute to the following files:

%ALLUSERSPROFILE%\Start Menu\Programs\Startup\wordpad.exe.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Startup\hypertrm.exe.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Startup\isignup.exe.lnk

Deletes the following files:

%TEMP%\RGI1.tmp

Miscellaneous:

Searches for the following windows:

ClassName: 'URTVDQBGUI' WindowName: 'gerdosfqdyu'

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial