Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'Norton Antivirus AV' = '%WINDIR%\FVProtect.exe'
Modifies file system
Creates the following files
- %WINDIR%\userconfig9x.dll
- C:\far2\plugins\ftp\eminem song text archive.doc.exe
- C:\far2\plugins\ftp\eminem sexy archive.doc.exe
- C:\far2\plugins\ftp\eminem full album.mp3.exe
- C:\far2\plugins\ftp\eminem spears porn.jpg.exe
- C:\far2\plugins\ftp\ringtones.mp3.exe
- C:\far2\plugins\ftp\eminem sex xxx.jpg.exe
- C:\far2\plugins\ftp\ringtones.doc.exe
- C:\far2\plugins\ftp\britney spears blowjob.jpg.exe
- C:\far2\plugins\ftp\eminem blowjob.jpg.exe
- C:\far2\plugins\ftp\eminem poster.jpg.exe
- C:\far2\plugins\ftp\american idol.doc.exe
- C:\far2\plugins\ftp\cloning.doc.exe
- C:\far2\plugins\ftp\saddam hussein.jpg.exe
- C:\far2\plugins\ftp\arnold schwarzenegger.jpg.exe
- C:\far2\plugins\ftp\windows 2003 crack.exe
- C:\far2\plugins\ftp\windows xp crack.exe
- C:\far2\plugins\ftp\eminem.mp3.exe
- C:\far2\plugins\ftp\britney spears.mp3.exe
- C:\far2\plugins\ftp\britney spears full album.mp3.exe
- C:\far2\plugins\ftp\britney spears song text archive.doc.exe
- C:\far2\plugins\ftp\matrix.mpg.exe
- C:\far2\plugins\ftp\lib\the sims 4 beta.exe
- C:\far2\plugins\ftp\kazaa lite 4.0 new.exe
- C:\far2\plugins\ftp\britney spears sexy archive.doc.exe
- C:\far2\plugins\ftp\kazaa new.exe
- C:\far2\plugins\ftp\britney spears porn.jpg.exe
- C:\far2\plugins\ftp\harry potter all e.book.doc.exe
- C:\far2\plugins\ftp\britney sex xxx.jpg.exe
- C:\far2\plugins\ftp\adobe photoshop 10 crack.exe
- C:\far2\plugins\ftp\altkins diet.doc.exe
- C:\far2\plugins\ftp\harry potter 1-6 book.txt.exe
- C:\far2\plugins\ftp\britney spears cumshot.jpg.exe
- C:\far2\plugins\ftp\harry potter.doc.exe
- C:\far2\plugins\ftp\britney spears fuck.jpg.exe
- C:\far2\plugins\ftp\harry potter game.exe
- C:\far2\plugins\ftp\britney spears.jpg.exe
- C:\far2\plugins\ftp\harry potter 5.mpg.exe
- C:\far2\plugins\ftp\britney spears and eminem porn.jpg.exe
- C:\far2\plugins\ftp\lib\lightwave 9 update.exe
- C:\far2\plugins\ftp\harry potter e book.doc.exe
- C:\far2\plugins\ftp\ahead nero 8.exe
- C:\far2\plugins\ftp\lightwave 9 update.exe
- C:\far2\plugins\ftp\adobe premiere 10.exe
- C:\far2\plugins\ftp\norton antivirus 2005 beta.exe
- C:\far2\plugins\ftp\gimp 1.8 full with key.exe
- C:\far2\plugins\ftp\partitionsmagic 10 beta.exe
- C:\far2\plugins\ftp\star office 9.exe
- C:\far2\plugins\ftp\magix video deluxe 5 beta.exe
- C:\far2\plugins\ftp\clone dvd 6.exe
- C:\far2\plugins\ftp\ms service pack 6.exe
- C:\far2\plugins\ftp\microsoft winxp crack full.exe
- C:\far2\plugins\ftp\acdsee 10.exe
- C:\far2\plugins\ftp\cracks & warez archiv.exe
- C:\far2\plugins\ftp\winamp 13 full.exe
- C:\far2\plugins\ftp\divx 8.0 final.exe
- C:\far2\plugins\ftp\opera 11.exe
- C:\far2\plugins\ftp\internet explorer 9 setup.exe
- C:\far2\plugins\ftp\smashing the stack full.rtf.exe
- C:\far2\plugins\ftp\ulead keygen 2004.exe
- C:\far2\plugins\ftp\keygen 4 all new.exe
- C:\far2\plugins\ftp\windows 2000 sourcecode.doc.exe
- C:\far2\plugins\ftp\3d studio max 6 3dsmax.exe
- C:\far2\plugins\ftp\1001 sex and more.rtf.exe
- C:\far2\plugins\ftp\rfc compilation.doc.exe
- C:\far2\plugins\ftp\best matrix screensaver new.scr
- C:\far2\plugins\ftp\porno screensaver britney.scr
- C:\far2\plugins\ftp\dark angels new.pif
- C:\far2\plugins\ftp\xxx hardcore pics.jpg.exe
- C:\far2\plugins\ftp\microsoft office 2003 crack best.exe
- C:\far2\plugins\ftp\serials edition.txt.exe
- C:\far2\plugins\ftp\screensaver2.scr
- C:\far2\plugins\ftp\teen porn 15.jpg.pif
- C:\far2\plugins\ftp\lib\ulead keygen 2004.exe
- C:\far2\plugins\ftp\full album all.mp3.pif
- C:\far2\plugins\ftp\e-book archive2.rtf.exe
- C:\far2\plugins\ftp\doom 3 release 2.exe
- C:\far2\plugins\ftp\how to hack new.doc.exe
- C:\far2\plugins\ftp\learn programming 2004.doc.exe
- C:\far2\plugins\ftp\winxp ebook newest.doc.exe
- C:\far2\plugins\ftp\win longhorn re.exe
- C:\far2\plugins\ftp\dictionary english 2004 - france.doc.exe
- C:\far2\plugins\ftp\adobe photoshop 10 full.exe
- C:\far2\plugins\ftp\netsky source code.scr
- C:\far2\plugins\ftp\visual studio net crack all.exe
- C:\far2\plugins\ftp\lib\smashing the stack full.rtf.exe
- C:\far2\plugins\ftp\lib\magix video deluxe 5 beta.exe
- C:\far2\plugins\ftp\lib\britney spears song text archive.doc.exe
- C:\far2\plugins\ftp\lib\britney spears full album.mp3.exe
- C:\far2\plugins\ftp\lib\eminem.mp3.exe
- C:\far2\plugins\ftp\lib\britney spears.mp3.exe
- C:\far2\plugins\ftp\lib\eminem song text archive.doc.exe
- C:\far2\plugins\ftp\lib\eminem sexy archive.doc.exe
- C:\far2\plugins\ftp\lib\eminem full album.mp3.exe
- C:\far2\plugins\ftp\lib\britney spears porn.jpg.exe
- C:\far2\plugins\ftp\lib\eminem spears porn.jpg.exe
- C:\far2\plugins\ftp\lib\eminem sex xxx.jpg.exe
- C:\far2\plugins\ftp\lib\ringtones.doc.exe
- C:\far2\plugins\ftp\lib\eminem blowjob.jpg.exe
- C:\far2\plugins\ftp\lib\altkins diet.doc.exe
- C:\far2\plugins\ftp\lib\eminem poster.jpg.exe
- C:\far2\plugins\ftp\lib\american idol.doc.exe
- C:\far2\plugins\ftp\lib\cloning.doc.exe
- C:\far2\plugins\ftp\lib\britney spears and eminem porn.jpg.exe
- C:\far2\plugins\ftp\lib\matrix.mpg.exe
- C:\far2\plugins\ftp\lib\harry potter 5.mpg.exe
- C:\far2\plugins\ftp\lib\britney spears.jpg.exe
- C:\far2\plugins\ftp\lib\harry potter game.exe
- %WINDIR%\base64.tmp
- %WINDIR%\zipped.tmp
- %WINDIR%\zip1.tmp
- %WINDIR%\zip2.tmp
- %WINDIR%\zip3.tmp
- C:\far2\plugins\ftp\lib\kazaa lite 4.0 new.exe
- C:\far2\plugins\ftp\lib\britney spears sexy archive.doc.exe
- C:\far2\plugins\ftp\lib\saddam hussein.jpg.exe
- C:\far2\plugins\ftp\lib\ringtones.mp3.exe
- C:\far2\plugins\ftp\lib\kazaa new.exe
- C:\far2\plugins\ftp\lib\britney sex xxx.jpg.exe
- C:\far2\plugins\ftp\lib\harry potter 1-6 book.txt.exe
- C:\far2\plugins\ftp\lib\britney spears blowjob.jpg.exe
- C:\far2\plugins\ftp\lib\harry potter e book.doc.exe
- C:\far2\plugins\ftp\lib\britney spears cumshot.jpg.exe
- C:\far2\plugins\ftp\lib\harry potter.doc.exe
- C:\far2\plugins\ftp\lib\britney spears fuck.jpg.exe
- %WINDIR%\fvprotect.exe
- C:\far2\plugins\ftp\lib\harry potter all e.book.doc.exe
- C:\far2\plugins\ftp\lib\microsoft office 2003 crack best.exe
- C:\far2\plugins\ftp\lib\opera 11.exe
- C:\far2\plugins\ftp\lib\windows xp crack.exe
- C:\far2\plugins\ftp\lib\1001 sex and more.rtf.exe
- C:\far2\plugins\ftp\lib\3d studio max 6 3dsmax.exe
- C:\far2\plugins\ftp\lib\keygen 4 all new.exe
- C:\far2\plugins\ftp\lib\windows 2000 sourcecode.doc.exe
- C:\far2\plugins\ftp\lib\norton antivirus 2005 beta.exe
- C:\far2\plugins\ftp\lib\gimp 1.8 full with key.exe
- C:\far2\plugins\ftp\lib\partitionsmagic 10 beta.exe
- C:\far2\plugins\ftp\lib\arnold schwarzenegger.jpg.exe
- C:\far2\plugins\ftp\lib\star office 9.exe
- C:\far2\plugins\ftp\lib\clone dvd 6.exe
- C:\far2\plugins\ftp\lib\ms service pack 6.exe
- C:\far2\plugins\ftp\lib\acdsee 10.exe
- C:\far2\plugins\ftp\lib\visual studio net crack all.exe
- C:\far2\plugins\ftp\lib\cracks & warez archiv.exe
- C:\far2\plugins\ftp\lib\winamp 13 full.exe
- C:\far2\plugins\ftp\lib\divx 8.0 final.exe
- C:\far2\plugins\ftp\lib\dictionary english 2004 - france.doc.exe
- C:\far2\plugins\ftp\lib\rfc compilation.doc.exe
- C:\far2\plugins\ftp\lib\win longhorn re.exe
- C:\far2\plugins\ftp\lib\winxp ebook newest.doc.exe
- C:\far2\plugins\ftp\lib\learn programming 2004.doc.exe
- C:\far2\plugins\ftp\lib\microsoft winxp crack full.exe
- C:\far2\plugins\ftp\lib\teen porn 15.jpg.pif
- C:\far2\plugins\ftp\lib\adobe premiere 10.exe
- C:\far2\plugins\ftp\lib\adobe photoshop 10 full.exe
- C:\far2\plugins\ftp\lib\best matrix screensaver new.scr
- C:\far2\plugins\ftp\lib\porno screensaver britney.scr
- C:\far2\plugins\ftp\lib\dark angels new.pif
- C:\far2\plugins\ftp\lib\windows 2003 crack.exe
- C:\far2\plugins\ftp\lib\internet explorer 9 setup.exe
- C:\far2\plugins\ftp\lib\xxx hardcore pics.jpg.exe
- C:\far2\plugins\ftp\lib\screensaver2.scr
- C:\far2\plugins\ftp\lib\full album all.mp3.pif
- C:\far2\plugins\ftp\lib\ahead nero 8.exe
- C:\far2\plugins\ftp\lib\netsky source code.scr
- C:\far2\plugins\ftp\lib\e-book archive2.rtf.exe
- C:\far2\plugins\ftp\lib\doom 3 release 2.exe
- C:\far2\plugins\ftp\lib\how to hack new.doc.exe
- C:\far2\plugins\ftp\lib\adobe photoshop 10 crack.exe
- C:\far2\plugins\ftp\lib\serials edition.txt.exe
- C:\far2\plugins\ftp\the sims 4 beta.exe
Network activity
TCP
- 'ms#####.##c.protection.outlook.com':25
- 'mx##.ulb.ac.be':25
- 'mx####.##il.gm0.yahoodns.net':25
UDP
- DNS ASK se##et.com
- DNS ASK vu#.ac.be
- DNS ASK ms#.com
- DNS ASK mx##.ulb.ac.be
- DNS ASK ms#####.##c.protection.outlook.com
- DNS ASK ao#.com
- DNS ASK mx####.##il.gm0.yahoodns.net
- DNS ASK qu##ro.br
- DNS ASK an##o.br
- DNS ASK pi##jui.br
- DNS ASK mu###al.com.br
