Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] '*proxyprovcpl.exe' = '"C:\Documents and Settings\LocalService\Application Data\proxyprovcpl.exe"'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] '*<Virus name>.exe' = '"<Full path to virus>"'
Malicious functions:
Injects code into
the following system processes:
- <SYSTEM32>\alg.exe
a large number of user processes.
Modifies file system :
Creates the following files:
- C:\Documents and Settings\LocalService\Application Data\proxyprovcpl.exe
- %TEMP%\f1c8c705
Moves itself:
- from <Full path to virus> to %TEMP%\FY1.tmp
