Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Classes\WMSFile\shell\open\command] '' = '"%PROGRAM_FILES%\Windows Media Player\wmplayer.exe" /layout:"%L"'
- [<HKLM>\SOFTWARE\Classes\WMVFile\shell\open\command] '' = '"%PROGRAM_FILES%\Windows Media Player\wmplayer.exe" /prefetch:7 /Open "%L"'
- [<HKLM>\SOFTWARE\Classes\WMZFile\shell\open\command] '' = '"%PROGRAM_FILES%\Windows Media Player\wmplayer.exe" /layout:"%L"'
- [<HKLM>\SOFTWARE\Classes\WAXFile\shell\open\command] '' = '"%PROGRAM_FILES%\Windows Media Player\wmplayer.exe" /Open "%L"'
- [<HKLM>\SOFTWARE\Classes\wmafile\shell\open\command] '' = '"%PROGRAM_FILES%\Windows Media Player\wmplayer.exe" /prefetch:5 /Open "%L"'
- [<HKLM>\SOFTWARE\Classes\WMDFile\shell\open\command] '' = '"%PROGRAM_FILES%\Windows Media Player\wmplayer.exe" /WMPackage:"%L"'
- [<HKLM>\SOFTWARE\Classes\MMST\shell\open\command] '' = '"%PROGRAM_FILES%\Windows Media Player\wmplayer.exe" "%L"'
- [<HKLM>\SOFTWARE\Classes\MMSU\shell\open\command] '' = '"%PROGRAM_FILES%\Windows Media Player\wmplayer.exe" "%L"'
- [<HKLM>\SOFTWARE\Classes\MSBD\shell\open\command] '' = '"%PROGRAM_FILES%\Windows Media Player\wmplayer.exe" "%L"'
- [<HKLM>\SOFTWARE\Classes\WPLFile\shell\open\command] '' = '"%PROGRAM_FILES%\Windows Media Player\wmplayer.exe" /Open "%L"'
- [<HKLM>\SOFTWARE\Classes\WVXFile\shell\open\command] '' = '"%PROGRAM_FILES%\Windows Media Player\wmplayer.exe" /Open "%L"'
- [<HKLM>\SOFTWARE\Classes\MMS\shell\open\command] '' = '"%PROGRAM_FILES%\Windows Media Player\wmplayer.exe" "%L"'
- [<HKLM>\SOFTWARE\Classes\SoundRec\shell\open\command] '' = '"%PROGRAM_FILES%\Windows Media Player\wmplayer.exe" /Open "%L"'
- [<HKLM>\SOFTWARE\Classes\ASXFile\shell\open\command] '' = '"%PROGRAM_FILES%\Windows Media Player\wmplayer.exe" /Open "%L"'
- [<HKLM>\SOFTWARE\Classes\AUFile\shell\open\command] '' = '"%PROGRAM_FILES%\Windows Media Player\wmplayer.exe" /Open "%L"'
- [<HKLM>\SOFTWARE\Classes\AVIFile\shell\open\command] '' = '"%PROGRAM_FILES%\Windows Media Player\wmplayer.exe" /prefetch:8 /Open "%L"'
- [<HKCU>\Control Panel\Desktop] 'SCRNSAVE.EXE' = '<SYSTEM32>\logon.scr'
- [<HKLM>\SOFTWARE\Classes\AIFFFile\shell\open\command] '' = '"%PROGRAM_FILES%\Windows Media Player\wmplayer.exe" /Open "%L"'
- [<HKLM>\SOFTWARE\Classes\ASFFile\shell\open\command] '' = '"%PROGRAM_FILES%\Windows Media Player\wmplayer.exe" /prefetch:7 /Open "%L"'
- [<HKLM>\SOFTWARE\Classes\m3ufile\shell\open\command] '' = '"%PROGRAM_FILES%\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "%L"'
- [<HKLM>\SOFTWARE\Classes\MIDFile\shell\open\command] '' = '"%PROGRAM_FILES%\Windows Media Player\wmplayer.exe" /Open "%L"'
- [<HKLM>\SOFTWARE\Classes\mp3file\shell\open\command] '' = '"%PROGRAM_FILES%\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "%L"'
- [<HKLM>\SOFTWARE\Classes\cdafile\shell\open\command] '' = '"%PROGRAM_FILES%\Windows Media Player\wmplayer.exe" /Open "%L"'
- [<HKLM>\SOFTWARE\Classes\WMP.DVR-MSFile\shell\open\command] '' = '"%PROGRAM_FILES%\Windows Media Player\wmplayer.exe" /Open "%L"'
- [<HKLM>\SOFTWARE\Classes\mpegfile\shell\open\command] '' = '"%PROGRAM_FILES%\Windows Media Player\wmplayer.exe" /prefetch:9 /Open "%L"'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\TXOService] 'Start' = '00000002'
Malicious functions:
To complicate detection of its presence in the operating system,
forces the system hide from view:
- hidden files
- file extensions
Creates and executes the following:
- '<SYSTEM32>\xoffice.exe'
- '<SYSTEM32>\Execl.exe'
- '<SYSTEM32>\txoWinService.exe'
Executes the following:
- '%WINDIR%\inf\unregmp2.exe' /Shortcuts /RegBrowsers /ResetMUI
- '<SYSTEM32>\rundll32.exe' advpack.dll,LaunchINFSection %WINDIR%\INF\wmp.inf,PerUserStub
- '<SYSTEM32>\rundll32.exe' advpack.dll,LaunchINFSection %WINDIR%\INF\msmsgs.inf,BLC.QuietInstall.PerUser
- '<SYSTEM32>\regsvr32.exe' /s /n /i:U shell32.dll
- '<SYSTEM32>\rundll32.exe' IEDKCS32.DLL,BrandIE4 SIGNUP
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\mscories.dll,Install
- '<SYSTEM32>\msiexec.exe' /V
- '<SYSTEM32>\rundll32.exe' advpack.dll,LaunchINFSectionEx <SYSTEM32>\ieuinit.inf,Install,,36
- '<SYSTEM32>\ie4uinit.exe'
- '%WINDIR%\explorer.exe' /e,/idlist,:176:2848,<SYSTEM32>
- '<SYSTEM32>\shmgrate.exe' OCInstallUserConfigIE
- '<SYSTEM32>\rundll32.exe' setupapi,InstallHinfSection MarketplaceLinkInstall 896 %WINDIR%\inf\ie.inf
- '<SYSTEM32>\shmgrate.exe' OCInstallUserConfigOE
- '<SYSTEM32>\regsvr32.exe' /s /n /i:/UserInstall <SYSTEM32>\themeui.dll
Injects code into
the following system processes:
- <SYSTEM32>\ctfmon.exe
- %WINDIR%\Explorer.EXE
Modifies settings of Windows Internet Explorer:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] 'MinLevel' = '00012000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] 'RecommendedLevel' = '00012000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] 'Description' = 'This zone contains Web sites that could potentially damage your computer or data.'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] 'Icon' = 'inetcpl.cpl#00004481'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] 'CurrentLevel' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] 'CurrentLevel' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] 'Flags' = '00000003'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1201' = '00000003'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] 'MinLevel' = '00011000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] 'RecommendedLevel' = '00011000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] 'Description' = 'This zone contains all Web sites you haven't placed in other zones'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] 'Icon' = 'inetcpl.cpl#001313'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] '' = ''
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] 'DisplayName' = 'Restricted sites'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] 'Flags' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1805' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] 'CurrentLevel' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '2001' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '2004' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2004' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2007' = '00010000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] '2004' = '00000003'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] '2007' = '00000003'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '2007' = '00010000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] '2001' = '00000003'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0] '2004' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0] '2007' = '00000003'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] 'CurrentLevel' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0] '2001' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '2007' = '00010000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2001' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '2001' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '2004' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0] 'DisplayName' = 'My Computer'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0] 'Description' = 'Your computer'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] '{A8A88C49-5EB2-4990-A1A2-0876022C854F}' = '{1a,37,61,59,23,52,35,0c,7a,5f,20,17,2f,1e,1a,19,0e,2b,01,73,13,37,13,12,14,1a,15,39}'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0] '' = ''
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0] 'Flags' = '00000021'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0] '1805' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0] 'Icon' = 'explorer.exe#0100'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0] 'CurrentLevel' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] '1C00' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '{AEBA21FA-782A-4A90-978D-B72164C80120}' = '{1a,37,61,59,23,52,35,0c,7a,5f,20,17,2f,1e,1a,19,0e,2b,01,73,1e,28,1a,04,1b,0c,3b,c2,21,27,53,0d,36,05,2c,05,04,3d,4f,3a,4a,44,33,3a,0a,06,12,68,53,7c,20,13,35,5d,4c,10,27,01,56,7a,2d,3f,38,4f,79,0f,16,26,75,53,1c,31,00,56,7a,3e,32,24,4f,79,1b,00,33,71,4d,...'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'WarnOnPost' = '{01,00,00,00}'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] '1400' = '00000003'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] '{AEBA21FA-782A-4A90-978D-B72164C80120}' = '{1a,37,61,59,23,52,35,0c,7a,5f,20,17,2f,1e,1a,19,0e,2b,01,73,13,37,13,12,14,1a,15,39}'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] '1A10' = '00000003'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1A10' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '{A8A88C49-5EB2-4990-A1A2-0876022C854F}' = '{1a,37,61,59,23,52,35,0c,7a,5f,20,17,2f,1e,1a,19,0e,2b,01,73,1e,28,1a,04,1b,0c,3b,c2,21,2d,53,49,07,25,0f,29,01,7c,50,68,3a,3b,34,4f,79,08,39,0d,49,72,33,1f,39,5d,4c,17,37,05,56,7a,2f,2e,32,4f,79,1f,12,3b,75,53,0b,3f,12,56,7a,3a,20,23,4f,79,12,05,33,71,4d,...'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '' = ''
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] 'MinLevel' = '00010000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] 'RecommendedLevel' = '00010000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] 'Description' = 'This zone contains Web sites that you trust not to damage your computer or data.'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] 'Icon' = 'inetcpl.cpl#00004480'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '' = ''
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] 'DisplayName' = 'Internet'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] 'Flags' = '00000047'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1805' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] 'Icon' = 'shell32.dll#0018'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] 'MinLevel' = '00010000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] 'DisplayName' = 'Local intranet'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] 'Description' = 'This zone contains all Web sites that are on your organization's intranet.'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '' = ''
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] 'DisplayName' = 'Trusted sites'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] 'RecommendedLevel' = '00010500'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '1805' = '00000000'
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system :
Creates the following files:
- C:\Documents and Settings\LocalService\Favorites\Links\Windows Marketplace.url
- C:\Documents and Settings\LocalService\Local Settings\History\desktop.ini
- C:\Documents and Settings\LocalService\Start Menu\Programs\Outlook Express.lnk
- C:\Documents and Settings\LocalService\Start Menu\Programs\Accessories\Address Book.lnk
- C:\Documents and Settings\LocalService\Start Menu\Programs\Windows Media Player.lnk
- C:\Documents and Settings\LocalService\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini
- C:\Documents and Settings\LocalService\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
- C:\Documents and Settings\LocalService\Start Menu\Programs\Internet Explorer.lnk
- C:\Documents and Settings\LocalService\Application Data\Microsoft\Internet Explorer\Desktop.htt
- C:\Documents and Settings\LocalService\Start Menu\Programs\desktop.ini
- C:\Documents and Settings\LocalService\Start Menu\Programs\Accessories\desktop.ini
- C:\Documents and Settings\LocalService\Favorites\Links\Customize Links.url
- C:\Documents and Settings\LocalService\Favorites\Radio Station Guide.url
- C:\Documents and Settings\LocalService\Favorites\Links\Free Hotmail.url
- C:\Documents and Settings\LocalService\Favorites\Links\Windows Media.url
- C:\Documents and Settings\LocalService\Favorites\Links\Windows.url
- C:\Config.Msi\425f5.rbs
- %WINDIR%\Installer\MSI8.tmp
- C:\Documents and Settings\LocalService\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf
- C:\Documents and Settings\LocalService\Favorites\MSN.com.url
- C:\Documents and Settings\LocalService\Application Data\Microsoft\Internet Explorer\brndlog.txt
- %WINDIR%\Temp\RGI7.tmp
- C:\Execl.exe
- <SYSTEM32>\Execl.exe
- C:\Documents and Settings\LocalService\Recent\Desktop.ini
- C:\Documents and Settings\LocalService\My Documents\desktop.ini
- C:\Documents and Settings\LocalService\Favorites\Desktop.ini
- <SYSTEM32>\DLL.dll
- <SYSTEM32>\txoWinService.exe
- <SYSTEM32>\xoffice.exe
- C:\autorun.inf
- <SYSTEM32>\systcm.sys
- C:\Documents and Settings\LocalService\My Documents\My Pictures\Desktop.ini
- %WINDIR%\Temp\RGI3.tmp
- %WINDIR%\Temp\RGI2.tmp
- %WINDIR%\Temp\RGI4.tmp
- %WINDIR%\Temp\RGI6.tmp
- %WINDIR%\Temp\RGI5.tmp
- C:\Documents and Settings\LocalService\My Documents\My Music\Desktop.ini
- C:\Documents and Settings\LocalService\My Documents\My Pictures\Sample Pictures.lnk
- C:\Documents and Settings\LocalService\My Documents\My Music\Sample Music.lnk
- C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\desktop.ini
- %WINDIR%\Temp\RGI1.tmp
Sets the 'hidden' attribute to the following files:
- C:\Documents and Settings\LocalService\My Documents\My Music\Desktop.ini
- C:\Documents and Settings\LocalService\My Documents\My Pictures\Desktop.ini
- C:\Documents and Settings\LocalService\My Documents\desktop.ini
- C:\Documents and Settings\LocalService\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini
- C:\Execl.exe
- C:\autorun.inf
- C:\Documents and Settings\LocalService\Favorites\Desktop.ini
- C:\Documents and Settings\LocalService\Recent\Desktop.ini
Deletes the following files:
- %WINDIR%\Temp\RGI7.tmp
- %WINDIR%\Temp\RGI6.tmp
- C:\Documents and Settings\LocalService\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
- C:\Config.Msi\425f5.rbs
- %WINDIR%\Installer\MSI8.tmp
- %WINDIR%\Temp\RGI2.tmp
- %WINDIR%\Temp\RGI1.tmp
- %WINDIR%\Temp\RGI3.tmp
- %WINDIR%\Temp\RGI5.tmp
- %WINDIR%\Temp\RGI4.tmp
Miscellaneous:
Searches for the following windows:
- ClassName: 'Proxy Desktop' WindowName: '(null)'
- ClassName: '(null)' WindowName: 'GINA Logon'
- ClassName: '' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'