Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Classes\.exe] '' = 'exefile'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'svchoost' = '<DRIVERS>\spoclsv.exe'
Malicious functions:
To complicate detection of its presence in the operating system,
forces the system hide from view:
- hidden files
blocks execution of the following system utilities:
- Windows Task Manager (Taskmgr)
- Registry Editor (RegEdit)
Executes the following:
- <SYSTEM32>\cmd.exe /c %WINDIR%\17mt.bat
- <SYSTEM32>\taskkill.exe /f /im QQMusic.exe /t
- <SYSTEM32>\taskkill.exe /f /im sogouExplorer exe /t
- <SYSTEM32>\logonui.exe /status /shutdown
- <SYSTEM32>\format.com c:
- %WINDIR%\regedit.exe /s reg.reg
- <SYSTEM32>\taskkill.exe /f /im taskmgr.exe /t
- <SYSTEM32>\taskkill.exe /f /im kav32.exe /t
- <SYSTEM32>\taskkill.exe /f /im dr.com /t
- <SYSTEM32>\taskkill.exe /f /im 360se.exe /t
- <SYSTEM32>\taskkill.exe /f /im MSN Explorer.exe /t
- <SYSTEM32>\taskkill.exe /f /im qq.exe /t
Terminates or attempts to terminate
the following user processes:
- dnf.exe
- chrome.exe
Searches for windows to
detect programs and games:
- ClassName: '' WindowName: 'qq.exe'
Modifies settings of Windows Explorer:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoViewContextMenu' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoClose' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoViewOnDrive' = 'FFFFFFFF'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoControlPanel' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoRun' = '00000001'
Hides the following processes:
- <Full path to virus>
Sets a new unauthorized home page for Windows Internet Explorer.
Attempts to shut down the Windows operating system.
Modifies file system :
Creates the following files:
- %WINDIR%\17mt.bat
- C:\17mt.ico
- <DRIVERS>\spoclsv.exe
Miscellaneous:
Searches for the following windows:
- ClassName: '' WindowName: 'TBMon.exe'
- ClassName: '' WindowName: 'scan32.exe'
- ClassName: '' WindowName: 'naPrdMgr.exe'
- ClassName: '' WindowName: 'UpdaterUI.exe'
- ClassName: '' WindowName: 'RavTask.exe'
- ClassName: '' WindowName: 'Rav.exe'
- ClassName: '' WindowName: 'Ravmond.exe'
- ClassName: '' WindowName: 'CCenter.exe'
- ClassName: '' WindowName: 'VsTskMgr.exe'
- ClassName: '' WindowName: 'QQPCRTP.exe'
- ClassName: '' WindowName: 'KSafeTray.exe'
- ClassName: '' WindowName: 'plantsvszombies.exe.exe'
- ClassName: '' WindowName: 'gta_sa.exe'
- ClassName: '' WindowName: 'VirusScan.exe'
- ClassName: '' WindowName: 'Mcshield.exe'
- ClassName: '' WindowName: 'QQKav.exe'
- ClassName: '' WindowName: 'QQAV.exe'
- ClassName: '' WindowName: 'Logo_1.exe'
- ClassName: '' WindowName: 'Rundl132.exe'
- ClassName: '' WindowName: 'FrogAgent.exe'
- ClassName: '' WindowName: 'Logo1_.exe'
- ClassName: 'RegEdit_RegEdit' WindowName: ''
- ClassName: 'StatusWindowClass' WindowName: ''
- ClassName: '' WindowName: 'e.exe'
- ClassName: '' WindowName: '360se.exe'
- ClassName: '' WindowName: 'TrojDie.kxp'
- ClassName: '' WindowName: 'KVXP.kxp'
- ClassName: '' WindowName: 'kvMonXP.kxp '
- ClassName: '' WindowName: 'Ravmon.exe'
- ClassName: '' WindowName: 'RavStub.exe'
- ClassName: '' WindowName: 'KRegEx.exe'
- ClassName: '' WindowName: 'UIHost.exe'
- ClassName: '' WindowName: 'KVCenter.kxp'
- ClassName: '' WindowName: 'KVSrvXP.exe'
- ClassName: '' WindowName: 'QvodPlayer.exe'
- ClassName: '' WindowName: 'QvodTerminal.exe'
- ClassName: '' WindowName: 'ComputerMonZ.exe'
- ClassName: '' WindowName: 'QQLive.exe'
- ClassName: '' WindowName: 'DNF.exe'
- ClassName: '' WindowName: 'QQGame.exe'
- ClassName: '' WindowName: 'duospeak.exe'
- ClassName: '' WindowName: 'KartRider.exe'
- ClassName: '' WindowName: 'ComputerZ_CN.exe'
- ClassName: 'Indicator' WindowName: ''
- ClassName: '' WindowName: 'AliIM.exe'
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'Progman' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: '' WindowName: 'chrome.exe'
- ClassName: '' WindowName: 'TheWorld.exe'
- ClassName: '' WindowName: 'Maxthon.exe'
- ClassName: '' WindowName: 'KuGoo.exe'
- ClassName: '' WindowName: 'imeutil.exe'
- ClassName: '' WindowName: 'QQ????.exe'
- ClassName: '' WindowName: 'my.exe'
- ClassName: '' WindowName: 'Thunder.exe'
- ClassName: '' WindowName: 'ThunderNB.exe'
- ClassName: '' WindowName: 'NOTEPAD.exe'
- ClassName: '' WindowName: 'SoftManager.exe'
- ClassName: '' WindowName: 'ui_launch_dx_bak.exe'
- ClassName: '' WindowName: 'TXPlatform.exe'
- ClassName: '' WindowName: 'QQMusic.exe'
- ClassName: '' WindowName: '????QQ????????.exe'
- ClassName: '' WindowName: 'HaoZip.exe'
- ClassName: '' WindowName: 'GameApp.exe'
- ClassName: '' WindowName: 'CrossFire.exe'
- ClassName: '' WindowName: 'sogouexplorer.exe'
- ClassName: '' WindowName: 'procmgrex.exe'