Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices] '<Virus name>' = '<Full path to virus>'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '<Virus name>' = '<Full path to virus>'
Modifies file system :
Creates the following files:
- %PROGRAM_FILES%\MSN\MSNCoreFiles\OOBE\MicrosoftRSystem.exe
- %PROGRAM_FILES%\Windows Media Player\PlayerNpdsplay.exe
- %CommonProgramFiles%\SpeechEngines\Microsoft\SpeechEngine.exe
- %PROGRAM_FILES%\Reference Assemblies\Microsoft\Framework\v3.5\FrameworkMicrosoft.exe
- %PROGRAM_FILES%\NetMeeting\Windowsnmas5.1.2600.2180.exe
- %CommonProgramFiles%\System\msadc\msaddsrData.exe
- %CommonProgramFiles%\Microsoft Shared\TextConv\Documentmsconv97.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\getfile[1].php
- %CommonProgramFiles%\Microsoft Shared\DW\1031\ApplicationError11.0.5510.exe
- %CommonProgramFiles%\Microsoft Shared\Triedit\ComponentDHTML.exe
- %PROGRAM_FILES%\Internet Explorer\WindowsSystem.exe
- %PROGRAM_FILES%\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationProviderPresentationFramework.exe
- %CommonProgramFiles%\<Auxiliary name>\Drivers\Virtual Printer\TPOGPS\i386\GatewayThinPrint.exe
- %CommonProgramFiles%\SpeechEngines\Microsoft\TTS\1033\SAPI5WindowsTM.exe
- %PROGRAM_FILES%\Windows NT\Pinball\PINBALLPinball.exe
- %CommonProgramFiles%\System\MicrosoftSystem6.00.2900.21802.0408032158.exe
- %CommonProgramFiles%\Microsoft Shared\Speech\WindowsTMWindowsTM5.1.4111.00.exe
- %PROGRAM_FILES%\FireFox\uninstall\helperTumucumaque.exe
- %CommonProgramFiles%\Microsoft Shared\DAO\MicrosoftDAO36003.60.8618.0.exe
- %PROGRAM_FILES%\Internet Explorer\Connection Wizard\Windowsicwconn1.exe
- %CommonProgramFiles%\System\Ole DB\msdascmsdaosp2.81.1117.0.exe
- %CommonProgramFiles%\Microsoft Shared\MSInfo\WindowsOperating5.1.2600.0.exe
- %PROGRAM_FILES%\Internet Explorer\MUI\0409\mscorierMicrosoft.exe
- %PROGRAM_FILES%\Messenger\msmsgsmsgslang.exe
- %PROGRAM_FILES%\Windows NT\SystemHYPERTRM.exe
- %CommonProgramFiles%\<Auxiliary name>\Drivers\Virtual Printer\TPOG3\i386\ThinPrintThinPrint782095.exe
- %PROGRAM_FILES%\MSN\MSNCoreFiles\Install\MicrosoftRWindows.exe
- %CommonProgramFiles%\Microsoft Shared\DW\1025\ApplicationReporting.exe
- %PROGRAM_FILES%\MSN\MSNCoreFiles\Install\MSN9Components\WindowsMicrosoftR5.50.4134.600.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\google[1]
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\v=78&step=2&hostid=8AFBDC759981BCFBF46C93C81128BB94[1]
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\getfile[1].php
- <Auxiliary element>
- %CommonProgramFiles%\Microsoft Shared\DW\1042\DWIntl20Reporting.exe
- %CommonProgramFiles%\MSSoap\Binaries\Resources\1033\SoapMSSOAPR1.02.814.0.exe
- %PROGRAM_FILES%\Windows NT\Accessories\wordpadSystem.exe
- %PROGRAM_FILES%\MSN Gaming Zone\Windows\zonelibZone1.2.626.1.exe
- %PROGRAM_FILES%\Movie Maker\WindowsWMM2RES2.exe
- %CommonProgramFiles%\Microsoft Shared\DW\3082\DWIntl20Reporting11.0.5510.exe
- %CommonProgramFiles%\System\ado\ADORH15Access.exe
- %CommonProgramFiles%\Microsoft Shared\DW\1028\MicrosoftReporting.exe
- %PROGRAM_FILES%\Outlook Express\WindowsMicrosoft.exe
- %CommonProgramFiles%\Microsoft Shared\DW\1036\DWIntl20Application.exe
- %PROGRAM_FILES%\FireFox\components\browsercompsTumucumaque2.0.2.exe
- %PROGRAM_FILES%\Online Services\ServiceRefer15269.exe
Deletes the following files:
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\v=78&step=2&hostid=8AFBDC759981BCFBF46C93C81128BB94[1]
Network activity:
Connects to:
- '74.##5.232.51':80
- 'ht####bsearch.info':80
- 'localhost':1038
TCP:
HTTP GET requests:
- ht####bsearch.info/getfile.php?r=##############################################################################################
- ht####bsearch.info/getfile.php?r=#############################################################################################
- ht####bsearch.info/httpss/v=78&step=2&hostid=8AFBDC759981BCFBF46C93C81128BB94
- 74.##5.232.51/
UDP:
- DNS ASK google.com
- DNS ASK ht####bsearch.info
- DNS ASK 13#######2.httpwebsearch.info
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''