Trojan.DownLoader1.60579

Added to the Dr.Web virus database: 2013-02-13

Virus description added: 2013-02-22

Malicious functions:

Installs hooks to intercept notifications

on keystrokes:

Modifies file system :

Creates the following files:

%TEMP%\2.tmp
%TEMP%\1.tmp
%TEMP%\mymacro.zip
%TEMP%\3.tmp
<Current directory>\plugin\Web.dll
<Current directory>\plugin\Sys.dll
%WINDIR%\qjx.dll
<Current directory>\plugin\Window.dll
%TEMP%\zvflw.dll
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\liveupdate7[1].dat
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\newswindowmm7[1].htm
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\newswindowmm7[1].htm
%TEMP%\adcon\mm\liveupdate7.dat.tmp
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ad-mymacro[1].xml
%TEMP%\2
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\ad-mymacro7[1].htm
%TEMP%\3
<Current directory>\plugin\BkgndColor.dll
<Current directory>\plugin\Bkgnd.dll
<Current directory>\plugin\Console.dll
<Current directory>\plugin\Color.dll
%TEMP%\adcon\mm\tmpad.xml
%TEMP%\ad-mymacro.xml
%TEMP%\temp02.dll
%TEMP%\temp01.dll
<Current directory>\plugin\Encrypt.dll
<Current directory>\plugin\Net.dll
<Current directory>\plugin\Msg.dll
<Current directory>\plugin\Pic.dll
<Current directory>\plugin\Office.dll
<Current directory>\plugin\GetSysInfo.dll
<Current directory>\plugin\File.dll
<Current directory>\plugin\Memory.dll
<Current directory>\plugin\Media.dll

Deletes the following files:

%TEMP%\2.tmp
%TEMP%\3
%TEMP%\3.tmp
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\newswindowmm7[1].htm
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\ad-mymacro7[1].htm
%TEMP%\temp01.dll
%TEMP%\adcon\mm\tmpad.xml
%TEMP%\mymacro.zip
%TEMP%\2
%TEMP%\temp02.dll

Moves the following files:

Network activity:

Connects to:

TCP:

HTTP GET requests:

UDP:

Miscellaneous:

Searches for the following windows: