Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Classes\CLSID\{7be9d83c-a729-4d97-b5a7-1b7313c39e0a}\shell\open\command] '' = ''
- [<HKLM>\SOFTWARE\Classes\CLSID\{48e7caab-b918-4e58-a94d-505519c795dc}\shell\open\command] '' = ''
- [<HKLM>\SOFTWARE\Classes\CLSID\{0DF44EAA-FF21-4412-828E-260A8728E7F1}\Shell\Open\Command] '' = ''
- [<HKLM>\SOFTWARE\Classes\CLSID\{6DFD7C5C-2451-11d3-A299-00C04F8EF6AF}\Shell\Open\Command] '' = ''
- [<HKLM>\SOFTWARE\Classes\PROTOCOLS\Handler\mhtml] 'CLSID' = '{05300401-BCBC-11d0-85E3-00C04FD85AB4}'
- [<HKLM>\SOFTWARE\Classes\PROTOCOLS\Handler\cdl] 'CLSID' = '{3dd53d40-7b8b-11D0-b013-00aa0059ce02}'
- [<HKLM>\SOFTWARE\Classes\PROTOCOLS\Filter\Class Install Handler] 'CLSID' = '{32B533BB-EDAE-11d0-BD5A-00AA00B92AF1}'
- [<HKLM>\SOFTWARE\Classes\PROTOCOLS\Handler\dvd] 'CLSID' = '{12D51199-0DB5-46FE-A120-47A3D7D937CC}'
- [<HKLM>\SOFTWARE\Classes\PROTOCOLS\Handler\tv] 'CLSID' = '{CBD30858-AF45-11D2-B6D6-00C04FBBDE6E}'
- [<HKLM>\SOFTWARE\Classes\InternetShortcut\shell\open\command] '' = 'rundll32.exe url.dll,OpenURL %l'
- [<HKLM>\SOFTWARE\Classes\PROTOCOLS\Handler\wia] 'CLSID' = '{13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE}'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] '{AEB6717E-7E19-11d0-97EE-00C04FD91972}' = ''
- [<HKLM>\SOFTWARE\Classes\InternetShortcut\shell\open\command] '' = 'rundll32.exe shdocvw.dll,OpenURL %l'
- [<HKLM>\SOFTWARE\Classes\SHCmdFile\shell\open\command] '' = 'explorer.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] 'PostBootReminder' = '{7849596a-48ea-486e-8937-a2a3009f31a9}'
- [<HKLM>\SOFTWARE\Classes\PROTOCOLS\Filter\text/webviewhtml] 'CLSID' = '{733AC4CB-F1A4-11d0-B951-00A0C90312E1}'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] 'CDBurn' = '{fbeb8a05-beee-4442-804e-409d6c4515e9}'
- [<HKLM>\SOFTWARE\Classes\CLSID\{E773F1AF-3A65-4866-857D-846FC9C4598A}\shell\open\command] '' = ''
- [<HKLM>\SOFTWARE\Classes\PROTOCOLS\Handler\mailto] 'CLSID' = '{3050f3DA-98B5-11CF-BB82-00AA00BDCE0B}'
- [<HKLM>\SOFTWARE\Classes\PROTOCOLS\Handler\res] 'CLSID' = '{3050F3BC-98B5-11CF-BB82-00AA00BDCE0B}'
- [<HKLM>\SOFTWARE\Classes\PROTOCOLS\Handler\http] 'CLSID' = '{79eac9e2-baf9-11ce-8c82-00aa004ba90b}'
- [<HKLM>\SOFTWARE\Classes\PROTOCOLS\Handler\sysimage] 'CLSID' = '{76E67A63-06E9-11D2-A840-006008059382}'
- [<HKLM>\SOFTWARE\Classes\PROTOCOLS\Handler\about] 'CLSID' = '{3050F406-98B5-11CF-BB82-00AA00BDCE0B}'
- [<HKLM>\SOFTWARE\Classes\PROTOCOLS\Handler\ms-its] 'CLSID' = '{9D148291-B9C8-11D0-A4CC-0000F80149F6}'
- [<HKLM>\SOFTWARE\Classes\PROTOCOLS\Handler\its] 'CLSID' = '{9D148291-B9C8-11D0-A4CC-0000F80149F6}'
- [<HKLM>\SOFTWARE\Classes\PROTOCOLS\Handler\vbscript] 'CLSID' = '{3050F3B2-98B5-11CF-BB82-00AA00BDCE0B}'
- [<HKLM>\SOFTWARE\Classes\PROTOCOLS\Handler\javascript] 'CLSID' = '{3050F3B2-98B5-11CF-BB82-00AA00BDCE0B}'
- [<HKLM>\SOFTWARE\Classes\PROTOCOLS\Filter\lzdhtml] 'CLSID' = '{8f6b0360-b80d-11d0-a9b3-006097942311}'
- [<HKLM>\SOFTWARE\Classes\PROTOCOLS\Handler\local] 'CLSID' = '{79eac9e7-baf9-11ce-8c82-00aa004ba90b}'
- [<HKLM>\SOFTWARE\Classes\PROTOCOLS\Filter\gzip] 'CLSID' = '{8f6b0360-b80d-11d0-a9b3-006097942311}'
- [<HKLM>\SOFTWARE\Classes\PROTOCOLS\Filter\deflate] 'CLSID' = '{8f6b0360-b80d-11d0-a9b3-006097942311}'
- [<HKLM>\SOFTWARE\Classes\PROTOCOLS\Handler\file] 'CLSID' = '{79eac9e7-baf9-11ce-8c82-00aa004ba90b}'
- [<HKLM>\SOFTWARE\Classes\PROTOCOLS\Handler\gopher] 'CLSID' = '{79eac9e4-baf9-11ce-8c82-00aa004ba90b}'
- [<HKLM>\SOFTWARE\Classes\PROTOCOLS\Handler\ftp] 'CLSID' = '{79eac9e3-baf9-11ce-8c82-00aa004ba90b}'
- [<HKLM>\SOFTWARE\Classes\PROTOCOLS\Handler\mk] 'CLSID' = '{79eac9e6-baf9-11ce-8c82-00aa004ba90b}'
- [<HKLM>\SOFTWARE\Classes\PROTOCOLS\Handler\https] 'CLSID' = '{79eac9e5-baf9-11ce-8c82-00aa004ba90b}'
Malicious functions:
To complicate detection of its presence in the operating system,
forces the system hide from view:
- hidden files
Creates and executes the following:
- %PROGRAM_FILES%\Related Search\Toolbar.exe
Terminates or attempts to terminate
the following user processes:
- opera.exe
- iexplore.exe
Modifies settings of Windows Internet Explorer:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] 'Icon' = 'inetcpl.cpl#001313'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] 'Description' = 'This zone contains all Web sites you haven't placed in other zones'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] 'RecommendedLevel' = '00011000'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] 'MinLevel' = '00011000'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] 'DisplayName' = 'Internet'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] 'Flags' = '00000047'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] 'RecommendedLevel' = '00010000'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '' = ''
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1805' = '00000000'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] 'Flags' = '00000001'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] 'RecommendedLevel' = '00012000'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] 'MinLevel' = '00012000'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] '1805' = '00000001'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] 'Flags' = '00000003'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] 'Icon' = 'inetcpl.cpl#00004481'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] '' = ''
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1805' = '00000001'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] 'Description' = 'This zone contains Web sites that could potentially damage your computer or data.'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] 'DisplayName' = 'Restricted sites'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0] '1805' = '00000000'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0] 'Flags' = '00000021'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] 'DisplayName' = 'Local intranet'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '' = ''
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0] 'CurrentLevel' = '00000000'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0] 'DisplayName' = 'My Computer'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0] '' = ''
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0] 'Icon' = 'explorer.exe#0100'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0] 'Description' = 'Your computer'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] 'Description' = 'This zone contains all Web sites that are on your organization's intranet.'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] 'Description' = 'This zone contains Web sites that you trust not to damage your computer or data.'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] 'DisplayName' = 'Trusted sites'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] 'MinLevel' = '00010000'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] 'Icon' = 'inetcpl.cpl#00004480'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '' = ''
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] 'MinLevel' = '00010000'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] 'Icon' = 'shell32.dll#0018'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '1805' = '00000000'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] 'RecommendedLevel' = '00010500'
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system :
Creates the following files:
- %TEMP%\RGI13.tmp
- %TEMP%\RGI12.tmp
- %TEMP%\RGI15.tmp
- %TEMP%\RGI14.tmp
- %TEMP%\RGIF.tmp
- %TEMP%\RGIE.tmp
- %TEMP%\RGI11.tmp
- %TEMP%\RGI10.tmp
- <SYSTEM32>\iegfxfrw.dll
- %TEMP%\RGI1A.tmp
- %TEMP%\jefb.bat
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\version[1].php
- %TEMP%\RGI17.tmp
- %TEMP%\RGI16.tmp
- %TEMP%\RGI19.tmp
- %TEMP%\RGI18.tmp
- %TEMP%\RGID.tmp
- %PROGRAM_FILES%\Related Search\uninstall.exe
- %TEMP%\nsp3.tmp\RegSvr33.dll
- %TEMP%\RGI4.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\versionbefore[1].php
- %PROGRAM_FILES%\Related Search\Toolbar.exe
- %TEMP%\nsc2.tmp
- %PROGRAM_FILES%\Related Search\RelatedSearch.dll
- %PROGRAM_FILES%\Related Search\Codek.dll
- %TEMP%\RGIA.tmp
- %TEMP%\RGI9.tmp
- %TEMP%\RGIC.tmp
- %TEMP%\RGIB.tmp
- %TEMP%\RGI6.tmp
- %TEMP%\RGI5.tmp
- %TEMP%\RGI8.tmp
- %TEMP%\RGI7.tmp
Deletes the following files:
- %TEMP%\RGI14.tmp
- %TEMP%\RGI15.tmp
- %TEMP%\RGI16.tmp
- %TEMP%\RGI11.tmp
- %TEMP%\RGI12.tmp
- %TEMP%\RGI13.tmp
- %TEMP%\RGI17.tmp
- <SYSTEM32>\amcompat.tlb
- <SYSTEM32>\nscompat.tlb
- %PROGRAM_FILES%\Related Search\Toolbar.exe
- %TEMP%\RGI18.tmp
- %TEMP%\RGI19.tmp
- %TEMP%\RGI1A.tmp
- %TEMP%\RGI10.tmp
- %TEMP%\RGI6.tmp
- %TEMP%\RGI7.tmp
- %TEMP%\RGI8.tmp
- %TEMP%\nsp3.tmp\RegSvr33.dll
- %TEMP%\RGI4.tmp
- %TEMP%\RGI5.tmp
- %TEMP%\RGI9.tmp
- %TEMP%\RGID.tmp
- %TEMP%\RGIE.tmp
- %TEMP%\RGIF.tmp
- %TEMP%\RGIA.tmp
- %TEMP%\RGIB.tmp
- %TEMP%\RGIC.tmp
Network activity:
Connects to:
- 'www.up###ind.com':80
- 'localhost':1037
TCP:
HTTP GET requests:
- www.up###ind.com/tbg/s/version.php?c=##
- www.up###ind.com/tbg/s/versionbefore.php?c=##
UDP:
- DNS ASK www.up###ind.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'ReBarWindow32' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''