Technical Information
Malicious functions:
Creates and executes the following:
- '%ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\wajamchecker.exe'
- '%ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\wajamchecker.exe' (downloaded from the Internet)
Modifies file system :
Creates the following files:
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\cnd_express3.html
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\cnd_express2.html
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\dosearches.html
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\omiga.html
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\indexcnd4.html
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\cnddefault.html
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\rinkela.html
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\indexsearchprotector.html
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\linkury_express4b.html
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\rinkela2.html
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\compete2.html
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\compete.html
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\dosearch_express4.html
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\Linkury.html
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\linkury_express4a.html
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\linkury_express4.html
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\images\pc-power-speed.png
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\indexcnd2.html
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\AddLyrics.html
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\SuperCopy.html
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\indexsimplestrong.html
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\indexcnd.html
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\dale.html
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\AddLyricsSA.html
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\indexcnd3.html
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\cnd_express.html
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\photozoom.html
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\wajam.html
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\luckysaving.html
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\wajam2.html
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\remarkit.html
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\yandex.html
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\PCOptimizer3.html
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\indexcndsearchvideo2a.html
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\mypcbackupNon.html
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\PCOptimizerNon.html
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\mypcbackup.html
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\indexcndsearchvideo2.html
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\weather.html
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\shoppingchips.html
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\SPIdentifier[1].exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\installdata[1].php
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\wajamchecker.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\installdata[1].php
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\shoppingchipsNon.html
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\weatherNon.html
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\remarkitNon.html
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\relevantNon.html
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\indexcndsearchvideo.html
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\cnd_express3searchprotect_searchcnd.html
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\indexsearchprotector2.html
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\relevant.html
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\compete2a.html
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\indexcndsearch.html
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\BestOnlineDeals.html
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\cnd_express3searchprotect.html
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\remarkit2.html
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\PCOptimizer.html
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\indexsearchprotector_old.html
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\PCOptimizer2.html
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\images\price-peep.png
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\images\peep.png
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\styleprice.css
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\PricePeep.html
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\Yahoo.html
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\newversion.html
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\index.html
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\images\toolbar.bmp
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\initialize.html
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\js\jquery.progressbar.min.js
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\js\jquery.js
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\favicon.ico
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\js\script.js
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\indexsimple2.html
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\indexsimple.html
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\cnd_test.html
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\images\cndtoolbar.png
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\paththree.html
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\images\next-btnhover.png
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\pagetwo.html
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\pagetwosweet.html
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\font\helveticaneuelt-light-webfont.ttf
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\font\helveticaneuelt-light-webfont.svg
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\images\accept-button.png
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\font\helveticaneuelt-light-webfont.woff
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\style_new.css
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\GP1q[1]
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\font\helveticaneuelt-light-webfont.eot
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\wait.html
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\images\progressbg_green.gif
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\images\next-btn.png
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\js\jquery.easing.1.3.js
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\js\jquery-1.6.2.min.js
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\images\bg_cover.gif
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\images\bg.png
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\images\dream-big.png
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\images\close-button.png
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\images\peep-line.png
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\pagetwoY.html
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\style.css
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\images\screen.png
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\styletweet.css
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\images\strongvault_logo.jpg
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\images\ytoolbar.bmp
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\pagetweettube.html
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\sweetnew.html
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\imioffer.html
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\cnd.html
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\indexask.html
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\images\Deltatoolbar.jpg
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\messanger.html
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\ask.html
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\delta.html
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\paththreeDE.html
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\paththreeUK.html
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\images\yahoo.png
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\wait2.html
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\pageiwantthis.html
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\imi.html
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\images\next-btn2.png
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\style2.css
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\images\social-icon-bg.png
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\images\logo.png
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\strong.html
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\images\toolbarib.jpg
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\images\arrow.png
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\images\a.png
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\images\google.png
- %ALLUSERSPROFILE%\Application Data\ZalmanInstaller_VideoDownloader\images\bing.png
Deletes the following files:
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\installdata[1].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\installdata[1].php
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\GP1q[1]
Network activity:
Connects to:
- 'localhost':1039
- 'sp#######e.conduit-services.com':80
- 'ke######oad.go2cloud.org':80
- '50.##.241.141':80
TCP:
HTTP GET requests:
- 50.##.241.141/installdata.php?p1#######################################################################################################################################################################
- 50.##.241.141/installdata.php?p1#############################################################
- sp#######e.conduit-services.com/spidentifier/spidentifierstub/SPIdentifier.exe
- ke######oad.go2cloud.org/GP1q?tr############################################
- 50.##.241.141/installdata.php?p1#############################################################################################
UDP:
- DNS ASK sp#######e.conduit-services.com
- DNS ASK ke######oad.go2cloud.org
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'MS_WebcheckMonitor' WindowName: '(null)'
- ClassName: 'MS_AutodialMonitor' WindowName: '(null)'