Technical Information
Malicious functions:
Creates and executes the following:
- %TEMP%\nsw3.tmp\ns5.tmp %TEMP%\test.exe
- %TEMP%\nsw3.tmp\ns4.tmp %TEMP%\setup.exe
Executes the following:
- %PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE http://%6#########D%6D%78%78%62%2E%69%6E%66%6F/?i=###########
- %PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE http://%6#########D%6D%78%78%62%2E%69%6E%66%6F/?i=############
- %PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE http://%6#########D%6D%78%78%62%2E%69%6E%66%6F/?i=##################################
- %PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE http://%6#########D%6D%78%78%62%2E%69%6E%66%6F/?i=#######
Modifies file system :
Creates the following files:
- %HOMEPATH%\Favorites\БґЅУ\НшЦ·ґуИ«.url
- %HOMEPATH%\Favorites\БґЅУ\МФ±¦№єОп.url
- %HOMEPATH%\Favorites\БґЅУ\КЦ»ъЧЈёЈ.url
- %HOMEPATH%\Favorites\ѕЙµДКХІШ\MSN.com.url
- %HOMEPATH%\Favorites\ѕЙµДКХІШ\Desktop.ini
- %HOMEPATH%\Favorites\БґЅУ\Фµ·ЦЕд¶Ф.url
- %HOMEPATH%\Favorites\БґЅУ\ЙМТµµјєЅ.url
- %HOMEPATH%\Favorites\БґЅУ\ІШН·К«ґК.url
- %HOMEPATH%\Favorites\БґЅУ\°ЛШФЙ«Нј.url
- %HOMEPATH%\Favorites\Фµ·ЦЕд¶Ф.url
- %HOMEPATH%\Favorites\БґЅУ\ГАЕ®КУЖµ.url
- %HOMEPATH%\Favorites\БґЅУ\»ўДкФЛіМ.url
- %HOMEPATH%\Favorites\БґЅУ\ёцРФЗ©Гы.url
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\go.mmxxb[1]
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\go.mmxxb[1]
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\go.mmxxb[1]
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\go.mmxxb[1]
- %TEMP%\uninst.exe
- %TEMP%\temp.ini
- %TEMP%\nsw3.tmp\ns5.tmp
- %HOMEPATH%\Favorites\ѕЙµДКХІШ\Links\Free Hotmail.url
- %HOMEPATH%\Favorites\ѕЙµДКХІШ\Links\Customize Links.url
- %HOMEPATH%\Favorites\ѕЙµДКХІШ\Radio Station Guide.url
- %HOMEPATH%\Favorites\ѕЙµДКХІШ\Links\Windows.url
- %HOMEPATH%\Favorites\ѕЙµДКХІШ\Links\Windows Media.url
- %HOMEPATH%\Favorites\ѕЙµДКХІШ\Links\Windows Marketplace.url
- %WINDIR%\myfav\Desktop.ini
- %TEMP%\error
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\31recall[1].htm
- %WINDIR%\myfav\Links\Customize Links.url
- %WINDIR%\myfav\Radio Station Guide.url
- %WINDIR%\myfav\MSN.com.url
- %TEMP%\nsw3.tmp\InetLoad.dll
- %TEMP%\nsw3.tmp\System.dll
- %TEMP%\nsw3.tmp\time.dll
- %TEMP%\nsg2.tmp
- %TEMP%\nsw3.tmp\Math.dll
- %TEMP%\nsw3.tmp\ns4.tmp
- %TEMP%\nsw3.tmp\nsExec.dll
- %HOMEPATH%\Favorites\ЙМТµµјєЅ.url
- %HOMEPATH%\Favorites\ГАЕ®КУЖµ.url
- %HOMEPATH%\Favorites\»ўДкФЛіМ.url
- %HOMEPATH%\Favorites\НшЦ·ґуИ«.url
- %HOMEPATH%\Favorites\МФ±¦№єОп.url
- %HOMEPATH%\Favorites\КЦ»ъЧЈёЈ.url
- %HOMEPATH%\Favorites\ёцРФЗ©Гы.url
- %WINDIR%\myfav\Links\Windows Media.url
- %WINDIR%\myfav\Links\Windows Marketplace.url
- %WINDIR%\myfav\Links\Free Hotmail.url
- %HOMEPATH%\Favorites\ІШН·К«ґК.url
- %HOMEPATH%\Favorites\°ЛШФЙ«Нј.url
- %WINDIR%\myfav\Links\Windows.url
Deletes the following files:
- %TEMP%\nsw3.tmp\nsExec.dll
- %TEMP%\nsw3.tmp\Math.dll
- %TEMP%\nsw3.tmp\time.dll
- %TEMP%\nsw3.tmp\System.dll
- %TEMP%\nsw3.tmp\ns5.tmp
- %TEMP%\nsw3.tmp\ns4.tmp
- %TEMP%\nsw3.tmp\InetLoad.dll
- %TEMP%\uninst.exe
Network activity:
Connects to:
- 'go.##xxb.info':80
- 'localhost':1043
- 'localhost':1045
- 'do##.##ayeronline.info':80
- 'localhost':1038
- 'localhost':1039
TCP:
HTTP GET requests:
- go.##xxb.info/?i=###########
- go.##xxb.info/?i=############
- go.##xxb.info/?i=#######
- go.##xxb.info/?i=################################
UDP:
- DNS ASK go.##xxb.info
- DNS ASK do##.##ayeronline.info
Miscellaneous:
Searches for the following windows:
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: '' WindowName: ''