Win32.IRC.Bot.644

Win32.IRC.Bot.644

Added to the Dr.Web virus database: 2014-02-23

Virus description added: 2014-02-24

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Active Setup\Installed Components\{28ABC5C0-4FCB-11CF-AAX5-81CX1C635612}] 'StubPath' = 'c:\SYSTEMFILES\x-f-324553-12314-3344-1\ise32.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'svchost32' = '%APPDATA%\svchost32.exe'

Creates the following files on removable media:

<Drive name for removable media>:\autorun.inf
<Drive name for removable media>:\SYSTEMFILES\x-f-324553-12314-3344-1\ise32.exe
<Drive name for removable media>:\SYSTEMFILES\x-f-324553-12314-3344-1\Desktop.ini

Malicious functions:

Executes the following:

'<SYSTEM32>\rundll32.exe' <SYSTEM32>\sysdm.cpl,NoExecuteProcessException %WINDIR%\explorer.exe
'<SYSTEM32>\dumprep.exe' 1428 -dm 7 7 %TEMP%\WER8211.dir00\explorer.exe.hdmp 16325836412028092
'<SYSTEM32>\dumprep.exe' 1428 -dm 7 7 %TEMP%\WER8211.dir00\explorer.exe.mdmp 16325836412028080

Injects code into

the following system processes:

Modifies file system :

Creates the following files:

Sets the 'hidden' attribute to the following files:

Network activity:

Connects to:

UDP:

Miscellaneous:

Searches for the following windows: