Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'SVCHOST' = 'svchost.com'
Malicious functions:
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Task Manager (Taskmgr)
- Registry Editor (RegEdit)
Terminates or attempts to terminate
the following user processes:
- NAVAPW32.EXE
- nod32.exe
- outpost.exe
- lotroclient.exe
- magent.exe
- MCAGENT.EXE
- zapro.exe
- zlclient.exe
- ZONEALARM.EXE
- smc.exe
- sro_client.exe
- ybclient.exe
- GUARD.EXE
- AVSYNMGR.EXE
- bdagent.exe
- drweb.exe
- ash.exe
- ashAvast.exe
- ashAvSrv.exe
- fsav32.exe
- fsavaui.exe
- fsavgui.exe
- drweb386.exe
- elementclient.exe
- fsav.exe
Modifies file system :
Creates the following files:
- %CommonProgramFiles%\Microsoft Shared\Stationery\WinZip v9.0 Registration.exe
- %CommonProgramFiles%\Microsoft Shared\Speech\RCXD.tmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\RCXE.tmp
- %CommonProgramFiles%\Microsoft Shared\TextConv\RCXF.tmp
- %CommonProgramFiles%\Microsoft Shared\TextConv\AquaZone Desktop Garden 1.0.1.1 full Crack.exe
- %CommonProgramFiles%\Microsoft Shared\DW\RCXB.tmp
- %CommonProgramFiles%\Microsoft Shared\DW\Virtuosa Phoenix Edition Crack.exe
- %CommonProgramFiles%\Microsoft Shared\MSInfo\ABBY FineReader Pro 7.0 Crack.exe
- %CommonProgramFiles%\Microsoft Shared\Speech\CD to MP3 Freeware 1.5 .exe
- %CommonProgramFiles%\Microsoft Shared\MSInfo\RCXC.tmp
- %CommonProgramFiles%\Microsoft Shared\Web Folders\Blinx 2 - Masters of Time & Space Microsoft crack.exe
- %CommonProgramFiles%\Microsoft Shared\VGX\RCX12.tmp
- %CommonProgramFiles%\Microsoft Shared\Web Folders\RCX13.tmp
- %CommonProgramFiles%\Microsoft Shared\web server extensions\RCX14.tmp
- %CommonProgramFiles%\Microsoft Shared\web server extensions\DVD Region-Free 5.5 Crack.exe
- %CommonProgramFiles%\Microsoft Shared\Triedit\RCX10.tmp
- %CommonProgramFiles%\Microsoft Shared\Triedit\Dope Wars Crack.exe
- %CommonProgramFiles%\Microsoft Shared\VC\CopyToDVD 3.0.3 Crack.exe
- %CommonProgramFiles%\Microsoft Shared\VGX\FlashFXP All Version KeyGen.exe
- %CommonProgramFiles%\Microsoft Shared\VC\RCX11.tmp
- %CommonProgramFiles%\Microsoft Shared\DAO\RCXA.tmp
- %CommonProgramFiles%\Microsoft Shared\Jedi Academy NO CD Crack.exe
- %WINDIR%\Downloaded Program Files\RCX3.tmp
- %CommonProgramFiles%\Microsoft Shared\RCX4.tmp
- %PROGRAM_FILES%\Movie Maker\Shared\Medal of Honor Pacific Assault crack.exe
- %WINDIR%\system\SystemRunInternet.dll
- <SYSTEM32>\ClubxXx.exe
- <SYSTEM32>\svchost.com
- %WINDIR%\system\SystemNetBBS.dll
- %WINDIR%\Downloaded Program Files\jamella's diablo 2 editor.exe
- <Auxiliary element>
- %HOMEPATH%\My Documents\Downloads\RCX8.tmp
- %HOMEPATH%\My Documents\Downloads\winamp plugin pack.exe
- %HOMEPATH%\My Documents\My Received Files\Britney Spears blowjob.exe
- %CommonProgramFiles%\Microsoft Shared\DAO\Age of Empires II The Age of Kings NO CD crack.exe
- %HOMEPATH%\My Documents\My Received Files\RCX9.tmp
- %WINDIR%\ime\shared\Adobe Photoshop 9 full.exe
- %PROGRAM_FILES%\Movie Maker\Shared\RCX5.tmp
- %WINDIR%\ime\shared\RCX6.tmp
- %WINDIR%\SoftwareDistribution\Download\RCX7.tmp
- %WINDIR%\SoftwareDistribution\Download\playstation 2 emulator fanix.exe
Deletes the following files:
- %CommonProgramFiles%\Microsoft Shared\Stationery\WinZip v9.0 Registration.exe
- %CommonProgramFiles%\Microsoft Shared\TextConv\AquaZone Desktop Garden 1.0.1.1 full Crack.exe
- %CommonProgramFiles%\Microsoft Shared\MSInfo\ABBY FineReader Pro 7.0 Crack.exe
- %CommonProgramFiles%\Microsoft Shared\Speech\CD to MP3 Freeware 1.5 .exe
- %CommonProgramFiles%\Microsoft Shared\Triedit\Dope Wars Crack.exe
- %CommonProgramFiles%\Microsoft Shared\Web Folders\Blinx 2 - Masters of Time & Space Microsoft crack.exe
- %CommonProgramFiles%\Microsoft Shared\web server extensions\DVD Region-Free 5.5 Crack.exe
- %CommonProgramFiles%\Microsoft Shared\VC\CopyToDVD 3.0.3 Crack.exe
- %CommonProgramFiles%\Microsoft Shared\VGX\FlashFXP All Version KeyGen.exe
- %CommonProgramFiles%\Microsoft Shared\DW\Virtuosa Phoenix Edition Crack.exe
- %CommonProgramFiles%\Microsoft Shared\Jedi Academy NO CD Crack.exe
- %PROGRAM_FILES%\Movie Maker\Shared\Medal of Honor Pacific Assault crack.exe
- <Auxiliary element>
- %WINDIR%\Downloaded Program Files\jamella's diablo 2 editor.exe
- %WINDIR%\ime\shared\Adobe Photoshop 9 full.exe
- %HOMEPATH%\My Documents\My Received Files\Britney Spears blowjob.exe
- %CommonProgramFiles%\Microsoft Shared\DAO\Age of Empires II The Age of Kings NO CD crack.exe
- %WINDIR%\SoftwareDistribution\Download\playstation 2 emulator fanix.exe
- %HOMEPATH%\My Documents\Downloads\winamp plugin pack.exe
Moves the following files:
- from %CommonProgramFiles%\Microsoft Shared\Stationery\RCXE.tmp to %CommonProgramFiles%\Microsoft Shared\Stationery\WinZip v9.0 Registration.exe
- from %CommonProgramFiles%\Microsoft Shared\TextConv\RCXF.tmp to %CommonProgramFiles%\Microsoft Shared\TextConv\AquaZone Desktop Garden 1.0.1.1 full Crack.exe
- from %CommonProgramFiles%\Microsoft Shared\MSInfo\RCXC.tmp to %CommonProgramFiles%\Microsoft Shared\MSInfo\ABBY FineReader Pro 7.0 Crack.exe
- from %CommonProgramFiles%\Microsoft Shared\Speech\RCXD.tmp to %CommonProgramFiles%\Microsoft Shared\Speech\CD to MP3 Freeware 1.5 .exe
- from %CommonProgramFiles%\Microsoft Shared\Triedit\RCX10.tmp to %CommonProgramFiles%\Microsoft Shared\Triedit\Dope Wars Crack.exe
- from %CommonProgramFiles%\Microsoft Shared\Web Folders\RCX13.tmp to %CommonProgramFiles%\Microsoft Shared\Web Folders\Blinx 2 - Masters of Time & Space Microsoft crack.exe
- from %CommonProgramFiles%\Microsoft Shared\web server extensions\RCX14.tmp to %CommonProgramFiles%\Microsoft Shared\web server extensions\DVD Region-Free 5.5 Crack.exe
- from %CommonProgramFiles%\Microsoft Shared\VC\RCX11.tmp to %CommonProgramFiles%\Microsoft Shared\VC\CopyToDVD 3.0.3 Crack.exe
- from %CommonProgramFiles%\Microsoft Shared\VGX\RCX12.tmp to %CommonProgramFiles%\Microsoft Shared\VGX\FlashFXP All Version KeyGen.exe
- from %CommonProgramFiles%\Microsoft Shared\DW\RCXB.tmp to %CommonProgramFiles%\Microsoft Shared\DW\Virtuosa Phoenix Edition Crack.exe
- from %CommonProgramFiles%\Microsoft Shared\RCX4.tmp to %CommonProgramFiles%\Microsoft Shared\Jedi Academy NO CD Crack.exe
- from %PROGRAM_FILES%\Movie Maker\Shared\RCX5.tmp to %PROGRAM_FILES%\Movie Maker\Shared\Medal of Honor Pacific Assault crack.exe
- from <Auxiliary element> to <Auxiliary element>
- from %WINDIR%\Downloaded Program Files\RCX3.tmp to %WINDIR%\Downloaded Program Files\jamella's diablo 2 editor.exe
- from %WINDIR%\ime\shared\RCX6.tmp to %WINDIR%\ime\shared\Adobe Photoshop 9 full.exe
- from %HOMEPATH%\My Documents\My Received Files\RCX9.tmp to %HOMEPATH%\My Documents\My Received Files\Britney Spears blowjob.exe
- from %CommonProgramFiles%\Microsoft Shared\DAO\RCXA.tmp to %CommonProgramFiles%\Microsoft Shared\DAO\Age of Empires II The Age of Kings NO CD crack.exe
- from %WINDIR%\SoftwareDistribution\Download\RCX7.tmp to %WINDIR%\SoftwareDistribution\Download\playstation 2 emulator fanix.exe
- from %HOMEPATH%\My Documents\Downloads\RCX8.tmp to %HOMEPATH%\My Documents\Downloads\winamp plugin pack.exe
Miscellaneous:
Searches for the following windows:
- ClassName: 'Indicator' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''