Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'SVCHOST' = 'svchost.com'
Malicious functions:
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Task Manager (Taskmgr)
- Registry Editor (RegEdit)
Terminates or attempts to terminate
the following user processes:
- NAVAPW32.EXE
- nod32.exe
- outpost.exe
- lotroclient.exe
- magent.exe
- MCAGENT.EXE
- zapro.exe
- zlclient.exe
- ZONEALARM.EXE
- smc.exe
- sro_client.exe
- ybclient.exe
- GUARD.EXE
- AVSYNMGR.EXE
- bdagent.exe
- drweb.exe
- ash.exe
- ashAvast.exe
- ashAvSrv.exe
- fsav32.exe
- fsavaui.exe
- fsavgui.exe
- drweb386.exe
- elementclient.exe
- fsav.exe
Modifies file system :
Creates the following files:
- %CommonProgramFiles%\Microsoft Shared\Stationery\Command & Conquer - Generals no cd crack.exe
- %CommonProgramFiles%\Microsoft Shared\Speech\RCXD.tmp
- %CommonProgramFiles%\Microsoft Shared\Stationery\RCXE.tmp
- %CommonProgramFiles%\Microsoft Shared\TextConv\RCXF.tmp
- %CommonProgramFiles%\Microsoft Shared\TextConv\Final Fantasy XI - USA no cd crack.exe
- %CommonProgramFiles%\Microsoft Shared\DW\RCXB.tmp
- %CommonProgramFiles%\Microsoft Shared\DW\Anti-Trojan 4.0.exe
- %CommonProgramFiles%\Microsoft Shared\MSInfo\dMSN mercury messenger 1.7.0.6.exe
- %CommonProgramFiles%\Microsoft Shared\Speech\Adobe Illustrator v10.0 Time Limit Crack.exe
- %CommonProgramFiles%\Microsoft Shared\MSInfo\RCXC.tmp
- %CommonProgramFiles%\Microsoft Shared\Triedit\Besieger DreamCatcher Interactive crack.exe
- %CommonProgramFiles%\Microsoft Shared\Web Folders\RCX13.tmp
- %CommonProgramFiles%\Microsoft Shared\Web Folders\Deus Ex Invisible War NO CD Crack.exe
- %CommonProgramFiles%\Microsoft Shared\web server extensions\Full Spectrum Warrior crack.exe
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\fifo.log
- %CommonProgramFiles%\Microsoft Shared\web server extensions\RCX14.tmp
- %CommonProgramFiles%\Microsoft Shared\VC\Drug Wars - Underworld 1.3.exe
- %CommonProgramFiles%\Microsoft Shared\Triedit\RCX10.tmp
- %CommonProgramFiles%\Microsoft Shared\VC\RCX11.tmp
- %CommonProgramFiles%\Microsoft Shared\VGX\RCX12.tmp
- %CommonProgramFiles%\Microsoft Shared\VGX\Icewind Dale 2 no cd crack.exe
- %CommonProgramFiles%\Microsoft Shared\XP Slipstreamer v1.0 Crack.exe
- %WINDIR%\Downloaded Program Files\RCX3.tmp
- %CommonProgramFiles%\Microsoft Shared\RCX4.tmp
- %PROGRAM_FILES%\Movie Maker\Shared\City of Heroes NCsoft crack.exe
- %WINDIR%\system\SystemRunInternet.dll
- <SYSTEM32>\ClubxXx.exe
- <SYSTEM32>\svchost.com
- %WINDIR%\system\SystemNetBBS.dll
- %WINDIR%\Downloaded Program Files\windows xp key generator.exe
- <Auxiliary element>
- %PROGRAM_FILES%\Movie Maker\Shared\RCX5.tmp
- %HOMEPATH%\My Documents\My Received Files\Magix Video Deluxe 5 beta.exe
- %HOMEPATH%\My Documents\Downloads\RCX8.tmp
- %HOMEPATH%\My Documents\My Received Files\RCX9.tmp
- %CommonProgramFiles%\Microsoft Shared\DAO\RCXA.tmp
- %CommonProgramFiles%\Microsoft Shared\DAO\WinZip Self-Extractor v2.2 keygen.exe
- %WINDIR%\ime\shared\RCX6.tmp
- %WINDIR%\ime\shared\Porno Screensaver.exe
- %WINDIR%\SoftwareDistribution\Download\warcraft 3 maphack.exe
- %HOMEPATH%\My Documents\Downloads\winzip full version key generator.exe
- %WINDIR%\SoftwareDistribution\Download\RCX7.tmp
Deletes the following files:
- %CommonProgramFiles%\Microsoft Shared\Stationery\Command & Conquer - Generals no cd crack.exe
- %CommonProgramFiles%\Microsoft Shared\TextConv\Final Fantasy XI - USA no cd crack.exe
- %CommonProgramFiles%\Microsoft Shared\MSInfo\dMSN mercury messenger 1.7.0.6.exe
- %CommonProgramFiles%\Microsoft Shared\Speech\Adobe Illustrator v10.0 Time Limit Crack.exe
- %CommonProgramFiles%\Microsoft Shared\Triedit\Besieger DreamCatcher Interactive crack.exe
- %CommonProgramFiles%\Microsoft Shared\Web Folders\Deus Ex Invisible War NO CD Crack.exe
- %CommonProgramFiles%\Microsoft Shared\web server extensions\Full Spectrum Warrior crack.exe
- %CommonProgramFiles%\Microsoft Shared\VC\Drug Wars - Underworld 1.3.exe
- %CommonProgramFiles%\Microsoft Shared\VGX\Icewind Dale 2 no cd crack.exe
- %CommonProgramFiles%\Microsoft Shared\DW\Anti-Trojan 4.0.exe
- %CommonProgramFiles%\Microsoft Shared\XP Slipstreamer v1.0 Crack.exe
- %PROGRAM_FILES%\Movie Maker\Shared\City of Heroes NCsoft crack.exe
- <Auxiliary element>
- %WINDIR%\Downloaded Program Files\windows xp key generator.exe
- %WINDIR%\ime\shared\Porno Screensaver.exe
- %HOMEPATH%\My Documents\My Received Files\Magix Video Deluxe 5 beta.exe
- %CommonProgramFiles%\Microsoft Shared\DAO\WinZip Self-Extractor v2.2 keygen.exe
- %WINDIR%\SoftwareDistribution\Download\warcraft 3 maphack.exe
- %HOMEPATH%\My Documents\Downloads\winzip full version key generator.exe
Moves the following files:
- from %CommonProgramFiles%\Microsoft Shared\Stationery\RCXE.tmp to %CommonProgramFiles%\Microsoft Shared\Stationery\Command & Conquer - Generals no cd crack.exe
- from %CommonProgramFiles%\Microsoft Shared\TextConv\RCXF.tmp to %CommonProgramFiles%\Microsoft Shared\TextConv\Final Fantasy XI - USA no cd crack.exe
- from %CommonProgramFiles%\Microsoft Shared\MSInfo\RCXC.tmp to %CommonProgramFiles%\Microsoft Shared\MSInfo\dMSN mercury messenger 1.7.0.6.exe
- from %CommonProgramFiles%\Microsoft Shared\Speech\RCXD.tmp to %CommonProgramFiles%\Microsoft Shared\Speech\Adobe Illustrator v10.0 Time Limit Crack.exe
- from %CommonProgramFiles%\Microsoft Shared\Triedit\RCX10.tmp to %CommonProgramFiles%\Microsoft Shared\Triedit\Besieger DreamCatcher Interactive crack.exe
- from %CommonProgramFiles%\Microsoft Shared\Web Folders\RCX13.tmp to %CommonProgramFiles%\Microsoft Shared\Web Folders\Deus Ex Invisible War NO CD Crack.exe
- from %CommonProgramFiles%\Microsoft Shared\web server extensions\RCX14.tmp to %CommonProgramFiles%\Microsoft Shared\web server extensions\Full Spectrum Warrior crack.exe
- from %CommonProgramFiles%\Microsoft Shared\VC\RCX11.tmp to %CommonProgramFiles%\Microsoft Shared\VC\Drug Wars - Underworld 1.3.exe
- from %CommonProgramFiles%\Microsoft Shared\VGX\RCX12.tmp to %CommonProgramFiles%\Microsoft Shared\VGX\Icewind Dale 2 no cd crack.exe
- from %CommonProgramFiles%\Microsoft Shared\DW\RCXB.tmp to %CommonProgramFiles%\Microsoft Shared\DW\Anti-Trojan 4.0.exe
- from %CommonProgramFiles%\Microsoft Shared\RCX4.tmp to %CommonProgramFiles%\Microsoft Shared\XP Slipstreamer v1.0 Crack.exe
- from %PROGRAM_FILES%\Movie Maker\Shared\RCX5.tmp to %PROGRAM_FILES%\Movie Maker\Shared\City of Heroes NCsoft crack.exe
- from <Auxiliary element> to <Auxiliary element>
- from %WINDIR%\Downloaded Program Files\RCX3.tmp to %WINDIR%\Downloaded Program Files\windows xp key generator.exe
- from %WINDIR%\ime\shared\RCX6.tmp to %WINDIR%\ime\shared\Porno Screensaver.exe
- from %HOMEPATH%\My Documents\My Received Files\RCX9.tmp to %HOMEPATH%\My Documents\My Received Files\Magix Video Deluxe 5 beta.exe
- from %CommonProgramFiles%\Microsoft Shared\DAO\RCXA.tmp to %CommonProgramFiles%\Microsoft Shared\DAO\WinZip Self-Extractor v2.2 keygen.exe
- from %WINDIR%\SoftwareDistribution\Download\RCX7.tmp to %WINDIR%\SoftwareDistribution\Download\warcraft 3 maphack.exe
- from %HOMEPATH%\My Documents\Downloads\RCX8.tmp to %HOMEPATH%\My Documents\Downloads\winzip full version key generator.exe
Miscellaneous:
Searches for the following windows:
- ClassName: 'Indicator' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''