Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- /etc/rc.local
Malicious functions:
Launches itself as a daemon
Performs operations with the file system:
Modifies file access rights:
- /usr/bin/X.org
- /etc/rc.local
- /tmp/.statd_pid
Creates or modifies files:
- /tmp/zVi899
- /usr/bin/X.org
- /tmp/.absintty
- /tmp/.statd_pid
- /home/ftp/ATI-Catalyst-i386-bin.run
- /home/ftp/NVidia-86_64-repack.run
- /home/ftp/intel-xorg-driverpack.install
- /home/ftp/Clamex-Ultra_build_2009-08-12.bin
- /home/ftp/unrar-nonfree_cracked-by-Zer0fAg.run
- /home/ftp/Kaspersky_For-Linux-FS_Trial-x86.run
- /home/ftp/Kaspersky_For-Linux-FS_Trial-x64.run
- /home/ftp/Kaspersky_For-Linux-FS6_Beta2-x86.run
- /home/ftp/DrWeb-for-Linux-glibc2.7.run
- /home/ftp/DrWeb-for-Linux-glibc2.8.run
- /home/ftp/DrWeb-for-Linux-glibc2.9.run
- /home/ftp/VMWare-install-x86.run
- /home/ftp/VMWare-install-x86_64.run
- /home/ftp/F-Prot-2.10_for_Ubuntu.run
- /home/ftp/i640-drv-x86.run
- /home/ftp/KAV_Linux-Crack-NaGi0.run
- /home/ftp/CDCloner.bin
- /home/ftp/FIFA_for_Linux_Patched.install.bin
- /home/ftp/DirectX9.4-forWine-x86.bin
- /home/ftp/Postal_II.crackit.run
- /home/ftp/Goths_In_Kyiv.dvpack.run
- /home/ftp/MAgent-v4.22-Linux-installer-x86.run
- /home/ftp/NGage-Emul-x86-Debian.bin
- /home/ftp/Lineage-Patcher-for-Linux-x86_64.run
- /home/ftp/KaZaA-client-Linux.run
- /home/ftp/NOD32-Linux-netinstall.x86.run
- /home/ftp/WebMoney_Linux_Package.run
- /home/ftp/Kazaa-SDK___Debian_Ubuntu_DeepStylex86.bin
- /home/ftp/Mcafee_Virusscan-x86-Linux-Patched-by-GZ00.run
- /home/ftp/NDIS-3.18-Intel_x86.run
- /home/ftp/ATI-Catalyst-.installer.run
- /home/ftp/GLFX-install.x86.run
- /home/ftp/ICH10R-Alsa-patcher.run
Deletes files:
- /tmp/.absintty