Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'omc.dll.exe' = 'C:/windows/system32/omc.dll.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Olrox.exe' = 'C:/windows/ShellNew/Olrox.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Issas.exe' = 'C:/windows/System32/Issas.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'command.com.com' = 'C:/Command.com.com'
Creates the following files on removable media:
- <Drive name for removable media>:\Autorun.inf
- <Drive name for removable media>:\olrox.exe
Malicious functions:
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Task Manager (Taskmgr)
- Registry Editor (RegEdit)
Executes the following:
- <SYSTEM32>\reg.exe add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v omc.dll.exe /t REG_SZ /d C:/windows/system32/omc.dll.exe
- <SYSTEM32>\reg.exe add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Olrox.exe /t REG_SZ /d C:/windows/ShellNew/Olrox.exe
- <SYSTEM32>\reg.exe add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Issas.exe /t REG_SZ /d C:/windows/System32/Issas.exe
- <SYSTEM32>\reg.exe add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v command.com.com /t REG_SZ /d C:/Command.com.com
- <SYSTEM32>\reg.exe add HKCU\software\microsoft\windows\currentversion\policies\system /v disabletaskmgr /t reg_dword /d "1" /f
- <SYSTEM32>\reg.exe add HKCU\software\microsoft\windows\currentversion\policies\system /v disableregistrytools /t reg_dword /d "1" /f
- <SYSTEM32>\shutdown.exe -r -t 00
- <SYSTEM32>\reg.exe add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT/CurrentVersion/Winlogon /v logonprompt /t REG_SZ /d W32/Olrox.a /F
- <SYSTEM32>\reg.exe add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Polices\Explorer /v NoSaveSettings /T REG_DWORD /D 1 /F
- <SYSTEM32>\reg.exe add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explore /v NoClose /t REG_DWORD /D 1 /F
- <SYSTEM32>\taskkill.exe /F /IM iexplore.exe
- <SYSTEM32>\taskkill.exe /F /IM firefox.exe
- <SYSTEM32>\taskkill.exe /F /IM msnmsgr.exe
- <SYSTEM32>\taskkill.exe /F /IM notepad.exe
- <SYSTEM32>\taskkill.exe /F /IM cmd.exe
Terminates or attempts to terminate
a large number of user processes.
Sets a new unauthorized home page for Windows Internet Explorer.
Attempts to shut down the Windows operating system.
Modifies file system :
Creates the following files:
- <SYSTEM32>\OMC.Dll.exe
- <SYSTEM32>\Issas.exe
- C:\Command.com.com
- %WINDIR%\Fonts\huevocartoon.exe
- <SYSTEM32>\oobe\html\oemreg\About.html
- %WINDIR%\mskernel32.vbs
- %WINDIR%\FDICO\D.inf
Sets the 'hidden' attribute to the following files:
- <Drive name for removable media>:\olrox.exe
- <Drive name for removable media>:\Autorun.inf
Miscellaneous:
Searches for the following windows:
- ClassName: 'Indicator' WindowName: ''
- ClassName: '' WindowName: ''