Technical Information
Malicious functions:
To complicate detection of its presence in the operating system,
forces the system hide from view:
- hidden files
- file extensions
Creates and executes the following:
- '%TEMP%\nsi3.tmp\nsC.tmp' sc config NVsvc start= DISABLED
- '%TEMP%\nsi3.tmp\nsB.tmp' sc config Ati HotKey Poller= DISABLED
- '%TEMP%\nsi3.tmp\nsA.tmp' sc config TermService start= DEMAND
- '%TEMP%\~nsu.tmp\Au_.exe' /S _?=%TEMP%\
- '%TEMP%\uninst.exe' /S
- '%TEMP%\nsi3.tmp\nsD.tmp' sc config srservice start= DISABLED
- '%TEMP%\nsi3.tmp\ns6.tmp' reg add HKEY_CLASSES_ROOT\Directory\Background\shellex\ContextMenuHandlers\new /ve /d {D969A300-E7FF-11d0-A93B-00A0C90F2719}
- '%TEMP%\nsi3.tmp\ns5.tmp' reg delete HKEY_CLASSES_ROOT\Directory\Background\shellex\ContextMenuHandlers /f
- '%TEMP%\nsi3.tmp\ns4.tmp' regsvr32 /u /s igfxpph.dll
- '%TEMP%\nsi3.tmp\ns9.tmp' sc config FastUserSwitchingCompatibility start= DEMAND
- '%TEMP%\nsi3.tmp\ns8.tmp' reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v IgfxTray /f
- '%TEMP%\nsi3.tmp\ns7.tmp' reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v HotKeysCmds /f
Executes the following:
- '<SYSTEM32>\sc.exe' config TermService start= DEMAND
- '<SYSTEM32>\sc.exe' config FastUserSwitchingCompatibility start= DEMAND
- '<SYSTEM32>\sc.exe' config Ati HotKey Poller= DISABLED
- '<SYSTEM32>\sc.exe' config srservice start= DISABLED
- '<SYSTEM32>\sc.exe' config NVsvc start= DISABLED
- '<SYSTEM32>\reg.exe' delete HKEY_CLASSES_ROOT\Directory\Background\shellex\ContextMenuHandlers /f
- '<SYSTEM32>\regsvr32.exe' /u /s igfxpph.dll
- '<SYSTEM32>\reg.exe' add HKEY_CLASSES_ROOT\Directory\Background\shellex\ContextMenuHandlers\new /ve /d {D969A300-E7FF-11d0-A93B-00A0C90F2719}
- '<SYSTEM32>\reg.exe' delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v IgfxTray /f
- '<SYSTEM32>\reg.exe' delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v HotKeysCmds /f
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system :
Creates the following files:
- C:\Documents and Settings\Default User\Favorites\°Щ¶ИЛСЛч.url
- C:\Documents and Settings\Default User\Favorites\GoogleЛСЛч.url
- C:\Documents and Settings\Default User\Favorites\АнПлјјКхКЧТі.url
- C:\Documents and Settings\Default User\Favorites\АнПлјјКхЙзЗш.url
- C:\Documents and Settings\Default User\Favorites\97dnПВФШХѕ.url
- %HOMEPATH%\Favorites\АнПлјјКхКЧТі.url
- %HOMEPATH%\Favorites\АнПлјјКхЙзЗш.url
- %HOMEPATH%\Favorites\НшЦ·µјєЅ.url
- %HOMEPATH%\Favorites\ДП±±НшФЪПЯУ°Фє.url
- %TEMP%\nspF.tmp
- C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\Quick Launch\ПФКѕЧАГж.scf
- %TEMP%\nsb11.tmp
- %TEMP%\~nsu.tmp\Au_.exe
- C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\Quick Launch\ОТµДµзДФ.lnk
- C:\Documents and Settings\Default User\Favorites\НшЦ·µјєЅ.url
- C:\Documents and Settings\Default User\Favorites\ДП±±НшФЪПЯУ°Фє.url
- C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\Quick Launch\Жф¶Ї Internet Explorer дЇААЖч.lnk
- C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\Desktop.htt
- %TEMP%\nsi3.tmp\ns5.tmp
- %TEMP%\nsi3.tmp\ns4.tmp
- %TEMP%\nsi3.tmp\ns7.tmp
- %TEMP%\nsi3.tmp\ns6.tmp
- %TEMP%\nsi3.tmp\nsExec.dll
- %TEMP%\nsi3.tmp\System.dll
- %TEMP%\nsn2.tmp
- %TEMP%\uninst.exe
- %TEMP%\temp.ini
- %HOMEPATH%\Favorites\97dnПВФШХѕ.url
- %TEMP%\nsi3.tmp\nsD.tmp
- %HOMEPATH%\Favorites\°Щ¶ИЛСЛч.url
- %HOMEPATH%\Favorites\GoogleЛСЛч.url
- %TEMP%\nsi3.tmp\nsC.tmp
- %TEMP%\nsi3.tmp\ns9.tmp
- %TEMP%\nsi3.tmp\ns8.tmp
- %TEMP%\nsi3.tmp\nsB.tmp
- %TEMP%\nsi3.tmp\nsA.tmp
Deletes the following files:
- %TEMP%\nsi3.tmp\nsD.tmp
- %TEMP%\nsi3.tmp\nsC.tmp
- %TEMP%\nsi3.tmp\nsB.tmp
- %TEMP%\nsi3.tmp\nsExec.dll
- %TEMP%\temp.ini
- %TEMP%\uninst.exe
- %TEMP%\nsi3.tmp\System.dll
- %TEMP%\nsi3.tmp\ns6.tmp
- %TEMP%\nsi3.tmp\ns5.tmp
- %TEMP%\nsi3.tmp\ns4.tmp
- %TEMP%\nsi3.tmp\ns7.tmp
- %TEMP%\nsi3.tmp\nsA.tmp
- %TEMP%\nsi3.tmp\ns9.tmp
- %TEMP%\nsi3.tmp\ns8.tmp
Deletes itself.
Miscellaneous:
Searches for the following windows:
- ClassName: 'SysListView32' WindowName: '(null)'
- ClassName: '#32770' WindowName: '(null)'