Win32.Expiro.23

To ensure autorun and distribution:

Creates the following services:

Infects the following executable system files:

Malicious functions:

Executes the following:

Modifies settings of Windows Internet Explorer:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '2103' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1406' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1609' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1609' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] '1609' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] '2103' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] '1406' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '2103' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0] '1609' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0] '2103' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0] '1406' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '1406' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1406' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '1609' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '2103' = '00000000'

Modifies file system :

Creates the following files:

<SYSTEM32>\cmd.vir
%PROGRAM_FILES%\Outlook Express\wab.vir
<SYSTEM32>\notepad.vir
%PROGRAM_FILES%\Windows Media Player\wmplayer.vir
<SYSTEM32>\utilman.vir
<SYSTEM32>\magnify.vir
<SYSTEM32>\wbem\wmiapsrv.vir
<SYSTEM32>\osk.vir
<SYSTEM32>\narrator.vir
%APPDATA%\Mozilla\Firefox\Profiles\przhlnon.default\extensions\{ec9032c7-c20a-464f-7b0e-13a3a9e97385}\install.rdf
%APPDATA%\Mozilla\Firefox\Profiles\przhlnon.default\extensions\{ec9032c7-c20a-464f-7b0e-13a3a9e97385}\chrome.manifest
%APPDATA%\Mozilla\Firefox\Profiles\przhlnon.default\extensions\{ec9032c7-c20a-464f-7b0e-13a3a9e97385}\components\red.js
%APPDATA%\Mozilla\Firefox\Profiles\przhlnon.default\extensions\{ec9032c7-c20a-464f-7b0e-13a3a9e97385}\chrome\content.jar
<LS_APPDATA>\wsr19zt32.dll
<SYSTEM32>\tourstart.vir
<SYSTEM32>\mobsync.vir
<SYSTEM32>\rcimlby.vir
%PROGRAM_FILES%\Outlook Express\msimn.vir
<SYSTEM32>\mnmsrvc.vir
<SYSTEM32>\imapi.vir
<SYSTEM32>\msiexec.vir
<SYSTEM32>\msdtc.vir
%WINDIR%\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{B1DA1097-D393-4ED6-A542-0AE75E7CD24A}.crmlog
<SYSTEM32>\clipsrv.vir
<SYSTEM32>\cisvc.vir
<SYSTEM32>\dmadmin.vir
<SYSTEM32>\dllhost.vir
<SYSTEM32>\tlntsvr.vir
<SYSTEM32>\smlogsvc.vir
<SYSTEM32>\vssvc.vir
<SYSTEM32>\ups.vir
<SYSTEM32>\scardsvr.vir
<SYSTEM32>\sessmgr.vir
<SYSTEM32>\netdde.vir
<SYSTEM32>\rsvp.vir
<SYSTEM32>\locator.vir

Deletes the following files:

<SYSTEM32>\narrator.vir
<SYSTEM32>\osk.vir
<SYSTEM32>\utilman.vir
<SYSTEM32>\magnify.vir
<SYSTEM32>\ups.vir
<SYSTEM32>\vssvc.vir
<SYSTEM32>\wbem\wmiapsrv.vir
%PROGRAM_FILES%\Outlook Express\wab.vir
<SYSTEM32>\tourstart.vir
%PROGRAM_FILES%\Outlook Express\msimn.vir
<SYSTEM32>\rcimlby.vir
<SYSTEM32>\mobsync.vir
<SYSTEM32>\cmd.vir
%PROGRAM_FILES%\Windows Media Player\wmplayer.vir
<SYSTEM32>\notepad.vir
<SYSTEM32>\tlntsvr.vir
%WINDIR%\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{E58DFEED-FD87-424D-B178-3D81F95917DF}.crmlog
<SYSTEM32>\imapi.vir
<SYSTEM32>\mnmsrvc.vir
<SYSTEM32>\dmadmin.vir
<SYSTEM32>\cisvc.vir
<SYSTEM32>\clipsrv.vir
<SYSTEM32>\dllhost.vir
<SYSTEM32>\msdtc.vir
<SYSTEM32>\rsvp.vir
<SYSTEM32>\scardsvr.vir
<SYSTEM32>\smlogsvc.vir
<SYSTEM32>\locator.vir
<SYSTEM32>\msiexec.vir
<SYSTEM32>\netdde.vir
<SYSTEM32>\sessmgr.vir

Miscellaneous:

Searches for the following windows: