Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '<Virus name>.exe' = '<SYSTEM32>\cacheForDriver\<Virus name>.exe'
Creates the following files on removable media:
- <Drive name for removable media>:\JRVDOC.lnk
- <Drive name for removable media>:\IRVDOC.lnk
- <Drive name for removable media>:\HRVDOC.lnk
- <Drive name for removable media>:\Recycler\DXDRVNET.EXE
- <Drive name for removable media>:\LRVDOC.lnk
- <Drive name for removable media>:\KRVDOC.lnk
- <Drive name for removable media>:\DRVDOC.lnk
- <Drive name for removable media>:\lpk.dll
- <Drive name for removable media>:\AutoRun.inf
- <Drive name for removable media>:\GRVDOC.lnk
- <Drive name for removable media>:\FRVDOC.lnk
- <Drive name for removable media>:\ERVDOC.lnk
Malicious functions:
To complicate detection of its presence in the operating system,
forces the system hide from view:
- hidden files
Creates and executes the following:
- C:\Documents and Settings\DXDRVDOC.EXE
- <SYSTEM32>\cacheForDriver\<Virus name>.exe
Modifies file system :
Creates the following files:
- %ALLUSERSPROFILE%\DXDRVNET.EXE
- <SYSTEM32>\cacheForDriver\DXDRVNET.EXE
- %TEMP%\avp.exe
- <SYSTEM32>\cacheForDriver\<Virus name>.exe
- C:\Documents and Settings\DXDRVDOC.EXE
- %TEMP%\avpset.exe
Sets the 'hidden' attribute to the following files:
- <Drive name for removable media>:\KRVDOC.lnk
- <Drive name for removable media>:\JRVDOC.lnk
- <Drive name for removable media>:\IRVDOC.lnk
- <Drive name for removable media>:\LRVDOC.lnk
- <SYSTEM32>\cacheForDriver\DXDRVNET.EXE
- %ALLUSERSPROFILE%\DXDRVNET.EXE
- <Drive name for removable media>:\Recycler\DXDRVNET.EXE
- <Drive name for removable media>:\HRVDOC.lnk
- <Drive name for removable media>:\lpk.dll
- <Drive name for removable media>:\AutoRun.inf
- <SYSTEM32>\cacheForDriver\<Virus name>.exe
- <Drive name for removable media>:\DRVDOC.lnk
- <Drive name for removable media>:\GRVDOC.lnk
- <Drive name for removable media>:\FRVDOC.lnk
- <Drive name for removable media>:\ERVDOC.lnk
Deletes the following files:
- <Drive name for removable media>:\AutoRun.inf
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''