Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Classes\.$_\shell\open\command] '' = '"%WINDIR%\gcheck.dll"'
- [<HKLM>\SOFTWARE\Classes\VBSFile\Shell\Open\Command] '' = ''
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'User Permissions' = '"%WINDIR%\userp.$_"'
- [<HKLM>\SOFTWARE\Classes\$__auto_file\shell\open\command] '' = '"%WINDIR%\gcheck.dll"'
- [<HKLM>\SOFTWARE\Classes\VBEFile\Shell\Open\Command] '' = ''
- [<HKLM>\SOFTWARE\Classes\exefile\shell\open\command] '' = '"C:\BOOTSECT.DLL" @@%1@@%*'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'System Upgrades' = '"%APPDATA%\uperfier.exe"'
- [<HKLM>\SOFTWARE\Classes\scrfile\shell\open\command] '' = '"C:\BOOTSECT.DLL" @@%1@@%*'
- [<HKLM>\SOFTWARE\Classes\batfile\shell\open\command] '' = '"C:\BOOTSECT.DLL" @@%1@@%*'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\MSScheduler] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\MSScheduler] 'ImagePath' = '%WINDIR%\csrss.exe'
Creates the following files on removable media:
- <Drive name for removable media>:\stopthat.dll
- <Drive name for removable media>:\Autorun.inf
- <Drive name for removable media>:\Sandisk.exe
Malicious functions:
To complicate detection of its presence in the operating system,
forces the system hide from view:
- hidden files
- file extensions
Creates and executes the following:
- %APPDATA%\smss.exe
- <SYSTEM32>\uperfier.exe
Executes the following:
- <SYSTEM32>\wscript.exe "%APPDATA%\automm.vbs" //B
- <SYSTEM32>\wscript.exe "%APPDATA%\up.vbs" //B
Modifies file system :
Creates the following files:
- %TEMP%\mrt3.tmp\kcfile.mfx
- %TEMP%\mrt3.tmp\kclist.mfx
- %TEMP%\mrt3.tmp\process.mfx
- %TEMP%\mrt3.tmp\fcMsgBox.mfx
- %TEMP%\mrt3.tmp\StringTokenizer.mfx
- %APPDATA%\Autorun.inf
- %TEMP%\mrt3.tmp\kcedit.mfx
- %TEMP%\mrt3.tmp\timex.mfx
- %TEMP%\mrt2.tmp\timex.mfx
- %TEMP%\mrt3.tmp\fcKernel.mfx
- %TEMP%\mrt2.tmp\kcedit.mfx
- %TEMP%\mrt3.tmp\ToolTip.mfx
- %TEMP%\mrt3.tmp\Registry2.mfx
- %TEMP%\mrt3.tmp\Instance Communicator.mfx
- %TEMP%\mrt2.tmp\StringTokenizer.mfx
- %TEMP%\mrt3.tmp\kcwctrl.mfx
- C:\RECYCLER\RECYCLER .exe
- %WINDIR%\WINDOWS .exe
- <Auxiliary element>
- %PROGRAM_FILES%\Program Files .exe
- C:\stopthat.dll
- %WINDIR%\winhlp32.xml
- C:\Sandisk.exe
- C:\Autorun.inf
- <SYSTEM32>\appleupdater.exe
- %WINDIR%\gcheck.dll
- %APPDATA%\automm.vbs
- <SYSTEM32>\Tasks\Apple\AppleSoftwareUpdate
- C:\Documents and Settings\Documents and Settings .exe
- C:\Far2\Far2 .exe
- C:\BOOTSECT.DLL
- %WINDIR%\twunkq_32.dll
- %TEMP%\mrt3.tmp\fcFolder.mfx
- %TEMP%\mrt1.tmp\kcfile.mfx
- %TEMP%\mrt1.tmp\kclist.mfx
- %TEMP%\mrt1.tmp\process.mfx
- %TEMP%\mrt1.tmp\fcMsgBox.mfx
- %TEMP%\mrt1.tmp\StringTokenizer.mfx
- <SYSTEM32>\uperfier.exe
- %TEMP%\mrt1.tmp\kcedit.mfx
- %TEMP%\mrt1.tmp\timex.mfx
- %TEMP%\mrt1.tmp\fcFolder.mfx
- %TEMP%\mrt1.tmp\ToolTip.mfx
- %TEMP%\mrt1.tmp\mmfs2.dll
- %TEMP%\mrt1.tmp\kcshape.mfx
- %TEMP%\mrt1.tmp\Registry2.mfx
- %TEMP%\mrt1.tmp\Instance Communicator.mfx
- %TEMP%\mrt1.tmp\fcKernel.mfx
- %TEMP%\mrt1.tmp\kcwctrl.mfx
- %TEMP%\mrt2.tmp\Instance Communicator.mfx
- %TEMP%\mrt2.tmp\process.mfx
- %TEMP%\mrt2.tmp\kcwctrl.mfx
- %TEMP%\mrt2.tmp\Registry2.mfx
- %TEMP%\mrt3.tmp\kcshape.mfx
- %TEMP%\mrt2.tmp\kclist.mfx
- %TEMP%\mrt2.tmp\fcMsgBox.mfx
- %TEMP%\mrt2.tmp\kcfile.mfx
- %TEMP%\mrt2.tmp\mmfs2.dll
- %TEMP%\mrt2.tmp\kcshape.mfx
- %APPDATA%\up.vbs
- %APPDATA%\smmm
- %TEMP%\mrt2.tmp\fcKernel.mfx
- %TEMP%\mrt3.tmp\mmfs2.dll
- %TEMP%\mrt2.tmp\fcFolder.mfx
- %TEMP%\mrt2.tmp\ToolTip.mfx
Sets the 'hidden' attribute to the following files:
- %APPDATA%\Autorun.inf
- %APPDATA%\smss.exe
Deletes the following files:
- %TEMP%\mrt2.tmp\kcwctrl.mfx
- %TEMP%\mrt2.tmp\fcKernel.mfx
- %TEMP%\mrt2.tmp\Instance Communicator.mfx
- %TEMP%\mrt2.tmp\Registry2.mfx
- %TEMP%\mrt2.tmp\kcshape.mfx
- %TEMP%\mrt2.tmp\mmfs2.dll
- %TEMP%\mrt2.tmp\ToolTip.mfx
- %TEMP%\mrt2.tmp\fcFolder.mfx
- %TEMP%\mrt2.tmp\timex.mfx
- %TEMP%\mrt2.tmp\kcedit.mfx
- %APPDATA%\automm.vbs
- %TEMP%\mrt2.tmp\StringTokenizer.mfx
- %TEMP%\mrt2.tmp\fcMsgBox.mfx
- %TEMP%\mrt2.tmp\process.mfx
- %TEMP%\mrt2.tmp\kclist.mfx
- %TEMP%\mrt2.tmp\kcfile.mfx
- %TEMP%\mrt1.tmp\fcKernel.mfx
- %TEMP%\mrt1.tmp\ToolTip.mfx
- %TEMP%\mrt1.tmp\Registry2.mfx
- %TEMP%\mrt1.tmp\kcwctrl.mfx
- %TEMP%\mrt1.tmp\mmfs2.dll
- %APPDATA%\up.vbs
- %TEMP%\mrt1.tmp\fcFolder.mfx
- %TEMP%\mrt1.tmp\kcshape.mfx
- %TEMP%\mrt1.tmp\kcedit.mfx
- %TEMP%\mrt1.tmp\kclist.mfx
- %TEMP%\mrt1.tmp\StringTokenizer.mfx
- %TEMP%\mrt1.tmp\timex.mfx
- %TEMP%\mrt1.tmp\process.mfx
- %TEMP%\mrt1.tmp\Instance Communicator.mfx
- %TEMP%\mrt1.tmp\kcfile.mfx
- %TEMP%\mrt1.tmp\fcMsgBox.mfx
Moves the following files:
- from %APPDATA%\smmm to %APPDATA%\smss.exe
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'Indicator' WindowName: ''