Technical Information
Malicious functions:
Creates and executes the following:
- C:\zv\tuneup\123.EXE /MEMSCAN
- C:\zv\tuneup\t3.exe
- C:\zv\tuneup\123.EXE /SCANPC
- C:\zv\tuneup\RenSolv.exe
- C:\zv\tuneup\t3.exe /h
Executes the following:
- <SYSTEM32>\ping.exe localhost
- %WINDIR%\regedit.exe /S exe_only.reg
- <SYSTEM32>\cmd.exe /c ""c:\zv\tuneup\solve.cmd" "
Forces autoplay for removable media.
Modifies file system :
Creates the following files:
- C:\zv\23_10_2012_strtbkp\Microsoft .NET Framework 1.1 Wizards.lnk
- C:\zv\23_10_2012_strtbkp\Microsoft .NET Framework 1.1 Configuration.lnk
- C:\zv\23_10_2012_strtbkp\Local Security Policy.lnk
- C:\zv\23_10_2012_strtbkp\Performance.lnk
- C:\zv\23_10_2012_strtbkp\Hearts.lnk
- C:\zv\23_10_2012_strtbkp\Freecell.lnk
- C:\zv\23_10_2012_strtbkp\Services.lnk
- C:\zv\23_10_2012_strtbkp\Event Viewer.lnk
- C:\zv\23_10_2012_strtbkp\System Restore.lnk
- C:\zv\23_10_2012_strtbkp\System Information.lnk
- C:\zv\23_10_2012_strtbkp\Security Center.lnk
- C:\zv\23_10_2012_strtbkp\WordPad.lnk
- C:\zv\23_10_2012_strtbkp\Data Sources (ODBC).lnk
- C:\zv\23_10_2012_strtbkp\Computer Management.lnk
- C:\zv\23_10_2012_strtbkp\Component Services.lnk
- C:\zv\23_10_2012_strtbkp\Internet Backgammon.lnk
- C:\zv\23_10_2012_strtbkp\Windows Movie Maker.lnk
- C:\zv\23_10_2012_strtbkp\Windows Messenger.lnk
- C:\zv\23_10_2012_strtbkp\MSN.lnk
- C:\zv\23_10_2012_strtbkp\Set Program Access and Defaults.lnk
- %ALLUSERSPROFILE%\Application Data\Net Protector\chkvrtb.ini
- C:\zv\23_10_2012_strtbkp\Windows Update.lnk
- C:\zv\23_10_2012_strtbkp\Windows Catalog.lnk
- C:\zv\23_10_2012_strtbkp\Spider Solitaire.lnk
- C:\zv\23_10_2012_strtbkp\Internet Reversi.lnk
- C:\zv\23_10_2012_strtbkp\Internet Hearts.lnk
- C:\zv\23_10_2012_strtbkp\Internet Checkers.lnk
- C:\zv\23_10_2012_strtbkp\Internet Spades.lnk
- C:\zv\23_10_2012_strtbkp\Solitaire.lnk
- C:\zv\23_10_2012_strtbkp\Pinball.lnk
- C:\zv\23_10_2012_strtbkp\Minesweeper.lnk
- C:\zv\tuneup\t3.exe
- C:\zv\tuneup\Solve.cmd
- C:\zv\tuneup\RenSolv.exe
- C:\zv\fs1.log
- C:\zv\23_10_2012_strtbkp\Accessibility Wizard.lnk
- C:\zv\23_10_2012_strtbkp\bkp.ini
- C:\zv\tuneup\PClean.dll
- C:\zv\tuneup\Disasm.dll
- C:\zv\tuneup\123.EXE
- C:\zv\tuneup.zip
- C:\zv\tuneup\exe_only.reg
- C:\zv\tuneup\olly.dll
- C:\zv\tuneup\NoMem.reg
- C:\zv\tuneup\KeepMin.exe
- C:\zv\23_10_2012_strtbkp\Calculator.lnk
- C:\zv\23_10_2012_strtbkp\Character Map.lnk
- C:\zv\23_10_2012_strtbkp\Backup.lnk
- C:\zv\23_10_2012_strtbkp\Paint.lnk
- C:\zv\23_10_2012_strtbkp\Disk Cleanup.lnk
- C:\zv\23_10_2012_strtbkp\Scheduled Tasks.lnk
- C:\zv\23_10_2012_strtbkp\Files and Settings Transfer Wizard.lnk
- C:\zv\23_10_2012_strtbkp\Disk Defragmenter.lnk
- C:\zv\23_10_2012_strtbkp\Volume Control.lnk
- C:\zv\23_10_2012_strtbkp\Network Setup Wizard.lnk
- C:\zv\23_10_2012_strtbkp\Network Connections.lnk
- C:\zv\23_10_2012_strtbkp\HyperTerminal.lnk
- C:\zv\23_10_2012_strtbkp\New Connection Wizard.lnk
- C:\zv\23_10_2012_strtbkp\Sound Recorder.lnk
- C:\zv\23_10_2012_strtbkp\Wireless Network Setup Wizard.lnk
- C:\zv\23_10_2012_strtbkp\Remote Desktop Connection.lnk
Deletes the following files:
- C:\zv\23_10_2012_strtbkp\Scheduled Tasks.lnk
- C:\zv\23_10_2012_strtbkp\Remote Desktop Connection.lnk
- C:\zv\23_10_2012_strtbkp\Pinball.lnk
- C:\zv\23_10_2012_strtbkp\Set Program Access and Defaults.lnk
- C:\zv\23_10_2012_strtbkp\Services.lnk
- C:\zv\23_10_2012_strtbkp\Security Center.lnk
- C:\zv\23_10_2012_strtbkp\Network Setup Wizard.lnk
- C:\zv\23_10_2012_strtbkp\Network Connections.lnk
- C:\zv\23_10_2012_strtbkp\MSN.lnk
- C:\zv\23_10_2012_strtbkp\Performance.lnk
- C:\zv\23_10_2012_strtbkp\Paint.lnk
- C:\zv\23_10_2012_strtbkp\New Connection Wizard.lnk
- C:\zv\23_10_2012_strtbkp\Windows Movie Maker.lnk
- C:\zv\23_10_2012_strtbkp\Windows Messenger.lnk
- C:\zv\23_10_2012_strtbkp\Windows Catalog.lnk
- C:\zv\23_10_2012_strtbkp\WordPad.lnk
- C:\zv\23_10_2012_strtbkp\Wireless Network Setup Wizard.lnk
- C:\zv\23_10_2012_strtbkp\Windows Update.lnk
- C:\zv\23_10_2012_strtbkp\Spider Solitaire.lnk
- C:\zv\23_10_2012_strtbkp\Sound Recorder.lnk
- C:\zv\23_10_2012_strtbkp\Solitaire.lnk
- C:\zv\23_10_2012_strtbkp\Volume Control.lnk
- C:\zv\23_10_2012_strtbkp\System Restore.lnk
- C:\zv\23_10_2012_strtbkp\System Information.lnk
- C:\zv\23_10_2012_strtbkp\Disk Cleanup.lnk
- C:\zv\23_10_2012_strtbkp\Data Sources (ODBC).lnk
- C:\zv\23_10_2012_strtbkp\Computer Management.lnk
- C:\zv\23_10_2012_strtbkp\Files and Settings Transfer Wizard.lnk
- C:\zv\23_10_2012_strtbkp\Event Viewer.lnk
- C:\zv\23_10_2012_strtbkp\Disk Defragmenter.lnk
- C:\zv\23_10_2012_strtbkp\bkp.ini
- C:\zv\23_10_2012_strtbkp\Backup.lnk
- C:\zv\23_10_2012_strtbkp\Accessibility Wizard.lnk
- C:\zv\23_10_2012_strtbkp\Component Services.lnk
- C:\zv\23_10_2012_strtbkp\Character Map.lnk
- C:\zv\23_10_2012_strtbkp\Calculator.lnk
- C:\zv\23_10_2012_strtbkp\Local Security Policy.lnk
- C:\zv\23_10_2012_strtbkp\Internet Spades.lnk
- C:\zv\23_10_2012_strtbkp\Internet Reversi.lnk
- C:\zv\23_10_2012_strtbkp\Minesweeper.lnk
- C:\zv\23_10_2012_strtbkp\Microsoft .NET Framework 1.1 Wizards.lnk
- C:\zv\23_10_2012_strtbkp\Microsoft .NET Framework 1.1 Configuration.lnk
- C:\zv\23_10_2012_strtbkp\HyperTerminal.lnk
- C:\zv\23_10_2012_strtbkp\Hearts.lnk
- C:\zv\23_10_2012_strtbkp\Freecell.lnk
- C:\zv\23_10_2012_strtbkp\Internet Hearts.lnk
- C:\zv\23_10_2012_strtbkp\Internet Checkers.lnk
- C:\zv\23_10_2012_strtbkp\Internet Backgammon.lnk
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'RegEdit_RegEdit' WindowName: ''