Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Optimizer Pro' = '%PROGRAM_FILES%\Optimizer Pro 3.38\OptProLauncher.exe'
Creates or modifies the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\<Virus name>.lnk
Malicious functions:
Creates and executes the following:
- '%TEMP%\is-GVASL.tmp\optprosetup.tmp' /SL5="$30092,5164504,115200,%TEMP%\optprosetup.exe" /VERYSILENT /MMJS /insid=18336069890896562333
- '%TEMP%\optprosetup.exe' /VERYSILENT /MMJS /insid=18336069890896562333
Modifies file system :
Creates the following files:
- %PROGRAM_FILES%\Optimizer Pro 3.38\is-95S4M.tmp
- %PROGRAM_FILES%\Optimizer Pro 3.38\is-ML3A2.tmp
- %PROGRAM_FILES%\Optimizer Pro 3.38\is-MK9CG.tmp
- %PROGRAM_FILES%\Optimizer Pro 3.38\is-CDQS4.tmp
- %PROGRAM_FILES%\Optimizer Pro 3.38\is-5ONNC.tmp
- %PROGRAM_FILES%\Optimizer Pro 3.38\is-PDK84.tmp
- %PROGRAM_FILES%\Optimizer Pro 3.38\is-9CGNJ.tmp
- %PROGRAM_FILES%\Optimizer Pro 3.38\is-0V5M3.tmp
- %PROGRAM_FILES%\Optimizer Pro 3.38\is-B9KC3.tmp
- %PROGRAM_FILES%\Optimizer Pro 3.38\is-FH26K.tmp
- %ALLUSERSPROFILE%\Start Menu\Programs\Optimizer Pro v3.2\Check updates.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\Optimizer Pro v3.2\Uninstall Optimizer Pro.lnk
- %PROGRAM_FILES%\Optimizer Pro 3.38\unins000.dat
- %PROGRAM_FILES%\Optimizer Pro 3.38\unins000.msg
- %ALLUSERSPROFILE%\Start Menu\Programs\Optimizer Pro v3.2\Optimizer Pro on the Web.lnk
- %HOMEPATH%\Desktop\Optimizer Pro.lnk
- %PROGRAM_FILES%\Optimizer Pro 3.38\is-5VNIG.tmp
- %ALLUSERSPROFILE%\Start Menu\Programs\Optimizer Pro v3.2\Help.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\Optimizer Pro v3.2\Optimizer Pro.lnk
- %TEMP%\is-LFK4N.tmp\itdownload.dll
- %TEMP%\is-LFK4N.tmp\OptProHelper.dll
- %PROGRAM_FILES%\Optimizer Pro 3.38\is-K9G0N.tmp
- %TEMP%\is-LFK4N.tmp\OptProMon.dll
- %TEMP%\is-LFK4N.tmp\_isetup\_shfoldr.dll
- %ALLUSERSPROFILE%\Application Data\{67ef2e10-f136-fe2c-67ef-f2e10f13b843}\<Virus name>.dat
- %ALLUSERSPROFILE%\Application Data\{67ef2e10-f136-fe2c-67ef-f2e10f13b843}\<Virus name>.exe
- %TEMP%\is-GVASL.tmp\optprosetup.tmp
- %TEMP%\optprosetup.exe
- %PROGRAM_FILES%\Optimizer Pro 3.38\is-R9KQ0.tmp
- %PROGRAM_FILES%\Optimizer Pro 3.38\is-QFOL3.tmp
- %PROGRAM_FILES%\Optimizer Pro 3.38\is-QQD4C.tmp
- %PROGRAM_FILES%\Optimizer Pro 3.38\is-DIK4B.tmp
- %PROGRAM_FILES%\Optimizer Pro 3.38\is-LGQDU.tmp
- %PROGRAM_FILES%\Optimizer Pro 3.38\is-49353.tmp
- %PROGRAM_FILES%\Optimizer Pro 3.38\is-8VQ90.tmp
- %PROGRAM_FILES%\Optimizer Pro 3.38\is-PPJQK.tmp
- %PROGRAM_FILES%\Optimizer Pro 3.38\is-2RC3F.tmp
- %PROGRAM_FILES%\Optimizer Pro 3.38\is-H1R97.tmp
Moves the following files:
- from %PROGRAM_FILES%\Optimizer Pro 3.38\is-0V5M3.tmp to %PROGRAM_FILES%\Optimizer Pro 3.38\OptimizerPro.chm
- from %PROGRAM_FILES%\Optimizer Pro 3.38\is-5ONNC.tmp to %PROGRAM_FILES%\Optimizer Pro 3.38\file_id.diz
- from %PROGRAM_FILES%\Optimizer Pro 3.38\is-B9KC3.tmp to %PROGRAM_FILES%\Optimizer Pro 3.38\English.ini
- from %PROGRAM_FILES%\Optimizer Pro 3.38\is-9CGNJ.tmp to %PROGRAM_FILES%\Optimizer Pro 3.38\StartupList.txt
- from %PROGRAM_FILES%\Optimizer Pro 3.38\is-PDK84.tmp to %PROGRAM_FILES%\Optimizer Pro 3.38\CookiesException.txt
- from %PROGRAM_FILES%\Optimizer Pro 3.38\is-ML3A2.tmp to %PROGRAM_FILES%\Optimizer Pro 3.38\HomePage.url
- from %PROGRAM_FILES%\Optimizer Pro 3.38\is-FH26K.tmp to %PROGRAM_FILES%\Optimizer Pro 3.38\OptProHelper.dll
- from %PROGRAM_FILES%\Optimizer Pro 3.38\is-5VNIG.tmp to %PROGRAM_FILES%\Optimizer Pro 3.38\itdownload.dll
- from %PROGRAM_FILES%\Optimizer Pro 3.38\is-MK9CG.tmp to %PROGRAM_FILES%\Optimizer Pro 3.38\cancel.bmp
- from %PROGRAM_FILES%\Optimizer Pro 3.38\is-95S4M.tmp to %PROGRAM_FILES%\Optimizer Pro 3.38\bg_new3.bmp
- from %PROGRAM_FILES%\Optimizer Pro 3.38\is-CDQS4.tmp to %PROGRAM_FILES%\Optimizer Pro 3.38\bg_new4.bmp
- from %PROGRAM_FILES%\Optimizer Pro 3.38\is-8VQ90.tmp to %PROGRAM_FILES%\Optimizer Pro 3.38\OptProReminder.exe
- from %PROGRAM_FILES%\Optimizer Pro 3.38\is-H1R97.tmp to %PROGRAM_FILES%\Optimizer Pro 3.38\OptProSmartScan.exe
- from %PROGRAM_FILES%\Optimizer Pro 3.38\is-PPJQK.tmp to %PROGRAM_FILES%\Optimizer Pro 3.38\OptProStart.exe
- from %PROGRAM_FILES%\Optimizer Pro 3.38\is-K9G0N.tmp to %PROGRAM_FILES%\Optimizer Pro 3.38\unins000.exe
- from %PROGRAM_FILES%\Optimizer Pro 3.38\is-R9KQ0.tmp to %PROGRAM_FILES%\Optimizer Pro 3.38\OptimizerPro.exe
- from %PROGRAM_FILES%\Optimizer Pro 3.38\is-2RC3F.tmp to %PROGRAM_FILES%\Optimizer Pro 3.38\OptProGuard.exe
- from %PROGRAM_FILES%\Optimizer Pro 3.38\is-LGQDU.tmp to %PROGRAM_FILES%\Optimizer Pro 3.38\sqlite3.dll
- from %PROGRAM_FILES%\Optimizer Pro 3.38\is-DIK4B.tmp to %PROGRAM_FILES%\Optimizer Pro 3.38\scan.gif
- from %PROGRAM_FILES%\Optimizer Pro 3.38\is-QFOL3.tmp to %PROGRAM_FILES%\Optimizer Pro 3.38\OptProUninstaller.exe
- from %PROGRAM_FILES%\Optimizer Pro 3.38\is-49353.tmp to %PROGRAM_FILES%\Optimizer Pro 3.38\OptProSchedule.exe
- from %PROGRAM_FILES%\Optimizer Pro 3.38\is-QQD4C.tmp to %PROGRAM_FILES%\Optimizer Pro 3.38\OptProLauncher.exe
Network activity:
Connects to:
- 'op###izepro.biz':80
- 'op##ro.info':80
- 'www.bb#.com':80
- '74.##5.232.51':80
- '15#.#66.255.19':80
TCP:
HTTP GET requests:
- op###izepro.biz/inst?si#################################################
- op###izepro.biz/inst?hi########################################################################################################################################################
HTTP POST requests:
- op##ro.info/install/
UDP:
- DNS ASK op###izepro.biz
- DNS ASK op##ro.info
- DNS ASK ed###on.cnn.com
- DNS ASK www.google.com
- DNS ASK www.cn#.com
- DNS ASK www.bb#.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'Indicator' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''