Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Windows Update' = '%APPDATA%\Microsoft\Windows\Templates\.exe'
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Registry Editor (RegEdit)
blocks the following features:
- System Restore (SR)
- User Account Control (UAC)
modifies the following system settings:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoRun' = '00000001'
Terminates or attempts to terminate
the following user processes:
- firefox.exe
- iexplore.exe
Searches for registry branches where third party applications store passwords
- [<HKCU>\Software\Paltalk]
- [<HKLM>\SOFTWARE\Wow6432Node\mIRC]
- [<HKLM>\Software\Wow6432Node\NuMega\SmartCheck]
- [<HKLM>\Software\Wow6432Node\OnlineTVPlayer\RegInfo]
- [<HKLM>\Software\Wow6432Node\O&O\O&O Defrag\8.0\Pro\licenses]
- [<HKLM>\Software\Wow6432Node\PowerQuest\PartitionMagic\8.0\UserInfo]
- [<HKLM>\Software\Wow6432Node\Passware\Encryption Analyzer\1\Registration,License]
- [<HKLM>\Software\Wow6432Node\Passware\Windows Key\7\Registration]
- [<HKLM>\Software\Wow6432Node\EnTech\PowerStrip]
- [<HKLM>\Software\Wow6432Node\Network Associates, Inc.\Sniffer Pro\4.5\USER]
- [<HKLM>\Software\Wow6432Node\Steganos\SIAVPN]
- [<HKLM>\Software\Wow6432Node\TexasCalc\License]
- [<HKCU>\Software\Microsoft\MSNMessenger]
- [<HKLM>\Software\Wow6432Node\Pegasys Inc.\TMPGEnc DVD Author\1.0]
- [<HKLM>\Software\Wow6432Node\TuneUp\Utilities\6.0]
- [<HKLM>\Software\Wow6432Node\TuneUp\Utilities\7.0]
- [<HKLM>\Software\Wow6432Node\TuneUp\Utilities\8.0]
- [<HKLM>\Software\Wow6432Node\Nullsoft\Winamp]
- [<HKLM>\SOFTWARE\Wow6432Node\Valve\Half-Life\Settings]
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Microsoft Games\Halo]
- [<HKLM>\SOFTWARE\Wow6432Node\Valve\CounterStrike\Settings]
- [<HKLM>\SOFTWARE\Wow6432Node\TechSmith\Camtasia Studio\4.0]
- [<HKCU>\Software\mIRC]
- [<HKLM>\SOFTWARE\Wow6432Node\JSG\Matrix Saver V2]
- [<HKLM>\Software\Wow6432Node\TechSmith\SnagIt\8]
- [<HKLM>\SOFTWARE\Wow6432Node\Macromedia\Dreamweaver\7\Registration]
- [<HKLM>\SOFTWARE\Wow6432Node\Codec Tweak Tool]
- [<HKCU>\Software\IMVU\username]
- [<HKCU>\Software\IMVU\password]
- [<HKCU>\Software\FTPWare\COREFTP\Sites\]
- [<HKLM>\SOFTWARE\Wow6432Node\ACD Systems\PicaView]
- [<HKLM>\SOFTWARE\Wow6432Node\Adobe\Photoshop\7.0\Registration]
- [<HKLM>\SOFTWARE\Wow6432Node\Elcom\Advanced PDF Password Recovery\Registration]
- [<HKLM>\SOFTWARE\Wow6432Node\Elcom\Advanced PDF Password Recovery Pro\Registration]
- [<HKLM>\SOFTWARE\Wow6432Node\Elcom\Advanced ZIP Password Recovery\Registration]
- [<HKLM>\SOFTWARE\Wow6432Node\@stake\LC5\Registration]
- [<HKLM>\SOFTWARE\Wow6432Node\Techland\Chrome]
- [<HKLM>\SOFTWARE\Wow6432Node\Valve\Counter-Strike\Settings]
- [<HKLM>\SOFTWARE\Wow6432Node\Macromedia\Flash\7\Registration]
- [<HKLM>\SOFTWARE\Wow6432Node\Cyberlink\PowerDVD]
- [<HKLM>\SOFTWARE\Wow6432Node\CyberLink\PowerProducer\3.0\UserReg]
- [<HKLM>\SOFTWARE\Wow6432Node\Valve\Day of Defeat\Settings]
- [<HKLM>\SOFTWARE\Wow6432Node\DVD Audio Extractor\Settings]
- [<HKLM>\SOFTWARE\Wow6432Node\F-Secure\BackWeb\iLauncher]
- [<HKLM>\SOFTWARE\Wow6432Node\Headlight\GetRight]
- [<HKLM>\SOFTWARE\Wow6432Node\Valve\Gunman]
- [<HKLM>\SOFTWARE\Wow6432Node\Valve\Half-Life\Setting]
- [<HKLM>\SOFTWARE\Wow6432Node\Ahead\InCD]
- [<HKLM>\SOFTWARE\Wow6432Node\JoWooD\InstalledGames\IG2]
- [<HKLM>\SOFTWARE\Wow6432Node\Macromedia\Fireworks\7\Registration]
- [<HKCU>\Software\Valve\Half-Life\Settings]
Modifies file system
Creates the following files
- %APPDATA%\microsoft\windows\templates\.exe
- %APPDATA%\microsoft\windows\templates\cdkeys.txt
Miscellaneous
Searches for the following windows
- ClassName: 'VMDragDetectWndClass' WindowName: ''
Creates and executes the following
- '%WINDIR%\syswow64\cmd.exe' /k <SYSTEM32>\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoRun /t REG_DWORD /d 1 /f' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' add HKCU\Software\Policies\Microsoft\Windows\System /v DisableCMD /t REG_DWORD /d 1 /f' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoViewContextMenu /t REG_DWORD /d 1 /f' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoFolderInfo /t REG_DWORD /d 1 /f' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoControlPanel /t REG_DWORD /d 1 /f' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /k <SYSTEM32>\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
- '%WINDIR%\syswow64\reg.exe' ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
- '%WINDIR%\syswow64\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoRun /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\reg.exe' add HKCU\Software\Policies\Microsoft\Windows\System /v DisableCMD /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoViewContextMenu /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoFolderInfo /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
- '%WINDIR%\syswow64\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoControlPanel /t REG_DWORD /d 1 /f
