Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\jvbigrib.lnk
- <SYSTEM32>\tasks\opera scheduled autoupdate 713452334
Modifies file system
Creates the following files
- %APPDATA%\microsoft\windows\jvbigrib\gwwvfvvw.exe
Sets the 'hidden' attribute to the following files
- %APPDATA%\microsoft\windows\jvbigrib\gwwvfvvw.exe
Deletes itself.
Network activity
Connects to
- 'ms###csi.com':80
TCP
HTTP GET requests
- http://www.ms###csi.com/ncsi.txt
Other
- '34.##0.144.191':443
UDP
- DNS ASK mu###os42.in
