Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'sys32ex' = '<SYSTEM32>\NTLDR.exe'
Malicious functions:
To complicate detection of its presence in the operating system,
forces the system hide from view:
- hidden files
- file extensions
blocks execution of the following system utilities:
- Windows Task Manager (Taskmgr)
- Registry Editor (RegEdit)
blocks the following features:
- System Restore (SR)
modifies the following system settings:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoClose' = '00000001'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer] 'NoRun' = '00000001'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer] 'NoFolderOptions' = '00000001'
Modifies file system:
Creates the following files:
- C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat.exe
- C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat.exe
- C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat.exe
- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.exe
- %HOMEPATH%\NTUSER.DAT.exe
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\pluginreg.dat.exe
- C:\Documents and Settings\NetworkService\NTUSER.DAT.exe
- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.exe
- C:\Documents and Settings\LocalService\Cookies\index.dat.exe
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Winter.jpg.exe
- C:\Documents and Settings\Default User\NTUSER.DAT.exe
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Sunset.jpg.exe
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Water lilies.jpg.exe
- C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\index.dat.exe
- C:\Documents and Settings\LocalService\NTUSER.DAT.exe
- C:\Documents and Settings\Default User\Cookies\index.dat.exe
- C:\Documents and Settings\Default User\Local Settings\History\History.IE5\index.dat.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\Nature Bkgrd.jpg.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\Pie Charts Bkgrd.jpg.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\Leaves Bkgrd.jpg.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\Maize Bkgrd.jpg.exe
- %CommonProgramFiles%\Services\verisign.bmp.exe
- %CommonProgramFiles%\Services\whowhere.bmp.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\Sunflower Bkgrd.jpg.exe
- %CommonProgramFiles%\Services\bigfoot.bmp.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\Glacier Bkgrd.jpg.exe
- <LS_APPDATA>\Microsoft\Windows\UsrClass.dat.exe
- <LS_APPDATA>\VMware\hgfs.dat.exe
- %HOMEPATH%\Cookies\index.dat.exe
- <LS_APPDATA>\GDIPFONTCACHEV1.DAT.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\Clear Day Bkgrd.jpg.exe
- %CommonProgramFiles%\Microsoft Shared\Stationery\Fiesta Bkgrd.jpg.exe
- %HOMEPATH%\Local Settings\History\History.IE5\index.dat.exe
- %HOMEPATH%\Local Settings\History\History.IE5\MSHist012011111020111111\index.dat.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\astronaut.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\ball.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\%USERNAME%.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\airplane.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\car.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\cat.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\beach.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\butterfly.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\guest.bmp.exe
- <SYSTEM32>\NTLDR.exe
- C:\Diperkosa.flv.exe
- %TEMP%\~DFA749.tmp
- %WINDIR%\system manager.sys.EXE
- <SYSTEM32>\readme.txt
- C:\gadis cantik ABG.flv.exe
- C:\readme.txt
- %WINDIR%\windows.txt
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\palm tree.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\pink flower.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\kick.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\lift-off.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\snowflake.bmp.exe
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Blue hills.jpg.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\red flower.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\skater.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\horses.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\dog.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\drip.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\chess.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\dirt bike.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\frog.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\guitar.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\duck.bmp.exe
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\fish.bmp.exe
