Technical Information
To ensure autorun and distribution:
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\cbiwf2k] 'Start' = '00000001'
Malicious functions:
Creates and executes the following:
- %TEMP%\fwclt.exe <Full path to virus>
Modifies file system :
Creates the following files:
- <SYSTEM32>\commodule.dll
- <SYSTEM32>\winview.ocx
- %TEMP%\fwclt.exe
- <SYSTEM32>\msidfn32.dll
- %TEMP%\77696E766965772E6F6378FA.tmp
- <DRIVERS>\cbiwf2k.sys
- <SYSTEM32>\winstat0.pdr
Deletes the following files:
- %TEMP%\77696E766965772E6F6378FA.tmp
Deletes itself.
