Trojan.Click.24124

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\smartup.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rsmain.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sndsrvc.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\npfmntor.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rsnetsvr.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xcommsvr.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\livesrv.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rssafety.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scanfrm.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spbbcsvc.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pfw.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccapp.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgnt.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iparmor.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\symlcsvc.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vptray.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccregvfy.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccevtmgr.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccsetmgr.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsserv.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mghtml.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcdetect.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\psimsvc.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avltmain.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mctskshd.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\oasclnt.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcagent.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcvsshld.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcvsescn.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avengine.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bdagent.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\psimreal.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bdwizreg.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\seccenter.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\psctrls.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avtask.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pavsrv51.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\apvxdwin.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\webproxy.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sched.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwmain.exe] 'Debugger' = 'TASKMAN.EXE'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rsnetsvr.exe] 'Debugger' = 'TASKMAN.EXE'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwsrv.exe] 'Debugger' = 'TASKMAN.EXE'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwproxy.exe] 'Debugger' = 'TASKMAN.EXE'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scanfrm.exe] 'Debugger' = 'TASKMAN.EXE'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\smartup.exe] 'Debugger' = 'TASKMAN.EXE'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ravtask.exe] 'Debugger' = 'TASKMAN.EXE'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rsmain.exe] 'Debugger' = 'TASKMAN.EXE'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\runiep.exe] 'Debugger' = 'TASKMAN.EXE'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwstub.exe] 'Debugger' = 'TASKMAN.EXE'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\egui.exe] 'Debugger' = 'TASKMAN.EXE'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ekrn.exe] 'Debugger' = 'TASKMAN.EXE'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32kui.exe] 'Debugger' = 'TASKMAN.EXE'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32krn.exe] 'Debugger' = 'TASKMAN.EXE'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UpFile.exe] 'Debugger' = 'TASKMAN.EXE'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rsaupd.exe] 'Debugger' = 'TASKMAN.EXE'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwcfg.exe] 'Debugger' = 'TASKMAN.EXE'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstray.exe] 'Debugger' = 'TASKMAN.EXE'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ras.exe] 'Debugger' = 'TASKMAN.EXE'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ravstub.exe] 'Debugger' = 'TASKMAN.EXE'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360safe.exe] 'Debugger' = 'TASKMAN.EXE'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe] 'Debugger' = 'TASKMAN.EXE'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\extdb.exe] 'Debugger' = 'TASKMAN.EXE'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\esslibupdate.exe] 'Debugger' = 'TASKMAN.EXE'
[<HKLM>\SOFTWARE\Classes\HTTP\shell\open\command] '' = '"%PROGRAM_FILES%\InternetExplorer\iexplore.exe" -nohome'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avguard.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avcenter.exe] 'Debugger' = 'ntsd -d'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Explorer' = '<DRIVERS>\TXPlatform.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstray.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360safeup.exe] 'Debugger' = 'TASKMAN.EXE'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ravmon.exe] 'Debugger' = 'TASKMAN.EXE'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rav.exe] 'Debugger' = 'TASKMAN.EXE'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccenter.exe] 'Debugger' = 'TASKMAN.EXE'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ravmond.exe] 'Debugger' = 'TASKMAN.EXE'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe] 'Debugger' = 'TASKMAN.EXE'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360safebox.exe] 'Debugger' = 'TASKMAN.EXE'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\safeboxup.exe] 'Debugger' = 'TASKMAN.EXE'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\safeboxtray.exe] 'Debugger' = 'TASKMAN.EXE'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\safebank.exe] 'Debugger' = 'TASKMAN.EXE'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcdash.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kavsvcui.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kislnchr.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32krn.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32kui.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kasmain.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kpfw32.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kmailmon.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kav32.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kpfwsvc.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navapw32.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvfw.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nmain.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navapsvc.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvsrvxp.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kregex.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\uihost.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvwsc.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvmonxp.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kwatch.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwmain.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SetupLD.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwsrv.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwproxy.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ras.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\run] 'llajyn_df' = '%WINDIR%\system\lljyn090118.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'vmdetdhc.exe' = '<SYSTEM32>\vmdetdhc.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\knownsvr.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\run] 'dlnblz' = '%WINDIR%\system\lz090117.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\frwstub.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp32.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccenter.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kavstart.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ravtask.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ravmon.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwcfg.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ravstub.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ravmond.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navw32.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rsagent.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xnlscn.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\agentsvr.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ulibcfg.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vcr32.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\egui.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvxp.kxp] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vcrmon.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ekrn.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kavsvc.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvol.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvmonxp.kxp] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ast.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\secnotifier.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvprescan.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vstskmgr.exe ] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\shstat.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\uplive.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\qqdoctormain.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kissvc.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\frameworkservice.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scan32.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360hotfix.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tbmon.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vstskmgr.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcshield.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\updaterui.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\naprdmgr.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360rpt.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\safebank.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\guardfield.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kaccore.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\safeboxtray.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360safebox.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\boxmod.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360safe.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\makereport.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\extdb.exe] 'Debugger' = 'ntsd -d'

Creates or modifies the following files:

%WINDIR%\Tasks\SA.DAT

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\ffhgtmb] 'Start' = '00000000'

Infects the following executable system files:

<SYSTEM32>\ctfmon.exe
<DRIVERS>\beep.sys

Substitutes the following executable system files:

<SYSTEM32>\dllcache\beep.sys with <SYSTEM32>\dllcache\beep.sys.new
<DRIVERS>\beep.sys with <DRIVERS>\beep.sys.new

Creates the following files on removable media:

<Drive name for removable media>:\autorun.inf
<Drive name for removable media>:\ЎЎЎЎЎЎ.exe

Malicious functions:

To complicate detection of its presence in the operating system,

forces the system hide from view:

hidden files

Creates and executes the following:

%PROGRAM_FILES%\Windows NT\test.exe
<DRIVERS>\TXPlatform.exe
%TEMP%\9874.exe
C:\ipe.exe
C:\iexpe.exe toni"89'$#*?#98hb$jgj)743:.
%TEMP%\wmnet.exe
%PROGRAM_FILES%\Microsoft Office\SYSTEM\sysbar.exe
%TEMP%\setup_1027281.exe
%TEMP%\setup1500.exe
<SYSTEM32>\vmdetdhc.exe -Start
%TEMP%\0013.exe
%TEMP%\1019.exe
%TEMP%\7.exe
%TEMP%\yoyo1182.exe
%TEMP%\17.exe
%PROGRAM_FILES%\Windows NT\test.exe (downloaded from the Internet)

Executes the following:

<SYSTEM32>\net1.exe share admin$ /del /y
<SYSTEM32>\net1.exe share A$ /del /y
<SYSTEM32>\cmd.exe /c %TEMP%\del60$$.bat
<SYSTEM32>\net1.exe share C$ /del /y
<SYSTEM32>\cmd.exe /c %TEMP%\del88$$.bat
<SYSTEM32>\cmd.exe /c %TEMP%\del28$$.bat
<SYSTEM32>\net1.exe share E$ /del /y
<SYSTEM32>\net1.exe stop System Restore Service
<SYSTEM32>\cmd.exe /c %TEMP%\del40$$.bat
<SYSTEM32>\cmd.exe /c %TEMP%\del57$$.bat
<SYSTEM32>\cmd.exe /c %TEMP%\del25$$.bat
<SYSTEM32>\ctfmon.exe
<SYSTEM32>\cmd.exe /c %TEMP%\del93$$.bat
<SYSTEM32>\net1.exe share Z$ /del /y
<SYSTEM32>\cmd.exe /c %TEMP%\del4$$.bat
<SYSTEM32>\cmd.exe /c %TEMP%\del21$$.bat
<SYSTEM32>\cmd.exe /c %TEMP%\del80$$.bat
<SYSTEM32>\rundll32.exe <SYSTEM32>\VVMoSh.dll,DllUnregisterServer
<SYSTEM32>\rundll32.exe <SYSTEM32>\VVMoSh.dll,DllRegisterServer
<SYSTEM32>\ping.exe -n 3 127.0.0.1
<SYSTEM32>\cmd.exe /c <SYSTEM32>\wvitQW.bat
<SYSTEM32>\cmd.exe /c %TEMP%\62$$.bat
<SYSTEM32>\spoolsv.exe -Start
<SYSTEM32>\cmd.exe /c %TEMP%\64$$.bat
%PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE http://www.lx##8.com/www.asp?t=##########
<SYSTEM32>\net.exe stop "Security Center"
<SYSTEM32>\net1.exe stop "Windows Firewall/Internet Connection Sharing (ICS)"
<SYSTEM32>\ping.exe 127.0.0.1
<SYSTEM32>\cmd.exe /c %TEMP%\del67$$.bat
<SYSTEM32>\cmd.exe /c <SYSTEM32>\copy2090000.bat
<SYSTEM32>\net.exe stop System Restore Service
<SYSTEM32>\net.exe stop "Windows Firewall/Internet Connection Sharing (ICS)"
<SYSTEM32>\net1.exe stop "Security Center"
<SYSTEM32>\cmd.exe /c ""c:\dfDelmlljy.bat" "

Injects code into

the following system processes:

<SYSTEM32>\spoolsv.exe

Terminates or attempts to terminate

the following system processes:

<SYSTEM32>\ctfmon.exe

the following user processes:

MCAGENT.EXE
ekrn.exe
ccapp.exe
bdagent.exe
NAVAPW32.EXE
AVP32.EXE
360tray.exe
nod32.exe
AVP.EXE

Forces autoplay for removable media.

Modifies file system :

Creates the following files:

C:\Far2\Addons\Shell\Desktop_1.ini
%TEMP%\del60$$.bat
C:\Far2\Addons\SetUp\Desktop_1.ini
C:\Far2\Addons\Colors\Default Highlighting\Desktop_1.ini
C:\Far2\Addons\Macros\Desktop_1.ini
C:\Far2\Addons\XLat\Russian\Desktop_1.ini
C:\Far2\Documentation\Desktop_1.ini
%TEMP%\del4$$.bat
C:\Far2\Addons\XLat\Desktop_1.ini
%TEMP%\del40$$.bat
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\mylist[1].asp
<SYSTEM32>\mylist.asp
C:\autorun.inf
C:\ЎЎЎЎЎЎ.exe
%TEMP%\del88$$.bat
C:\Far2\Addons\Colors\Desktop_1.ini
C:\Far2\Addons\Colors\Custom Highlighting\Desktop_1.ini
C:\Far2\Addons\Desktop_1.ini
%TEMP%\45$$.Ico
C:\Far2\Desktop_1.ini
C:\Far2\Documentation\eng\Desktop_1.ini
%WINDIR%\mydown.asp
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\update[1].txt
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\mydown[1].asp
C:\Far2\Plugins\7-Zip\Desktop_1.ini
C:\iexpe.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\update[2].txt
<SYSTEM32>\ssdutj.dat
<SYSTEM32>\s1349765902h.dat
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\setup1500[1].txt
<SYSTEM32>\s1349765902g.dat
%TEMP%\del80$$.bat
%TEMP%\del21$$.bat
%TEMP%\wmnet.exe
C:\Far2\Documentation\rus\Desktop_1.ini
C:\Far2\Encyclopedia\Desktop_1.ini
C:\Far2\FExcept\Desktop_1.ini
C:\Far2\Plugins\Desktop_1.ini
%TEMP%\del93$$.bat
%TEMP%\del25$$.bat
%TEMP%\del57$$.bat
<DRIVERS>\TXPlatform.exe
%TEMP%\64$$.bat
%ALLUSERSPROFILE%\lljyndf16.ini
%WINDIR%\system\lljyn090118.exe
%TEMP%\62$$.bat
%WINDIR%\system\lz090117.exe
%ALLUSERSPROFILE%\lzdf16.ini
<SYSTEM32>\VVMoSh.dll
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\Жф¶Ї Internet Explorer дЇААЖч.lnk
%HOMEPATH%\Favorites\НшЦ·µјєЅ.url
%TEMP%\1019.exe
%TEMP%\9874.exe
%TEMP%\17.exe
%TEMP%\7.exe
%TEMP%\0013.exe
<SYSTEM32>\vmdetdhc.exe
%WINDIR%\ResetTest.txt
%TEMP%\yoyo1182.exe
%TEMP%\setup1500.exe
%TEMP%\setup_1027281.exe
<DRIVERS>\tcwhsa.sys
%TEMP%\nst2.tmp\System.dll
%PROGRAM_FILES%\Microsoft Office\SYSTEM\12.exe
<SYSTEM32>\copy2090000.bat
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\www[1].asp
<SYSTEM32>\Com\ie.exe
%TEMP%\del67$$.bat
%TEMP%\del28$$.bat
%TEMP%\74$$.Ico
%HOMEPATH%\Local Settings\Temporary Internet Files\_inimac
<Current directory>\Desktop_1.ini
C:\ipe.exe
C:\z.tmp
%WINDIR%\system\lz32dla.dll
<SYSTEM32>\wvitQW.bat
%WINDIR%\system\llbjyn32bb.dll
C:\GK.TMP
C:\dfDelmlljy.bat
%PROGRAM_FILES%\Windows NT\test.exe
C:\z1.tmp
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\sunn[1].exe

Sets the 'hidden' attribute to the following files:

C:\Far2\Addons\XLat\Russian\Desktop_1.ini
C:\Far2\Documentation\Desktop_1.ini
C:\Far2\Addons\XLat\Desktop_1.ini
C:\Far2\Addons\SetUp\Desktop_1.ini
C:\Far2\Addons\Shell\Desktop_1.ini
C:\Far2\Documentation\eng\Desktop_1.ini
C:\Far2\Plugins\Desktop_1.ini
C:\Far2\Plugins\7-Zip\Desktop_1.ini
C:\Far2\FExcept\Desktop_1.ini
C:\Far2\Documentation\rus\Desktop_1.ini
C:\Far2\Encyclopedia\Desktop_1.ini
C:\Far2\Addons\Macros\Desktop_1.ini
<Drive name for removable media>:\autorun.inf
C:\ЎЎЎЎЎЎ.exe
<Drive name for removable media>:\ЎЎЎЎЎЎ.exe
<SYSTEM32>\vmdetdhc.exe
<Current directory>\Desktop_1.ini
C:\autorun.inf
C:\Far2\Addons\Colors\Custom Highlighting\Desktop_1.ini
C:\Far2\Addons\Colors\Default Highlighting\Desktop_1.ini
C:\Far2\Addons\Colors\Desktop_1.ini
C:\Far2\Desktop_1.ini
C:\Far2\Addons\Desktop_1.ini

Deletes the following files:

<SYSTEM32>\mylist.asp
C:\avp.exe
%TEMP%\74$$.Ico
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\mylist[1].asp
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\mydown[1].asp
<SYSTEM32>\s1349765902g.dat
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\update[1].txt
%WINDIR%\mydown.asp
<SYSTEM32>\s1349765902h.dat
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\www[1].asp
%TEMP%\setup1500.exe
%TEMP%\setup_1027281.exe
%TEMP%\1019.exe
%TEMP%\yoyo1182.exe
C:\z.tmp
%TEMP%\17.exe
%TEMP%\nst2.tmp\System.dll
C:\z1.tmp
%TEMP%\7.exe

Moves the following files:

from %TEMP%\yoyo1182.exe.exe to %TEMP%\yoyo1182.exe
from %PROGRAM_FILES%\Microsoft Office\SYSTEM\12.exe to %PROGRAM_FILES%\Microsoft Office\SYSTEM\sysbar.exe
from %TEMP%\setup1500.exe.exe to %TEMP%\setup1500.exe
from C:\ipe.exe to C:\avp.exe

Network activity:

Connects to:

'www.52##s.com':80
'www.wo#####idongxi.com.cn':80
'lo####.51edm.net':80
'www.ip###ugou.com':80
'localhost':1746
'20##.366ent.com':80
'id#.#kaka.com':80
'localhost':1745
'www.38##ip.cn':80
'<Private IP address>':445
'localhost':1045
'localhost':1039
'www.lx##8.com':80
'localhost':1051
'<Private IP address>':139
'aa.#234.net':82
'www.bu#####nchang.com.cn':80

TCP:

HTTP GET requests:

www.wo#####idongxi.com.cn/update.php?bX##################################
www.52##s.com/TJ.Htm
id#.#kaka.com/idc1/mydown.asp?ve##########################################
20##.366ent.com/2008//user/setup1500.txt
20##.366ent.com/2008//update.txt
www.ip###ugou.com/goto/down.txt
www.bu#####nchang.com.cn/api.php?bX##################################################################################################
www.lx##8.com/down/sunn.exe
www.lx##8.com/www.asp?t=##########
lo####.51edm.net/geturl.php?ve###############################################################################################################################
www.38##ip.cn/mylist.asp?ve#########################################

UDP:

DNS ASK www.ip###ugou.com
DNS ASK lo####.51edm.net
DNS ASK www.52##s.com
DNS ASK 20##.366ent.com
DNS ASK www.wo#####idongxi.com.cn
DNS ASK aa.#234.net
DNS ASK www.lx##8.com
DNS ASK www.bu#####nchang.com.cn
DNS ASK www.38##ip.cn
DNS ASK id#.#kaka.com

Miscellaneous:

Searches for the following windows:

ClassName: 'MS_WebcheckMonitor' WindowName: ''
ClassName: 'MS_AutodialMonitor' WindowName: ''
ClassName: '#32770' WindowName: 'Windows ??????????'
ClassName: '{F03B79CC-5B19-4D71-9EDD-FFDD44B441BF}' WindowName: '{F03B79CC-5B19-4D71-9EDD-FFDD44B441BF}'
ClassName: 'IEFrame' WindowName: ''
ClassName: 'Shell_TrayWnd' WindowName: ''
ClassName: 'EDIT' WindowName: ''
ClassName: '' WindowName: ''
ClassName: 'CabinetWClass' WindowName: ''

Tecnologie

Termini

Formazione ed informazione

Falsi miti

Technical Information

Curing recommendations

Free trial