Technical Information
To ensure autorun and distribution:
Creates the following files on removable media:
- <Drive name for removable media>:\Data.exe
- <Drive name for removable media>:\New Folder.exe
Malicious functions:
To complicate detection of its presence in the operating system,
forces the system hide from view:
- hidden files
- file extensions
Creates and executes the following:
- <SYSTEM32>\ explorer.exe
Executes the following:
- <SYSTEM32>\schtasks.exe /create /sc minute /tn /tr fGetSpecialFolder(41)"\ explorer.exe"
- <SYSTEM32>\net1.exe start schedule
- %WINDIR%\explorer.exe <Virus name>\
- <SYSTEM32>\schtasks.exe /delete /tn
Modifies file system :
Creates the following files:
- C:\Far2.exe
- C:\Documents and Settings.exe
- C:\<Auxiliary name>.exe
- <Auxiliary element>
- %PROGRAM_FILES%.exe
- <SYSTEM32>\ explorer.exe
- C:\New Folder.exe
- <Current directory>.exe
- C:\Data.exe
Sets the 'hidden' attribute to the following files:
- <SYSTEM32>\ explorer.exe
Deletes the following files:
- %TEMP%\~DF9D42.tmp
Miscellaneous:
Searches for the following windows:
- ClassName: '' WindowName: ''
