Technical Information
Malicious functions:
To complicate detection of its presence in the operating system,
forces the system hide from view:
- hidden files
blocks the following features:
- System Restore (SR)
- User Account Control (UAC)
Executes the following:
- <SYSTEM32>\cmd.exe /c C:\Intel\Logs\chip\<Virus name>CMD.bat
- <SYSTEM32>\cmd.exe /c C:\Intel\Logs\chip\<Virus name>MuC.bat
- %WINDIR%\regedit.exe /s "C:\Intel\Logs\Chip\<Virus name>CMD.bat"
- %WINDIR%\explorer.exe <Current directory>\<Virus name>
- <SYSTEM32>\cmd.exe /c C:\Intel\Logs\Chip\<Virus name>ST.bat
- <SYSTEM32>\cmd.exe /c C:\Intel\Logs\Chip\<Virus name>CLR.bat
Modifies file system :
Creates the following files:
- %PROGRAM_FILES%\Movie Maker\Movie Maker.exe
- %PROGRAM_FILES%\Microsoft.NET\Microsoft.NET.exe
- %PROGRAM_FILES%\MSN\MSN.exe
- %PROGRAM_FILES%\MSBuild\MSBuild.exe
- %PROGRAM_FILES%\microsoft frontpage\microsoft frontpage.exe
- %PROGRAM_FILES%\ComPlus Applications\ComPlus Applications.exe
- %CommonProgramFiles%\Common Files.exe
- %PROGRAM_FILES%\Messenger\Messenger.exe
- %PROGRAM_FILES%\Internet Explorer\Internet Explorer.exe
- %PROGRAM_FILES%\MSN Gaming Zone\MSN Gaming Zone.exe
- %PROGRAM_FILES%\Windows NT\Windows NT.exe
- %PROGRAM_FILES%\Windows Media Player\Windows Media Player.exe
- %PROGRAM_FILES%\xerox\xerox.exe
- %PROGRAM_FILES%\WindowsUpdate\WindowsUpdate.exe
- %PROGRAM_FILES%\Uninstall Information\Uninstall Information.exe
- %PROGRAM_FILES%\Online Services\Online Services.exe
- %PROGRAM_FILES%\NetMeeting\NetMeeting.exe
- %PROGRAM_FILES%\Reference Assemblies\Reference Assemblies.exe
- %PROGRAM_FILES%\Outlook Express\Outlook Express.exe
- <Current directory>\<Virus name>\<Virus name>.exe
- C:\Intel\Logs\Chip\<Virus name>MuC.bat
- C:\Documents and Settings\Default User\Default User.exe
- %ALLUSERSPROFILE%\All Users.exe
- %HOMEPATH%\CiberCity<Virus name>.exe
- C:\Intel\Logs\Chip\<Virus name>ST.bat
- C:\Intel\Logs\Chip\<Virus name>CMD.bat
- C:\Intel\Logs\Chip\<Virus name>CLR.bat
- C:\Documents and Settings\LocalService\LocalService.exe
- C:\Far2\Plugins\Plugins.exe
- C:\Far2\FExcept\FExcept.exe
- C:\Intel\Logs\Logs.exe
- C:\Far2\PluginSDK\PluginSDK.exe
- C:\Far2\Encyclopedia\Encyclopedia.exe
- %HOMEPATH%\%USERNAME%.exe
- C:\Documents and Settings\NetworkService\NetworkService.exe
- C:\Far2\Documentation\Documentation.exe
- C:\Far2\Addons\Addons.exe
Deletes the following files:
- C:\Intel\Logs\Chip\<Virus name>MuC.bat
- C:\Intel\Logs\Chip\<Virus name>ST.bat
Miscellaneous:
Searches for the following windows:
- ClassName: 'RegEdit_RegEdit' WindowName: ''
- ClassName: '' WindowName: ''
