Trojan.DownLoader7.20255

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] '' = ''
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'GrpConv' = 'grpconv -o'
[<HKLM>\SOFTWARE\Classes\MSProgramGroup\Shell\Open\Command] '' = '<SYSTEM32>\grpconv.exe %1'
[<HKLM>\SOFTWARE\Classes\cmdfile\shell\open\command] '' = '"%1" %*'
[<HKLM>\SOFTWARE\Classes\comfile\shell\open\command] '' = '"%1" %*'
[<HKLM>\SOFTWARE\Classes\exefile\shell\open\command] '' = '"%1" %*'
[<HKLM>\SOFTWARE\Classes\batfile\shell\open\command] '' = '"%1" %*'

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\PROCEXP90] 'ImagePath' = '<DRIVERS>\PROCEXP90.SYS'

Malicious functions:

Creates and executes the following:

C:\<Virus name>\mtee.cfexe NlsLang
C:\<Virus name>\swreg.cfexe query "HKLM\System\CurrentControlSet\Control\NLS\Language" /V InstallLanguage
C:\<Virus name>\sed.cfexe "/.*\t/!d; s///" temp00
<SYSTEM32>\CF7869.exe /S /D /c" ECHO.0409"
C:\<Virus name>\Findstr.cfexe -E "07"
C:\<Virus name>\Findstr.cfexe -E "13"
C:\<Virus name>\Findstr.cfexe -E "0C"
C:\<Virus name>\swreg.cfexe query "HKLM\System\CurrentControlSet\Control\NLS\CodePage" /V ACP
<SYSTEM32>\CF7869.exe /k c.bat
<SYSTEM32>\CF7869.exe /f:off /d /c call Start_.cmd
C:\32788R22FWJFW\NirCmd.cfexe execmd DEL "\32788R22FWJFW\prep.cmd"
<SYSTEM32>\CF7869.exe /S /D /c" ECHO..cfexe;.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH"
C:\<Virus name>\grep.cfexe -qi ".CFEXE;"
<SYSTEM32>\CF7869.exe /S /D /c" SET PATHEXT"
C:\<Virus name>\grep.cfexe -qi "\.CFEXE;"
C:\<Virus name>\Findstr.cfexe -E "0B"
C:\<Virus name>\grep.cfexe -isq "\/u" sfx.cmd
C:\<Virus name>\grep.cfexe -sq \\ ForeignA.dat
C:\<Virus name>\Findstr.cfexe -IV "\\detoured\.dll" temp01
<SYSTEM32>\CF7869.exe /S /D /c" ( ECHO.7947 http://do######.bleepingcomputer.com/sUBs/ & ECHO.28017 http://su##.#eekstogo.com/ & ECHO.18704 http://www.fo###pyware.com/sUBs/ )"
C:\<Virus name>\nircmd.com qboxcom "There's a newer version of ComboFix available.~n~nWould you like to update ComboFix?" "Update" returnval 1
C:\<Virus name>\Findstr.cfexe MANDATORY Version.txt
C:\<Virus name>\ComboFix-Download.exe http://www.fo###pyware.com/sUBs/version.txt .\ /delete
C:\<Virus name>\sed.cfexe -r "1d; /\t$/!d; s/.*\t(.:\\.*)\t.*/\1/;" temp00
C:\<Virus name>\Findstr.cfexe -E "0A"
C:\<Virus name>\Findstr.cfexe -E "10"
C:\<Virus name>\Findstr.cfexe -E "16"
C:\<Virus name>\Findstr.cfexe -E "05"
C:\<Virus name>\pv.cfexe -m CF7869.exe -q -e
C:\<Virus name>\Findstr.cfexe -E "04"
C:\<Virus name>\Findstr.cfexe -E "15"
C:\32788R22FWJFW\sed.cfexe -r "/<Non-existant Process> pid: ([0-9]*) .*/!d; s//@Nircmd KillProcess \/\1/" temp01
C:\32788R22FWJFW\handle.cfexe
<SYSTEM32>\cmd.cfexe /c 32788R22FWJFW\prep.cmd >Bug.txt
C:\32788R22FWJFW\pv.cfexe -o"%i\t%l"
C:\32788R22FWJFW\NirCmd.cfexe win close ititle "ComboFix"
C:\32788R22FWJFW\NirCmd.cfexe win close class "#32770"
C:\32788R22FWJFW\sed.cfexe "/\t.*\\nircmd\.inf$/!d; s///; s/./@pv -kfi &/" temp02
C:\32788R22FWJFW\nircmd.com cmdwait 500 exec hide "<SYSTEM32>\cmd.cfexe" /c 32788R22FWJFW\prep.cmd >Bug.txt
C:\32788R22FWJFW\nircmd.com exec hide 32788R22FWJFW\SWREG.exe acl "hklm\software\microsoft\windows nt\currentversion\windows" /de:f /q
C:\32788R22FWJFW\hidec.exe 32788R22FWJFW\swreg.exe import 32788R22FWJFW\EXE.reg
C:\32788R22FWJFW\nircmd.com shexec install 32788R22FWJFW\nircmd.inf
C:\32788R22FWJFW\swreg.exe import 32788R22FWJFW\EXE.reg
C:\32788R22FWJFW\gsar.cfexe -f -s\:000M:000i:000c:000r:000o -r\:001M:000i:000c:000r:000o "<SYSTEM32>\cmd.exe" "<SYSTEM32>\cmd.cfexe"
C:\32788R22FWJFW\nircmd.com exec hide 32788R22FWJFW\GSAR.cfexe -f -s\:000M:000i:000c:000r:000o -r\:001M:000i:000c:000r:000o "<SYSTEM32>\cmd.exe" "<SYSTEM32>\cmd.cfexe"
C:\32788R22FWJFW\swreg.exe acl "hklm\software\microsoft\windows nt\currentversion\windows" /de:f /q
C:\32788R22FWJFW\swreg.exe add "hklm\software\microsoft\windows\currentversion\app paths\combofix.exe" /ve /d "<Full path to virus>"
C:\32788R22FWJFW\swreg.cfexe acl "hklm\software\microsoft\windows nt\currentversion\windows" /RE:F /Q
C:\32788R22FWJFW\Findstr.cfexe -LIXC:"<Virus name>" dirname00
C:\32788R22FWJFW\Findstr.cfexe -IVX ComboFix
C:\32788R22FWJFW\grep.cfexe -sq "currentversion.* 6.0" osVer00
C:\32788R22FWJFW\NirCmd.cfexe exec hide "<SYSTEM32>\CF7869.exe" /f:off /d /c call Start_.cmd
C:\32788R22FWJFW\swreg.cfexe acl "hklm\software\microsoft\windows nt\currentversion\windows" /DE:F /Q
C:\32788R22FWJFW\swreg.cfexe query "hklm\software\microsoft\windows nt\currentversion\windows"
<SYSTEM32>\CF7869.exe /S /D /c" DIR /AD/B C:\* "
C:\32788R22FWJFW\Attrib.cfexe +R "C:\32788R22FWJFW\*.com"
C:\32788R22FWJFW\Attrib.cfexe +R "C:\32788R22FWJFW\*.cfexe"
C:\32788R22FWJFW\sed.cfexe -r "s/SfxCmd=.[^\x22]*\x22 +/@SET SfxCmd=/I"
C:\32788R22FWJFW\swxcacls.cfexe "<SYSTEM32>\cmd.exe" /OA /Q
C:\32788R22FWJFW\grep.cfexe -isqx "FileName=[-[:alnum:]@.]*" FileName
C:\32788R22FWJFW\gsar.cfexe -f -s\:000M:000i:000c:000r:000o -r\:001M:000i:000c:000r:000o "<SYSTEM32>\cmd.exe" "<SYSTEM32>\CF7869.exe"
C:\32788R22FWJFW\swxcacls.cfexe "<SYSTEM32>\cmd.exe" /P /GA:F /GS:F /GP:X /GU:X /Q

Executes the following:

<SYSTEM32>\findstr.exe -I "=.*[a-z]" sfx.cmd
<SYSTEM32>\attrib.exe +R "<Full path to virus>"
<SYSTEM32>\chcp.com 1251
<SYSTEM32>\sort.exe
<SYSTEM32>\ping.exe -n 2 google.com
<SYSTEM32>\runonce.exe -r
<SYSTEM32>\rundll32.exe setupapi,InstallHinfSection DefaultInstall 132 C:\32788R22FWJFW\nircmd.inf
<SYSTEM32>\grpconv.exe -o
<SYSTEM32>\find.exe "Windows XP" VER00
<SYSTEM32>\find.exe "Microsoft Windows [Version 5.2.3790]" VER00

Modifies file system :

Creates the following files:

C:\32788R22FWJFW\srizbi.md5
C:\32788R22FWJFW\SF.cfexe
C:\32788R22FWJFW\svchost.dat
C:\32788R22FWJFW\SvcDrv.vbs
C:\32788R22FWJFW\sed.cfexe
C:\32788R22FWJFW\SafeBootRepair.bat
C:\32788R22FWJFW\setpath.cfexe
C:\32788R22FWJFW\SetEnvmt.bat
C:\32788R22FWJFW\swxcacls.cfexe
C:\32788R22FWJFW\swsc.cfexe
C:\32788R22FWJFW\toolbar.sed
C:\32788R22FWJFW\system_ini.dat
C:\32788R22FWJFW\svclist.sed
C:\32788R22FWJFW\svchost.vista.dat
C:\32788R22FWJFW\swreg.exe
C:\32788R22FWJFW\svc_wht.dat
C:\32788R22FWJFW\pv.cfexe
C:\32788R22FWJFW\Purity.dat
C:\32788R22FWJFW\RegDo.sed
C:\32788R22FWJFW\Qoo.bat
C:\32788R22FWJFW\Policies.dat
C:\32788R22FWJFW\OSid.vbs
C:\32788R22FWJFW\psexec.cfexe
C:\32788R22FWJFW\Prep.cmd
C:\32788R22FWJFW\safeboot.dat
C:\32788R22FWJFW\run2.sed
C:\32788R22FWJFW\safeboot.def.vista.dat
C:\32788R22FWJFW\safeboot.def.dat
C:\32788R22FWJFW\RestoreO4.bat
C:\32788R22FWJFW\region.dat
C:\32788R22FWJFW\rogues.dat
C:\32788R22FWJFW\restore_pt.vbs
C:\Start_.cmd
C:\32788R22FWJFW\MWindows.dat
C:\<Virus name>\kmd.dat
C:\<Virus name>\NULL
<SYSTEM32>\CF7869.exe
C:\32788R22FWJFW\Attrib.cfexe
C:\32788R22FWJFW\dirname00
C:\32788R22FWJFW\FileName
C:\<Virus name>\NlsLang
C:\<Virus name>\Lang01
C:\<Virus name>\version.txt
C:\<Virus name>\Mirrors
C:\<Virus name>\temp00
C:\<Virus name>\erunt.dat
C:\<Virus name>\chcp.bat
C:\<Virus name>\lang00
C:\32788R22FWJFW\zip.cfexe
C:\32788R22FWJFW\zhsvc.dat
C:\Bug.txt
<SYSTEM32>\cmd.cfexe
C:\32788R22FWJFW\whitedirB.dat
C:\32788R22FWJFW\vfind.cfexe
C:\32788R22FWJFW\zDomain.dat
C:\32788R22FWJFW\WhiteLegacy.dat
C:\32788R22FWJFW\swreg.cfexe
C:\32788R22FWJFW\temp02
C:\32788R22FWJFW\Findstr.cfexe
C:\32788R22FWJFW\sfx.cmd
C:\32788R22FWJFW\NULL
C:\32788R22FWJFW\VER00
C:\32788R22FWJFW\temp01
<DRIVERS>\PROCEXP90.SYS
C:\32788R22FWJFW\NirCmdC.cfexe
C:\32788R22FWJFW\dumphive.cfexe
C:\32788R22FWJFW\DPF.str
C:\32788R22FWJFW\ERDNT.e_e
C:\32788R22FWJFW\embedded.sed
C:\32788R22FWJFW\DelClsid.bat
C:\32788R22FWJFW\dd.cfexe
C:\32788R22FWJFW\DPF.sed
C:\32788R22FWJFW\Disclaimer.bat
C:\32788R22FWJFW\executables.dat
C:\32788R22FWJFW\Exe.reg
C:\32788R22FWJFW\fdsv.cfexe
C:\32788R22FWJFW\extract.cfexe
C:\32788R22FWJFW\ERDNTWIN.LOC
C:\32788R22FWJFW\ERDNTDOS.LOC
C:\32788R22FWJFW\ERUNT.LOC
C:\32788R22FWJFW\ERUNT.cfexe
C:\32788R22FWJFW\BootSect
C:\32788R22FWJFW\Boot.bat
C:\32788R22FWJFW\catchme.cfexe
C:\32788R22FWJFW\C.bat
C:\32788R22FWJFW\023v.dat
C:\32788R22FWJFW\023.dat
C:\32788R22FWJFW\badclsid
C:\32788R22FWJFW\Assoc.cmd
C:\32788R22FWJFW\Creg.dat
C:\32788R22FWJFW\Comspec.bat
C:\32788R22FWJFW\CregC.dat
C:\32788R22FWJFW\CregC.cmd
C:\32788R22FWJFW\Combo-Fix.sys
C:\32788R22FWJFW\clsid.dat
C:\32788R22FWJFW\ComboFix-Download.exe
C:\32788R22FWJFW\Combobatch.bat
C:\32788R22FWJFW\mtee.cfexe
C:\32788R22FWJFW\MoveIt.bat
C:\32788R22FWJFW\ND_.bat
C:\32788R22FWJFW\ndis_combofix.dat
C:\32788R22FWJFW\LocalSystemNetworkRestricted.dat
C:\32788R22FWJFW\LocalServiceNetworkRestricted.dat
C:\32788R22FWJFW\moveex.cfexe
C:\32788R22FWJFW\md5deep.cfexe
C:\32788R22FWJFW\NirCmd.cfexe
C:\32788R22FWJFW\NetworkService.dat
C:\32788R22FWJFW\NirCmd.inf
C:\32788R22FWJFW\nircmd.com
C:\32788R22FWJFW\netsvc.dat
C:\32788R22FWJFW\netsvc.bad.dat
C:\32788R22FWJFW\netsvc.xp.dat
C:\32788R22FWJFW\netsvc.vista.dat
C:\32788R22FWJFW\gsar.cfexe
C:\32788R22FWJFW\grep.cfexe
C:\32788R22FWJFW\hidec.exe
C:\32788R22FWJFW\handle.cfexe
C:\32788R22FWJFW\FIND3M.bat
C:\32788R22FWJFW\Fin.dat
C:\32788R22FWJFW\FProps.vbs
C:\32788R22FWJFW\FIXLSP.bat
C:\32788R22FWJFW\lnkread.vbs
C:\32788R22FWJFW\List-C.bat
C:\32788R22FWJFW\LocalService.dat
C:\32788R22FWJFW\LocalDrive.vbs
C:\32788R22FWJFW\image001.gif
C:\32788R22FWJFW\history.bat
C:\32788R22FWJFW\LFN.vbs
C:\32788R22FWJFW\Lang.bat

Deletes the following files:

<SYSTEM32>\cmd.cfexe
C:\Bug.txt
C:\Start_.cmd
C:\<Virus name>\Lang01
C:\<Virus name>\temp00
C:\<Virus name>\lang00
C:\32788R22FWJFW\Prep.cmd
C:\32788R22FWJFW\temp02
C:\32788R22FWJFW\temp01
<DRIVERS>\PROCEXP90.SYS
C:\32788R22FWJFW\dirname00
C:\32788R22FWJFW\FileName
C:\32788R22FWJFW\NirCmd.inf

Moves the following files:

from C:\32788R22FWJFW\Purity.dat to C:\<Virus name>\Purity.dat
from C:\32788R22FWJFW\pv.cfexe to C:\<Virus name>\pv.cfexe
from C:\32788R22FWJFW\Qoo.bat to C:\<Virus name>\Qoo.bat
from C:\32788R22FWJFW\OSid.vbs to C:\<Virus name>\OSid.vbs
from C:\32788R22FWJFW\Policies.dat to C:\<Virus name>\Policies.dat
from C:\32788R22FWJFW\psexec.cfexe to C:\<Virus name>\psexec.cfexe
from C:\32788R22FWJFW\RegDo.sed to C:\<Virus name>\RegDo.sed
from C:\32788R22FWJFW\rogues.dat to C:\<Virus name>\rogues.dat
from C:\32788R22FWJFW\run2.sed to C:\<Virus name>\run2.sed
from C:\32788R22FWJFW\safeboot.dat to C:\<Virus name>\safeboot.dat
from C:\32788R22FWJFW\region.dat to C:\<Virus name>\region.dat
from C:\32788R22FWJFW\RestoreO4.bat to C:\<Virus name>\RestoreO4.bat
from C:\32788R22FWJFW\restore_pt.vbs to C:\<Virus name>\restore_pt.vbs
from C:\32788R22FWJFW\NULL to C:\<Virus name>\NULL
from C:\32788R22FWJFW\ndis_combofix.dat to C:\<Virus name>\ndis_combofix.dat
from C:\32788R22FWJFW\ND_.bat to C:\<Virus name>\ND_.bat
from C:\32788R22FWJFW\netsvc.bad.dat to C:\<Virus name>\netsvc.bad.dat
from C:\32788R22FWJFW\MoveIt.bat to C:\<Virus name>\MoveIt.bat
from C:\32788R22FWJFW\mtee.cfexe to C:\<Virus name>\mtee.cfexe
from C:\32788R22FWJFW\MWindows.dat to C:\<Virus name>\MWindows.dat
from C:\32788R22FWJFW\netsvc.dat to C:\<Virus name>\netsvc.dat
from C:\32788R22FWJFW\NirCmd.cfexe to C:\<Virus name>\NirCmd.cfexe
from C:\32788R22FWJFW\nircmd.com to C:\<Virus name>\nircmd.com
from C:\32788R22FWJFW\NirCmdC.cfexe to C:\<Virus name>\NirCmdC.cfexe
from C:\32788R22FWJFW\netsvc.vista.dat to C:\<Virus name>\netsvc.vista.dat
from C:\32788R22FWJFW\netsvc.xp.dat to C:\<Virus name>\netsvc.xp.dat
from C:\32788R22FWJFW\NetworkService.dat to C:\<Virus name>\NetworkService.dat
from C:\32788R22FWJFW\swxcacls.cfexe to C:\<Virus name>\swxcacls.cfexe
from C:\32788R22FWJFW\system_ini.dat to C:\<Virus name>\system_ini.dat
from C:\32788R22FWJFW\toolbar.sed to C:\<Virus name>\toolbar.sed
from C:\32788R22FWJFW\swreg.cfexe to C:\<Virus name>\swreg.cfexe
from C:\32788R22FWJFW\swreg.exe to C:\<Virus name>\swreg.exe
from C:\32788R22FWJFW\swsc.cfexe to C:\<Virus name>\swsc.cfexe
from C:\32788R22FWJFW\VER00 to C:\<Virus name>\VER00
from C:\32788R22FWJFW\zDomain.dat to C:\<Virus name>\zDomain.dat
from C:\32788R22FWJFW\zhsvc.dat to C:\<Virus name>\zhsvc.dat
from C:\32788R22FWJFW\zip.cfexe to C:\<Virus name>\zip.cfexe
from C:\32788R22FWJFW\vfind.cfexe to C:\<Virus name>\vfind.cfexe
from C:\32788R22FWJFW\whitedirB.dat to C:\<Virus name>\whitedirB.dat
from C:\32788R22FWJFW\WhiteLegacy.dat to C:\<Virus name>\WhiteLegacy.dat
from C:\32788R22FWJFW\svc_wht.dat to C:\<Virus name>\svc_wht.dat
from C:\32788R22FWJFW\sed.cfexe to C:\<Virus name>\sed.cfexe
from C:\32788R22FWJFW\SetEnvmt.bat to C:\<Virus name>\SetEnvmt.bat
from C:\32788R22FWJFW\setpath.cfexe to C:\<Virus name>\setpath.cfexe
from C:\32788R22FWJFW\safeboot.def.dat to C:\<Virus name>\safeboot.def.dat
from C:\32788R22FWJFW\safeboot.def.vista.dat to C:\<Virus name>\safeboot.def.vista.dat
from C:\32788R22FWJFW\SafeBootRepair.bat to C:\<Virus name>\SafeBootRepair.bat
from C:\32788R22FWJFW\SF.cfexe to C:\<Virus name>\SF.cfexe
from C:\32788R22FWJFW\svchost.dat to C:\<Virus name>\svchost.dat
from C:\32788R22FWJFW\svchost.vista.dat to C:\<Virus name>\svchost.vista.dat
from C:\32788R22FWJFW\svclist.sed to C:\<Virus name>\svclist.sed
from C:\32788R22FWJFW\sfx.cmd to C:\<Virus name>\sfx.cmd
from C:\32788R22FWJFW\srizbi.md5 to C:\<Virus name>\srizbi.md5
from C:\32788R22FWJFW\SvcDrv.vbs to C:\<Virus name>\SvcDrv.vbs
from C:\32788R22FWJFW\dd.cfexe to C:\<Virus name>\dd.cfexe
from C:\32788R22FWJFW\DelClsid.bat to C:\<Virus name>\DelClsid.bat
from C:\32788R22FWJFW\Disclaimer.bat to C:\<Virus name>\Disclaimer.bat
from C:\32788R22FWJFW\Creg.dat to C:\<Virus name>\Creg.dat
from C:\32788R22FWJFW\CregC.cmd to C:\<Virus name>\CregC.cmd
from C:\32788R22FWJFW\CregC.dat to C:\<Virus name>\CregC.dat
from C:\32788R22FWJFW\DPF.sed to C:\<Virus name>\DPF.sed
from C:\32788R22FWJFW\ERDNT.e_e to C:\<Virus name>\ERDNT.e_e
from C:\32788R22FWJFW\ERDNTDOS.LOC to C:\<Virus name>\ERDNTDOS.LOC
from C:\32788R22FWJFW\ERDNTWIN.LOC to C:\<Virus name>\ERDNTWIN.LOC
from C:\32788R22FWJFW\DPF.str to C:\<Virus name>\DPF.str
from C:\32788R22FWJFW\dumphive.cfexe to C:\<Virus name>\dumphive.cfexe
from C:\32788R22FWJFW\embedded.sed to C:\<Virus name>\embedded.sed
from C:\32788R22FWJFW\Comspec.bat to C:\<Virus name>\Comspec.bat
from C:\32788R22FWJFW\Attrib.cfexe to C:\<Virus name>\Attrib.cfexe
from C:\32788R22FWJFW\badclsid to C:\<Virus name>\badclsid
from C:\32788R22FWJFW\Boot.bat to C:\<Virus name>\Boot.bat
from C:\32788R22FWJFW\023.dat to C:\<Virus name>\023.dat
from C:\32788R22FWJFW\023v.dat to C:\<Virus name>\023v.dat
from C:\32788R22FWJFW\Assoc.cmd to C:\<Virus name>\Assoc.cmd
from C:\32788R22FWJFW\BootSect to C:\<Virus name>\BootSect
from C:\32788R22FWJFW\Combo-Fix.sys to C:\<Virus name>\Combo-Fix.sys
from C:\32788R22FWJFW\Combobatch.bat to C:\<Virus name>\Combobatch.bat
from C:\32788R22FWJFW\ComboFix-Download.exe to C:\<Virus name>\ComboFix-Download.exe
from C:\32788R22FWJFW\C.bat to C:\<Virus name>\C.bat
from C:\32788R22FWJFW\catchme.cfexe to C:\<Virus name>\catchme.cfexe
from C:\32788R22FWJFW\clsid.dat to C:\<Virus name>\clsid.dat
from C:\32788R22FWJFW\Lang.bat to C:\<Virus name>\Lang.bat
from C:\32788R22FWJFW\LFN.vbs to C:\<Virus name>\LFN.vbs
from C:\32788R22FWJFW\List-C.bat to C:\<Virus name>\List-C.bat
from C:\32788R22FWJFW\hidec.exe to C:\<Virus name>\hidec.exe
from C:\32788R22FWJFW\history.bat to C:\<Virus name>\history.bat
from C:\32788R22FWJFW\image001.gif to C:\<Virus name>\image001.gif
from C:\32788R22FWJFW\lnkread.vbs to C:\<Virus name>\lnkread.vbs
from C:\32788R22FWJFW\LocalSystemNetworkRestricted.dat to C:\<Virus name>\LocalSystemNetworkRestricted.dat
from C:\32788R22FWJFW\md5deep.cfexe to C:\<Virus name>\md5deep.cfexe
from C:\32788R22FWJFW\moveex.cfexe to C:\<Virus name>\moveex.cfexe
from C:\32788R22FWJFW\LocalDrive.vbs to C:\<Virus name>\LocalDrive.vbs
from C:\32788R22FWJFW\LocalService.dat to C:\<Virus name>\LocalService.dat
from C:\32788R22FWJFW\LocalServiceNetworkRestricted.dat to C:\<Virus name>\LocalServiceNetworkRestricted.dat
from C:\32788R22FWJFW\handle.cfexe to C:\<Virus name>\handle.cfexe
from C:\32788R22FWJFW\executables.dat to C:\<Virus name>\executables.dat
from C:\32788R22FWJFW\extract.cfexe to C:\<Virus name>\extract.cfexe
from C:\32788R22FWJFW\fdsv.cfexe to C:\<Virus name>\fdsv.cfexe
from C:\32788R22FWJFW\ERUNT.cfexe to C:\<Virus name>\ERUNT.cfexe
from C:\32788R22FWJFW\ERUNT.LOC to C:\<Virus name>\ERUNT.LOC
from C:\32788R22FWJFW\Exe.reg to C:\<Virus name>\Exe.reg
from C:\32788R22FWJFW\Fin.dat to C:\<Virus name>\Fin.dat
from C:\32788R22FWJFW\FProps.vbs to C:\<Virus name>\FProps.vbs
from C:\32788R22FWJFW\grep.cfexe to C:\<Virus name>\grep.cfexe
from C:\32788R22FWJFW\gsar.cfexe to C:\<Virus name>\gsar.cfexe
from C:\32788R22FWJFW\FIND3M.bat to C:\<Virus name>\FIND3M.bat
from C:\32788R22FWJFW\Findstr.cfexe to C:\<Virus name>\Findstr.cfexe
from C:\32788R22FWJFW\FIXLSP.bat to C:\<Virus name>\FIXLSP.bat

Network activity:

Connects to:

'www.fo###pyware.com':80

TCP:

HTTP GET requests:

www.fo###pyware.com/sUBs/version.txt

UDP:

DNS ASK www.fo###pyware.com
DNS ASK google.com

Miscellaneous:

Searches for the following windows:

ClassName: 'Shell_TrayWnd' WindowName: ''
ClassName: 'EDIT' WindowName: ''

Tecnologie

Termini

Formazione ed informazione

Falsi miti

Technical Information

Curing recommendations

Free trial