Trojan.DownLoader7.29091

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Classes\batfile\shell\open\command] '' = '"%1" %*'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'GrpConv' = 'grpconv -o'
[<HKLM>\SOFTWARE\Classes\MSProgramGroup\Shell\Open\Command] '' = '<SYSTEM32>\grpconv.exe %1'
[<HKLM>\SOFTWARE\Classes\cmdfile\shell\open\command] '' = '"%1" %*'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] '' = ''
[<HKLM>\SOFTWARE\Classes\exefile\shell\open\command] '' = '"%1" %*'
[<HKLM>\SOFTWARE\Classes\comfile\shell\open\command] '' = '"%1" %*'

Malicious functions:

To complicate detection of its presence in the operating system,

blocks the following features:

System Restore (SR)

Creates and executes the following:

C:\<Virus name>\NirCmd.cfexe SERVICE STOP CRYPTSVC
C:\<Virus name>\swreg.exe QUERY "hklm\system\select" /v "current"
<SYSTEM32>\CF11654.exe /k c.bat
C:\32788R22FWJFW\pev.cfexe EXEC "<SYSTEM32>\CF11654.exe" /F:OFF /D /C CALL Start_.cmd
<SYSTEM32>\CF11654.exe /F:OFF /D /C CALL Start_.cmd
C:\<Virus name>\Attrib.cfexe +R *.com
<SYSTEM32>\CF11654.exe /S /D /c" ECHO..CFEXE;.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH"
C:\<Virus name>\Attrib.cfexe +R *.cfexe
C:\<Virus name>\sed.cfexe -r "/.*\t/!d; s//00/; s/^[0-9]*(...) .*/@SET ControlSet=ControlSet\1\nSET CS000=HKEY_LOCAL_MACHINE\\system\\ControlSet\1\\Services/" CurrentCS00
C:\<Virus name>\grep.cfexe -sqx "REGEDIT4" Fin.dat
C:\32788R22FWJFW\unzip.cfexe -ojCq "License\streamtools.zip" sf.exe
C:\32788R22FWJFW\grep.cfexe -isq "\/cfDebug" sfx.cmd
C:\32788R22FWJFW\grep.cfexe -sq "=.*[a-z]" sfx.cmd
C:\32788R22FWJFW\sed.cfexe -r "/SfxCmd=/I!d; s///; s/^(\x22[^\x22]*\x22|[^\x22][^ ]*) +//; s/^([^\x22][^ ]*)/@SET SfxCmd=\x22\1\x22/; s/^(\x22.*)/@SET SfxCmd=\1/"
C:\32788R22FWJFW\sed.cfexe "/.*\t/!d; s///" NlsLanguage00
<SYSTEM32>\cmd.execf /S /D /c" SET SfxCmd "
C:\32788R22FWJFW\swreg.exe ADD HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys /D Driver
C:\32788R22FWJFW\swreg.exe ADD HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\procexp90.Sys /D Driver
<SYSTEM32>\CF11654.exe /S /D /c" DIR /AD/B C:\* "
C:\32788R22FWJFW\grep.cfexe -sqx "REGEDIT4" Fin.dat
C:\32788R22FWJFW\grep.cfexe -isqx "FileName=[-[:alnum:]@.]*" FileName
C:\<Virus name>\SWREG.cfexe DELETE "HKLM\SOFTWARE\UAC"
C:\<Virus name>\ComboFix-Download.cfexe -s --connect-timeout 5 -H "Host: download.bleepingcomputer.com" http://20#.#3.120.24/sUBs/version.txt
C:\<Virus name>\SWREG.cfexe DELETE "HKLM\SOFTWARE\QUADRA"
C:\<Virus name>\SWREG.cfexe DELETE "HKLM\SOFTWARE\TDSS"
C:\<Virus name>\SWREG.cfexe DELETE "HKLM\SOFTWARE\SENEKA"
C:\<Virus name>\pev.cfexe -rtf -dg7 .\c.bat
C:\<Virus name>\Nircmd.com QBOXCOMTOP "Current date is Tue 10/23/2012. ComboFix has expired~n~nClick 'Yes' to run in REDUCED FUNCTIONALITY mode~n~nClick 'No' to exit" "Version_09-04-23.01" "" FILLDELETE ABORTB
C:\<Virus name>\ComboFix-Download.cfexe -s --connect-timeout 5 -H "Host: www.fo####yware.com" http://75.##7.69.91/sUBs/version.txt
C:\<Virus name>\grep.cfexe "^[0-9][0-9].* [0-9]"
C:\<Virus name>\ComboFix-Download.cfexe -s --connect-timeout 5 -H "Host: subs.geekstogo.com" http://74.##7.128.223/sUBs/version.txt
C:\<Virus name>\pev.cfexe --files:pingtest02 -tf -t!o "%~G"
C:\<Virus name>\pev.cfexe -to -tf "<SYSTEM32>\cmd.exe"
C:\<Virus name>\pev.cfexe --files:ForeignC02 -t!o
C:\<Virus name>\FINDSTR.cfexe -LIEVG:ForeignWht ForeignC01
C:\<Virus name>\grep.cfexe -qi "\.CFEXE;"
C:\<Virus name>\sed.cfexe -R "1,3d; /[4-9]\S{7}\s*\d* .:\\/d; /.*(.:\\.*)/I!d; s//\1/" ForeignC00
C:\<Virus name>\sed.cfexe -R "1,3d; /((10|4)00000|[4-9]\S{7})\s*\d* .:\\/d; /C:\\WINDOWS\\system32\$xpsp2res|Normaliz|urlmon|odbcint|imon)\.dll/Id; /$|\\/I!d; s/.*(.:\\)/\1/" pingtest00
C:\<Virus name>\FINDSTR.cfexe -LIEVG:ForeignWht pingtest01
C:\<Virus name>\pev.cfexe EXEC PING.EXE -n 1 -w 250 127.0.0.1
C:\<Virus name>\pev.cfexe --Files:ForeignC03 "%~G" -t!g
C:\<Virus name>\grep.cfexe -isq "\/u" sfx.cmd
C:\32788R22FWJFW\swreg.exe QUERY HKLM\System\CurrentControlSet\Control\NLS\Language /V Default
C:\32788R22FWJFW\n.com cmdwait 1000 exec hide "~$folder.system$\cmd.execf" /c 32788R22FWJFW\prep.cmd >\Bug.txt
C:\32788R22FWJFW\swreg.exe acl "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32" /reset /q
C:\32788R22FWJFW\gsar.cfexe -if -s\:000M:000i:000c:000r:000o -r\:001M:000i:000c:000r:000o "<SYSTEM32>\cmd.exe" "<SYSTEM32>\cmd.execf"
C:\32788R22FWJFW\n.com cmdwait 3000 exec hide 32788R22FWJFW\swreg.exe acl "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32" /reset /q
C:\32788R22FWJFW\n.com exec hide 32788R22FWJFW\GSAR.cfexe -if -s\:000M:000i:000c:000r:000o -r\:001M:000i:000c:000r:000o "~$folder.system$\cmd.exe" "~$folder.system$\cmd.execf"
C:\32788R22FWJFW\pv.exe -kf n.com
<SYSTEM32>\cmd.execf /c 32788R22FWJFW\prep.cmd
C:\32788R22FWJFW\unzip.cfexe -ojCq "32788R22FWJFW\License\pv_5_2_2.zip" pv.exe -d "C:\32788R22FWJFW"
C:\32788R22FWJFW\n.com cmdwait 2500 exec hide "~$folder.system$\cmd.execf" /c 32788R22FWJFW\prep.cmd
<SYSTEM32>\cmd.execf /c 32788R22FWJFW\prep.cmd >\Bug.txt
C:\32788R22FWJFW\swreg.exe acl "hklm\software\microsoft\windows nt\currentversion\windows" /DE:F /Q
C:\32788R22FWJFW\swreg.exe acl "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32" /da:r /q
C:\32788R22FWJFW\hidec.exe 32788R22FWJFW\swreg.exe import 32788R22FWJFW\EXE.reg
C:\32788R22FWJFW\hidec.exe 32788R22FWJFW\swreg.exe acl "HKLM\SOFTWARE\Microsoft\Command Processor" /reset /q
C:\32788R22FWJFW\n.com shexec install 32788R22FWJFW\Prep.inf
C:\32788R22FWJFW\hidec.exe 32788R22FWJFW\swreg.exe acl "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32" /da:r /q
C:\32788R22FWJFW\swreg.exe acl "hklm\software\microsoft\windows nt\currentversion\windows" /O Guest /Q
C:\32788R22FWJFW\n.com cmdwait 150 exec hide 32788R22FWJFW\SWREG.exe acl "hklm\software\microsoft\windows nt\currentversion\windows" /DE:F /Q
C:\32788R22FWJFW\n.com exec hide 32788R22FWJFW\SWREG.exe acl "hklm\software\microsoft\windows nt\currentversion\windows" /O Guest /Q
C:\32788R22FWJFW\swreg.exe acl "HKLM\SOFTWARE\Microsoft\Command Processor" /reset /q
C:\32788R22FWJFW\swreg.exe import 32788R22FWJFW\EXE.reg
C:\32788R22FWJFW\swreg.exe ADD "hklm\software\microsoft\windows\currentversion\app paths\combofix.exe" /ve /d "<Full path to virus>"
C:\32788R22FWJFW\swreg.exe QUERY "hklm\software\microsoft\windows nt\currentversion\winlogon" /v Userinit
C:\32788R22FWJFW\swreg.exe QUERY "hklm\software\microsoft\windows\currentversion\app paths\combofix.exe" /ve
C:\32788R22FWJFW\sed.cfexe -r "/^ (aux|midi|mixer|wave)([1-9]\t|\t).*:\\/I!d;" temp00
C:\32788R22FWJFW\grep.cfexe -Fsq :\ temp01
C:\32788R22FWJFW\swreg.exe ADD HKCU\Console /V CodePage /T REG_DWORD /D "1251"
C:\32788R22FWJFW\swreg.exe ADD HKU\S-1-5-18\Console /V CodePage /T REG_DWORD /D "1251"
C:\32788R22FWJFW\sed.cfexe "/.*\t/!d; s//@CHCP.com /" NlsCodePageACP00
C:\32788R22FWJFW\grep.cfexe -Fisq "<SYSTEM32>\userinit.exe" Userinit00
C:\32788R22FWJFW\swreg.exe QUERY "HKLM\SYSTEM\CurrentControlSet\Control\Nls\CodePage" /V ACP
C:\32788R22FWJFW\swreg.exe QUERY "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32"
C:\32788R22FWJFW\grep.cfexe -isq "ProductType.*WinNT" WinNT00
C:\32788R22FWJFW\n.com win close class "#32770"
C:\32788R22FWJFW\swreg.exe query "hklm\system\currentcontrolset\control\productoptions" /v ProductType
C:\32788R22FWJFW\grep.cfexe -F "5.2." OsVer
C:\32788R22FWJFW\grep.cfexe -F "5.1.2" OsVer
C:\32788R22FWJFW\grep.cfexe -Fivsf md5sum.pif mdCheck02
C:\32788R22FWJFW\pev.cfexe -rtf --c:#@SET chksum=#5# .\md5sum.pif
C:\32788R22FWJFW\pev.cfexe -rtf --c:##5#b#f# .\* and not { \md5sum.pif or \OsVer* or \mdCheck0? or \temp0? or *.chm or \Oldsfxname00 or \sfx.cmd or \FileName or \Mui0? or \CatchDeny or \d-del_A.dat or \NlsLanguageDefault or \CHCP.bat or \Thumbs.db }
C:\32788R22FWJFW\n.com win close ititle "ComboFix"
C:\32788R22FWJFW\pev.cfexe -rtf --c:##5# .\License.exe OR .\32788R22FWJFW.exe or \Bootsect.exe \OsVer.exe or \WinNT.exe or \N_.exe

Executes the following:

<SYSTEM32>\findstr.exe -EI "14" NlsLanguageDefault
<SYSTEM32>\findstr.exe -EI "1D" NlsLanguageDefault
<SYSTEM32>\cscript.exe //NOLOGO //E:VBSCRIPT //B //T:08 av.vbs
<SYSTEM32>\findstr.exe -EI "06" NlsLanguageDefault
<SYSTEM32>\findstr.exe -EI "05" NlsLanguageDefault
<SYSTEM32>\findstr.exe -EI "15" NlsLanguageDefault
<SYSTEM32>\findstr.exe -EI "0B" NlsLanguageDefault
<SYSTEM32>\ping.exe -n 1 -w 250 127.0.0.1
<SYSTEM32>\ping.exe -n 2 -w 500 google.com
<SYSTEM32>\sort.exe Mirrors00
<SYSTEM32>\attrib.exe -H -S "\32788R22FWJFW\*"
<SYSTEM32>\findstr.exe -C:"*On-access scanning enabled*" Resident.txt
<SYSTEM32>\findstr.exe -IVX ComboFix
<SYSTEM32>\findstr.exe -LIXC:"<Virus name>" DirName00
<SYSTEM32>\attrib.exe +R "<Full path to virus>"
<SYSTEM32>\chcp.com 1251
<SYSTEM32>\findstr.exe -EI "09" NlsLanguageDefault
<SYSTEM32>\findstr.exe -BV !MD5: mdCheck00
<SYSTEM32>\rundll32.exe setupapi,InstallHinfSection DefaultInstall 132 C:\32788R22FWJFW\Prep.inf
<SYSTEM32>\runonce.exe -r
<SYSTEM32>\grpconv.exe -o
<SYSTEM32>\findstr.exe -EI "07" NlsLanguageDefault
<SYSTEM32>\findstr.exe -EI "16" NlsLanguageDefault
<SYSTEM32>\findstr.exe -EI "10" NlsLanguageDefault
<SYSTEM32>\findstr.exe -EI "[08]04" NlsLanguageDefault
<SYSTEM32>\findstr.exe -EI "0C" NlsLanguageDefault
<SYSTEM32>\findstr.exe -EI "13" NlsLanguageDefault
<SYSTEM32>\findstr.exe -EI "[4C]04" NlsLanguageDefault

Modifies file system :

Creates the following files:

C:\32788R22FWJFW\run2.sed
C:\32788R22FWJFW\RegDo.sed
C:\32788R22FWJFW\toolbar.sed
C:\32788R22FWJFW\av.vbs
C:\32788R22FWJFW\DPF.str
C:\32788R22FWJFW\REGDACL.sed
C:\32788R22FWJFW\md5sum.pif
C:\32788R22FWJFW\srizbi.md5
C:\32788R22FWJFW\Exe.reg
C:\32788R22FWJFW\embedded.sed
C:\32788R22FWJFW\ddsDo.sed
C:\32788R22FWJFW\FProps.vbs
<SYSTEM32>\cmd.execf
C:\32788R22FWJFW\License\streamtools.zip
C:\32788R22FWJFW\pv.exe
C:\32788R22FWJFW\Nircmd.com
C:\Bug.txt
C:\32788R22FWJFW\License\pv_5_2_2.zip
C:\32788R22FWJFW\OSid.vbs
C:\32788R22FWJFW\lnkread.vbs
C:\32788R22FWJFW\restore_pt.vbs
C:\32788R22FWJFW\image001.gif
C:\32788R22FWJFW\SvcDrv.vbs
C:\32788R22FWJFW\safeboot.dat
C:\32788R22FWJFW\rogues.dat
C:\32788R22FWJFW\safeboot.def.dat
C:\32788R22FWJFW\svc_wht.dat
C:\32788R22FWJFW\safeboot.def.vista.dat
C:\32788R22FWJFW\region.dat
C:\32788R22FWJFW\netsvc.xp.dat
C:\32788R22FWJFW\netsvc.vista.dat
C:\32788R22FWJFW\NetworkService.dat
C:\32788R22FWJFW\Purity.dat
C:\32788R22FWJFW\Policies.dat
C:\32788R22FWJFW\svchost.dat
C:\32788R22FWJFW\ERDNT.e_e
C:\32788R22FWJFW\zhsvc.dat
C:\32788R22FWJFW\ERDNTDOS.LOC
C:\32788R22FWJFW\ERUNT.LOC
C:\32788R22FWJFW\ERDNTWIN.LOC
C:\32788R22FWJFW\zDomain.dat
C:\32788R22FWJFW\system_ini.dat
C:\32788R22FWJFW\svchost.vista.dat
C:\32788R22FWJFW\vistareg.dat
C:\32788R22FWJFW\xpreg.dat
C:\32788R22FWJFW\w2kreg.dat
C:\32788R22FWJFW\pev.cfexe
C:\<Virus name>\SWREG.cfexe
C:\<Virus name>\CCS.bat
C:\<Virus name>\N_\25703
C:\<Virus name>\kmd.dat
C:\<Virus name>\N_\23492
C:\<Virus name>\CurrentCS00
C:\<Virus name>\N_\10285
C:\<Virus name>\FINDSTR.cfexe
C:\<Virus name>\Attrib.cfexe
C:\Qoobox\Quarantine\catchme.log
C:\<Virus name>\N_\4307
C:\<Virus name>\erunt.dat
C:\<Virus name>\N_\8085
C:\<Virus name>\Mirrors
C:\<Virus name>\N_\8295
C:\<Virus name>\N_\12831
C:\<Virus name>\N_\5138
C:\<Virus name>\Mirrors00
C:\<Virus name>\ForeignC00
C:\<Virus name>\ForeignWht
C:\<Virus name>\N_\26848
C:\<Virus name>\N_\13080
C:\<Virus name>\N_\26139
C:\32788R22FWJFW\N_\4994
C:\32788R22FWJFW\temp00
C:\32788R22FWJFW\Oldsfxname00
C:\32788R22FWJFW\NlsCodePageACP00
C:\32788R22FWJFW\Userinit00
C:\32788R22FWJFW\md501.bat
C:\32788R22FWJFW\WinNT00
C:\32788R22FWJFW\OsVer
C:\32788R22FWJFW\N_\N
C:\32788R22FWJFW\mdCheck02
C:\32788R22FWJFW\mdCheck00
C:\32788R22FWJFW\CHCP.bat
C:\32788R22FWJFW\DirName00
C:\32788R22FWJFW\FileName
C:\32788R22FWJFW\SF.exe
C:\<Virus name>\N_\11964
C:\Start_.cmd
C:\32788R22FWJFW\N_\5380
C:\32788R22FWJFW\NlsLanguage00
C:\32788R22FWJFW\N_\11146
C:\32788R22FWJFW\NlsLanguageDefault
<SYSTEM32>\CF11654.exe
C:\32788R22FWJFW\sfx.cmd
C:\32788R22FWJFW\netsvc.dat
C:\32788R22FWJFW\Catch-sub.cmd
C:\32788R22FWJFW\Boot-Rk.cmd
C:\32788R22FWJFW\CF-Script.cmd
C:\32788R22FWJFW\CregC.cmd
C:\32788R22FWJFW\Create.cmd
C:\32788R22FWJFW\AWF.cmd
C:\32788R22FWJFW\SetEnvmt.bat
C:\32788R22FWJFW\SafeBootRepair.bat
C:\32788R22FWJFW\Assoc.cmd
C:\32788R22FWJFW\av.cmd
C:\32788R22FWJFW\Auto-RC.cmd
C:\32788R22FWJFW\CSet.cmd
C:\32788R22FWJFW\Prep.cmd
C:\32788R22FWJFW\NT-OS.cmd
C:\32788R22FWJFW\RegScan.cmd
C:\32788R22FWJFW\SnapShot.cmd
C:\32788R22FWJFW\Rkey.cmd
C:\32788R22FWJFW\Kill-All.cmd
C:\32788R22FWJFW\FKMGen.cmd
C:\32788R22FWJFW\FD-SV.cmd
C:\32788R22FWJFW\GetHive.cmd
C:\32788R22FWJFW\katch.cmd
C:\32788R22FWJFW\Install-RC.cmd
C:\32788R22FWJFW\Boot.bat
C:\32788R22FWJFW\License\UnxUtilsDist.html
C:\32788R22FWJFW\c.bat
C:\32788R22FWJFW\DelClsid.bat
C:\32788R22FWJFW\Combobatch.bat
C:\32788R22FWJFW\License\Zip - license.txt
C:\32788R22FWJFW\License\dumphive-license.txt
C:\32788R22FWJFW\License\Curl - license.txt
C:\32788R22FWJFW\License\EXTRACT.TXT
C:\32788R22FWJFW\License\mtee.txt.txt
C:\32788R22FWJFW\License\FI - license.txt
C:\32788R22FWJFW\FIND3M.bat
C:\32788R22FWJFW\List.bat
C:\32788R22FWJFW\List-D.bat
C:\32788R22FWJFW\MoveIt.bat
C:\32788R22FWJFW\RestoreO4.bat
C:\32788R22FWJFW\ND_.bat
C:\32788R22FWJFW\List-C.bat
C:\32788R22FWJFW\history.bat
C:\32788R22FWJFW\FIXLSP.bat
C:\32788R22FWJFW\Kollect.bat
C:\32788R22FWJFW\List-B.bat
C:\32788R22FWJFW\Lang.bat
C:\32788R22FWJFW\SRestore.cmd
C:\32788R22FWJFW\swsc.cfexe
C:\32788R22FWJFW\setpath.cfexe
C:\32788R22FWJFW\swxcacls.cfexe
C:\32788R22FWJFW\unzip.cfexe
C:\32788R22FWJFW\tail.cfexe
C:\32788R22FWJFW\sed.cfexe
C:\32788R22FWJFW\mtee.cfexe
C:\32788R22FWJFW\moveex.cfexe
C:\32788R22FWJFW\NirCmd.cfexe
C:\32788R22FWJFW\psexec.cfexe
C:\32788R22FWJFW\NirCmdC.cfexe
C:\32788R22FWJFW\zip.cfexe
C:\32788R22FWJFW\LocalServiceNetworkRestricted.dat
C:\32788R22FWJFW\LocalService.dat
C:\32788R22FWJFW\LocalSystemNetworkRestricted.dat
C:\32788R22FWJFW\netsvc.bad.dat
C:\32788R22FWJFW\ndis_combofix.dat
C:\32788R22FWJFW\Fin.dat
C:\32788R22FWJFW\023.dat
C:\32788R22FWJFW\NirCmd.chm
C:\32788R22FWJFW\023v.dat
C:\32788R22FWJFW\CregC.dat
C:\32788R22FWJFW\Creg.dat
C:\32788R22FWJFW\pev.exe
C:\32788R22FWJFW\hidec.exe
C:\32788R22FWJFW\swreg.exe
C:\32788R22FWJFW\Combo-Fix.sys
C:\32788R22FWJFW\ffdefstr.dll
C:\32788R22FWJFW\n.com
C:\32788R22FWJFW\Update-CF.cmd
C:\32788R22FWJFW\SuppScan.cmd
C:\32788R22FWJFW\badclsid.c
C:\32788R22FWJFW\Prep.inf
C:\32788R22FWJFW\clsid.c
C:\32788R22FWJFW\BootSect
C:\32788R22FWJFW\extract.cfexe
C:\32788R22FWJFW\ERUNT.cfexe
C:\32788R22FWJFW\grep.cfexe
C:\32788R22FWJFW\handle.cfexe
C:\32788R22FWJFW\gsar.cfexe
C:\32788R22FWJFW\dumphive.cfexe
C:\32788R22FWJFW\appinit.bad
C:\32788R22FWJFW\RCLink
C:\32788R22FWJFW\catchme.cfexe
C:\32788R22FWJFW\dd.cfexe
C:\32788R22FWJFW\ComboFix-Download.cfexe

Deletes the following files:

C:\32788R22FWJFW\License\Zip - license.txt
C:\32788R22FWJFW\License\UnxUtilsDist.html
C:\32788R22FWJFW\N_\4994
C:\32788R22FWJFW\N_\11146
C:\32788R22FWJFW\License\mtee.txt.txt
C:\32788R22FWJFW\License\FI - license.txt
C:\32788R22FWJFW\License\streamtools.zip
C:\32788R22FWJFW\License\pv_5_2_2.zip
C:\32788R22FWJFW\N_\5380
C:\<Virus name>\ForeignC00
<SYSTEM32>\cmd.execf
C:\<Virus name>\Update-CF.cmd
C:\<Virus name>\Mirrors00
C:\<Virus name>\CurrentCS00
C:\32788R22FWJFW\N_\N
C:\Start_.cmd
C:\Bug.txt
C:\32788R22FWJFW\temp00
C:\32788R22FWJFW\md501.bat
C:\32788R22FWJFW\Userinit00
C:\32788R22FWJFW\NirCmd.chm
C:\32788R22FWJFW\WinNT00
C:\32788R22FWJFW\pv.exe
C:\32788R22FWJFW\mdCheck02
C:\32788R22FWJFW\mdCheck00
C:\32788R22FWJFW\NlsCodePageACP00
C:\32788R22FWJFW\License\Curl - license.txt
C:\32788R22FWJFW\Prep.cmd
C:\32788R22FWJFW\License\EXTRACT.TXT
C:\32788R22FWJFW\License\dumphive-license.txt
C:\32788R22FWJFW\FileName
C:\32788R22FWJFW\NlsLanguage00
C:\32788R22FWJFW\Oldsfxname00
C:\32788R22FWJFW\DirName00

Moves the following files:

from C:\32788R22FWJFW\Prep.inf to C:\<Virus name>\Prep.inf
from C:\32788R22FWJFW\Policies.dat to C:\<Virus name>\Policies.dat
from C:\32788R22FWJFW\Purity.dat to C:\<Virus name>\Purity.dat
from C:\32788R22FWJFW\psexec.cfexe to C:\<Virus name>\psexec.cfexe
from C:\32788R22FWJFW\OsVer to C:\<Virus name>\OsVer
from C:\32788R22FWJFW\OSid.vbs to C:\<Virus name>\OSid.vbs
from C:\32788R22FWJFW\pev.exe to C:\<Virus name>\pev.exe
from C:\32788R22FWJFW\pev.cfexe to C:\<Virus name>\pev.cfexe
from C:\32788R22FWJFW\RestoreO4.bat to C:\<Virus name>\RestoreO4.bat
from C:\32788R22FWJFW\RegScan.cmd to C:\<Virus name>\RegScan.cmd
from C:\32788R22FWJFW\Rkey.cmd to C:\<Virus name>\Rkey.cmd
from C:\32788R22FWJFW\restore_pt.vbs to C:\<Virus name>\restore_pt.vbs
from C:\32788R22FWJFW\REGDACL.sed to C:\<Virus name>\REGDACL.sed
from C:\32788R22FWJFW\RCLink to C:\<Virus name>\RCLink
from C:\32788R22FWJFW\region.dat to C:\<Virus name>\region.dat
from C:\32788R22FWJFW\RegDo.sed to C:\<Virus name>\RegDo.sed
from C:\32788R22FWJFW\NT-OS.cmd to C:\<Virus name>\NT-OS.cmd
from C:\32788R22FWJFW\ndis_combofix.dat to C:\<Virus name>\ndis_combofix.dat
from C:\32788R22FWJFW\n.com to C:\<Virus name>\n.com
from C:\32788R22FWJFW\netsvc.bad.dat to C:\<Virus name>\netsvc.bad.dat
from C:\32788R22FWJFW\ND_.bat to C:\<Virus name>\ND_.bat
from C:\32788R22FWJFW\moveex.cfexe to C:\<Virus name>\moveex.cfexe
from C:\32788R22FWJFW\md5sum.pif to C:\<Virus name>\md5sum.pif
from C:\32788R22FWJFW\mtee.cfexe to C:\<Virus name>\mtee.cfexe
from C:\32788R22FWJFW\MoveIt.bat to C:\<Virus name>\MoveIt.bat
from C:\32788R22FWJFW\Nircmd.com to C:\<Virus name>\Nircmd.com
from C:\32788R22FWJFW\NirCmd.cfexe to C:\<Virus name>\NirCmd.cfexe
from C:\32788R22FWJFW\NlsLanguageDefault to C:\<Virus name>\NlsLanguageDefault
from C:\32788R22FWJFW\NirCmdC.cfexe to C:\<Virus name>\NirCmdC.cfexe
from C:\32788R22FWJFW\netsvc.vista.dat to C:\<Virus name>\netsvc.vista.dat
from C:\32788R22FWJFW\netsvc.dat to C:\<Virus name>\netsvc.dat
from C:\32788R22FWJFW\NetworkService.dat to C:\<Virus name>\NetworkService.dat
from C:\32788R22FWJFW\netsvc.xp.dat to C:\<Virus name>\netsvc.xp.dat
from C:\32788R22FWJFW\system_ini.dat to C:\<Virus name>\system_ini.dat
from C:\32788R22FWJFW\swxcacls.cfexe to C:\<Virus name>\swxcacls.cfexe
from C:\32788R22FWJFW\toolbar.sed to C:\<Virus name>\toolbar.sed
from C:\32788R22FWJFW\tail.cfexe to C:\<Virus name>\tail.cfexe
from C:\32788R22FWJFW\svc_wht.dat to C:\<Virus name>\svc_wht.dat
from C:\32788R22FWJFW\svchost.vista.dat to C:\<Virus name>\svchost.vista.dat
from C:\32788R22FWJFW\swsc.cfexe to C:\<Virus name>\swsc.cfexe
from C:\32788R22FWJFW\swreg.exe to C:\<Virus name>\swreg.exe
from C:\32788R22FWJFW\zDomain.dat to C:\<Virus name>\zDomain.dat
from C:\32788R22FWJFW\xpreg.dat to C:\<Virus name>\xpreg.dat
from C:\32788R22FWJFW\zip.cfexe to C:\<Virus name>\zip.cfexe
from C:\32788R22FWJFW\zhsvc.dat to C:\<Virus name>\zhsvc.dat
from C:\32788R22FWJFW\Update-CF.cmd to C:\<Virus name>\Update-CF.cmd
from C:\32788R22FWJFW\unzip.cfexe to C:\<Virus name>\unzip.cfexe
from C:\32788R22FWJFW\w2kreg.dat to C:\<Virus name>\w2kreg.dat
from C:\32788R22FWJFW\vistareg.dat to C:\<Virus name>\vistareg.dat
from C:\32788R22FWJFW\svchost.dat to C:\<Virus name>\svchost.dat
from C:\32788R22FWJFW\SafeBootRepair.bat to C:\<Virus name>\SafeBootRepair.bat
from C:\32788R22FWJFW\safeboot.def.vista.dat to C:\<Virus name>\safeboot.def.vista.dat
from C:\32788R22FWJFW\SetEnvmt.bat to C:\<Virus name>\SetEnvmt.bat
from C:\32788R22FWJFW\sed.cfexe to C:\<Virus name>\sed.cfexe
from C:\32788R22FWJFW\run2.sed to C:\<Virus name>\run2.sed
from C:\32788R22FWJFW\rogues.dat to C:\<Virus name>\rogues.dat
from C:\32788R22FWJFW\safeboot.def.dat to C:\<Virus name>\safeboot.def.dat
from C:\32788R22FWJFW\safeboot.dat to C:\<Virus name>\safeboot.dat
from C:\32788R22FWJFW\srizbi.md5 to C:\<Virus name>\srizbi.md5
from C:\32788R22FWJFW\SRestore.cmd to C:\<Virus name>\SRestore.cmd
from C:\32788R22FWJFW\SvcDrv.vbs to C:\<Virus name>\SvcDrv.vbs
from C:\32788R22FWJFW\SuppScan.cmd to C:\<Virus name>\SuppScan.cmd
from C:\32788R22FWJFW\SF.exe to C:\<Virus name>\SF.exe
from C:\32788R22FWJFW\setpath.cfexe to C:\<Virus name>\setpath.cfexe
from C:\32788R22FWJFW\SnapShot.cmd to C:\<Virus name>\SnapShot.cmd
from C:\32788R22FWJFW\sfx.cmd to C:\<Virus name>\sfx.cmd
from C:\32788R22FWJFW\Creg.dat to C:\<Virus name>\Creg.dat
from C:\32788R22FWJFW\Create.cmd to C:\<Virus name>\Create.cmd
from C:\32788R22FWJFW\CregC.dat to C:\<Virus name>\CregC.dat
from C:\32788R22FWJFW\CregC.cmd to C:\<Virus name>\CregC.cmd
from C:\32788R22FWJFW\Combo-Fix.sys to C:\<Virus name>\Combo-Fix.sys
from C:\32788R22FWJFW\clsid.c to C:\<Virus name>\clsid.c
from C:\32788R22FWJFW\ComboFix-Download.cfexe to C:\<Virus name>\ComboFix-Download.cfexe
from C:\32788R22FWJFW\Combobatch.bat to C:\<Virus name>\Combobatch.bat
from C:\32788R22FWJFW\dumphive.cfexe to C:\<Virus name>\dumphive.cfexe
from C:\32788R22FWJFW\DPF.str to C:\<Virus name>\DPF.str
from C:\32788R22FWJFW\ERDNT.e_e to C:\<Virus name>\ERDNT.e_e
from C:\32788R22FWJFW\embedded.sed to C:\<Virus name>\embedded.sed
from C:\32788R22FWJFW\dd.cfexe to C:\<Virus name>\dd.cfexe
from C:\32788R22FWJFW\CSet.cmd to C:\<Virus name>\CSet.cmd
from C:\32788R22FWJFW\DelClsid.bat to C:\<Virus name>\DelClsid.bat
from C:\32788R22FWJFW\ddsDo.sed to C:\<Virus name>\ddsDo.sed
from C:\32788R22FWJFW\CHCP.bat to C:\<Virus name>\CHCP.bat
from C:\32788R22FWJFW\av.cmd to C:\<Virus name>\av.cmd
from C:\32788R22FWJFW\Auto-RC.cmd to C:\<Virus name>\Auto-RC.cmd
from C:\32788R22FWJFW\AWF.cmd to C:\<Virus name>\AWF.cmd
from C:\32788R22FWJFW\av.vbs to C:\<Virus name>\av.vbs
from C:\32788R22FWJFW\023v.dat to C:\<Virus name>\023v.dat
from C:\32788R22FWJFW\023.dat to C:\<Virus name>\023.dat
from C:\32788R22FWJFW\Assoc.cmd to C:\<Virus name>\Assoc.cmd
from C:\32788R22FWJFW\appinit.bad to C:\<Virus name>\appinit.bad
from C:\32788R22FWJFW\Catch-sub.cmd to C:\<Virus name>\Catch-sub.cmd
from C:\32788R22FWJFW\c.bat to C:\<Virus name>\c.bat
from C:\32788R22FWJFW\CF-Script.cmd to C:\<Virus name>\CF-Script.cmd
from C:\32788R22FWJFW\catchme.cfexe to C:\<Virus name>\catchme.cfexe
from C:\32788R22FWJFW\Boot-Rk.cmd to C:\<Virus name>\Boot-Rk.cmd
from C:\32788R22FWJFW\badclsid.c to C:\<Virus name>\badclsid.c
from C:\32788R22FWJFW\BootSect to C:\<Virus name>\BootSect
from C:\32788R22FWJFW\Boot.bat to C:\<Virus name>\Boot.bat
from C:\32788R22FWJFW\Kill-All.cmd to C:\<Virus name>\Kill-All.cmd
from C:\32788R22FWJFW\katch.cmd to C:\<Virus name>\katch.cmd
from C:\32788R22FWJFW\Lang.bat to C:\<Virus name>\Lang.bat
from C:\32788R22FWJFW\Kollect.bat to C:\<Virus name>\Kollect.bat
from C:\32788R22FWJFW\history.bat to C:\<Virus name>\history.bat
from C:\32788R22FWJFW\hidec.exe to C:\<Virus name>\hidec.exe
from C:\32788R22FWJFW\Install-RC.cmd to C:\<Virus name>\Install-RC.cmd
from C:\32788R22FWJFW\image001.gif to C:\<Virus name>\image001.gif
from C:\32788R22FWJFW\LocalService.dat to C:\<Virus name>\LocalService.dat
from C:\32788R22FWJFW\lnkread.vbs to C:\<Virus name>\lnkread.vbs
from C:\32788R22FWJFW\LocalSystemNetworkRestricted.dat to C:\<Virus name>\LocalSystemNetworkRestricted.dat
from C:\32788R22FWJFW\LocalServiceNetworkRestricted.dat to C:\<Virus name>\LocalServiceNetworkRestricted.dat
from C:\32788R22FWJFW\List-C.bat to C:\<Virus name>\List-C.bat
from C:\32788R22FWJFW\List-B.bat to C:\<Virus name>\List-B.bat
from C:\32788R22FWJFW\List.bat to C:\<Virus name>\List.bat
from C:\32788R22FWJFW\List-D.bat to C:\<Virus name>\List-D.bat
from C:\32788R22FWJFW\handle.cfexe to C:\<Virus name>\handle.cfexe
from C:\32788R22FWJFW\extract.cfexe to C:\<Virus name>\extract.cfexe
from C:\32788R22FWJFW\Exe.reg to C:\<Virus name>\Exe.reg
from C:\32788R22FWJFW\ffdefstr.dll to C:\<Virus name>\ffdefstr.dll
from C:\32788R22FWJFW\FD-SV.cmd to C:\<Virus name>\FD-SV.cmd
from C:\32788R22FWJFW\ERDNTWIN.LOC to C:\<Virus name>\ERDNTWIN.LOC
from C:\32788R22FWJFW\ERDNTDOS.LOC to C:\<Virus name>\ERDNTDOS.LOC
from C:\32788R22FWJFW\ERUNT.LOC to C:\<Virus name>\ERUNT.LOC
from C:\32788R22FWJFW\ERUNT.cfexe to C:\<Virus name>\ERUNT.cfexe
from C:\32788R22FWJFW\GetHive.cmd to C:\<Virus name>\GetHive.cmd
from C:\32788R22FWJFW\FProps.vbs to C:\<Virus name>\FProps.vbs
from C:\32788R22FWJFW\gsar.cfexe to C:\<Virus name>\gsar.cfexe
from C:\32788R22FWJFW\grep.cfexe to C:\<Virus name>\grep.cfexe
from C:\32788R22FWJFW\FIND3M.bat to C:\<Virus name>\FIND3M.bat
from C:\32788R22FWJFW\Fin.dat to C:\<Virus name>\Fin.dat
from C:\32788R22FWJFW\FKMGen.cmd to C:\<Virus name>\FKMGen.cmd
from C:\32788R22FWJFW\FIXLSP.bat to C:\<Virus name>\FIXLSP.bat

Network activity:

Connects to:

'75.##7.69.91':80
'74.##7.128.223':80
'20#.#3.120.24':80

TCP:

HTTP GET requests:

75.##7.69.91/sUBs/version.txt
74.##7.128.223/sUBs/version.txt
20#.#3.120.24/sUBs/version.txt

UDP:

DNS ASK google.com

Miscellaneous:

Searches for the following windows:

ClassName: 'Shell_TrayWnd' WindowName: ''
ClassName: 'EDIT' WindowName: ''

Tecnologie

Termini

Formazione ed informazione

Falsi miti

Technical Information

Curing recommendations

Free trial