Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Classes\.exe] '' = 'jpegfile'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'ОТµДЖф¶ЇПо' = '<Current directory>\CYX777.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'kiss770.cn' = '<Full path to virus>'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Explore.exe' = '<SYSTEM32>\0.vbs'
Malicious functions:
To complicate detection of its presence in the operating system,
forces the system hide from view:
- hidden files
blocks execution of the following system utilities:
- Command Prompt (CMD)
- Windows Task Manager (Taskmgr)
- Registry Editor (RegEdit)
Executes the following:
- <SYSTEM32>\taskkill.exe /f /im 360tray.exe
- <SYSTEM32>\taskkill.exe /f /im VsTskMgr.exe
- <SYSTEM32>\wbem\wmiadap.exe /R /T
- <SYSTEM32>\cmd.exe /c <SYSTEM32>\reg.bat
- <SYSTEM32>\taskkill.exe /im /f explorer.exe
- <SYSTEM32>\taskkill.exe /f /im Mcshield.exe
- <SYSTEM32>\taskkill.exe /f /im kavsvc.exe
- %WINDIR%\explorer.exe
- <SYSTEM32>\taskkill.exe /f /im KVXP.kxp
- <SYSTEM32>\taskkill.exe /f /im Ravmon.exe
- <SYSTEM32>\taskkill.exe /f /im Rav.exe
Terminates or attempts to terminate
the following system processes:
- %WINDIR%\Explorer.EXE
the following user processes:
- iexplore.exe
Modifies settings of Windows Explorer:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoLogOff' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoFileMenu' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoFind' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoSetFolders' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoViewContextMenu' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoRecentDocsMenu' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoClose' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoDrives' = 'FFFFFFFF'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoRun' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoControlPanel' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoDesktop' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoFolderOptions' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoViewOnDrive' = 'FFFFFFFF'
Forces autoplay for removable media.
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system :
Creates the following files:
- <SYSTEM32>\reg.reg
- <SYSTEM32>\wscript.ico
- <SYSTEM32>\wbem\Performance\WmiApRpl_new.ini
- <SYSTEM32>\reg.bat
- C:\<Virus name>.exe
- <SYSTEM32>\1.ico
- <SYSTEM32>\0.bat
- <SYSTEM32>\0.vbs
Sets the 'hidden' attribute to the following files:
- <SYSTEM32>\0.bat
- <SYSTEM32>\0.vbs
Miscellaneous:
Searches for the following windows:
- ClassName: '' WindowName: ''
- ClassName: '' WindowName: 'iexplore.exe'
- ClassName: 'Proxy Desktop' WindowName: ''
- ClassName: '' WindowName: 'explorer.exe'
- ClassName: 'Shell_TrayWnd' WindowName: ''
