Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SYSTEM\ControlSet001\Control\Print\Providers\Splhlp] 'Name' = '%ALLUSERSPROFILE%\Documents\zx.dll'
Substitutes the following executable system files:
- <SYSTEM32>\winlogon.exe with <SYSTEM32>\temp.tmp
- %WINDIR%\explorer.exe with %WINDIR%\temp.tmp
Malicious functions:
Injects code into
the following system processes:
- <SYSTEM32>\spoolsv.exe
Modifies file system :
Creates the following files:
- <SYSTEM32>\zx.dll
- %WINDIR%\temp.tmp
- <SYSTEM32>\temp.tmp
- %ALLUSERSPROFILE%\Documents\dll
- %ALLUSERSPROFILE%\Documents\zx.dll
- <SYSTEM32>\dll
Deletes the following files:
- %ALLUSERSPROFILE%\Documents\zx.dll
- %ALLUSERSPROFILE%\Documents\dll
Moves the following system files:
- from <SYSTEM32>\winlogon.exe to %WINDIR%\Temp\winlogon.dat
- from %WINDIR%\explorer.exe to %WINDIR%\Temp\explorer.dat
Moves itself:
- from <Full path to virus> to %ALLUSERSPROFILE%\Documents\19792079
Deletes itself.
