Technical Information
Malicious functions:
Creates and executes the following:
- C:\Documents and Settings\one User\-2.exe
- C:\Documents and Settings\one User\-1.exe
Executes the following:
- <SYSTEM32>\taskkill.exe /F /IM YAHOOM~1.EXE
- <SYSTEM32>\wscript.exe <Drive name for removable media>:\Runtime.vbs
- <SYSTEM32>\taskkill.exe /F /IM YahooMessenger.exe
- <SYSTEM32>\taskkill.exe /F /IM Ymsgr_tray.exe
Terminates or attempts to terminate
the following user processes:
- YahooMessenger.exe
Forces autoplay for removable media.
Modifies file system :
Creates the following files:
- C:\Documents and Settings\one User\-4.exe
- %ALLUSERSPROFILE%\Desktop\Yahoo! Messenger.lnk
- C:\Documents and Settings\one User\-1.exe
- C:\Documents and Settings\one User\-2.exe
- C:\Documents and Settings\one User\-3.exe
Miscellaneous:
Searches for the following windows:
- ClassName: '' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
