Technical Information
To ensure autorun and distribution:
Infects the following executable system files:
- <SYSTEM32>\msscript.ocx
Substitutes the following executable system files:
- <SYSTEM32>\dllcache\msscript.ocx with <SYSTEM32>\dllcache\msscript.ocx.new
Malicious functions:
Installs hooks to intercept notifications
on keystrokes:
- Handler for all processes: <SYSTEM32>\gwubi.dll
Modifies file system :
Creates the following files:
- <Current directory>\gwubi.dll
- <SYSTEM32>\gwubi.dll
- %WINDIR%\QMDispatch.dll
- <Current directory>\rename.ini
- %TEMP%\macroinfo.dat
- <Current directory>\mymacro.gif
- %TEMP%\2.01.tmp
- %TEMP%\macro0.tmp
- <Current directory>\mymacro.htm
- <Current directory>\WinIo.dll
- <Current directory>\stdlib.vbs
- <Current directory>\WINIO.VXD
- <Current directory>\WinIo.sys
- <Current directory>\QMDispatch.dll
- <Current directory>\cfgdll.dll
- <Current directory>\BException.dll
- <Current directory>\hknm.sys
- <Current directory>\helper.dll
Deletes the following files:
- %TEMP%\macro0.tmp
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
