Technical Information
Malicious functions:
Terminates or attempts to terminate
the following user processes:
- firefox.exe
Modifies file system :
Creates the following files:
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\download[1].php
Network activity:
Connects to:
- 'localhost':1040
- 'sv#.####matichelperdtx.com':80
- 'wp#d':80
TCP:
HTTP GET requests:
- sv#.####matichelperdtx.com/uploads/download.php
- sv#.####matichelperdtx.com/js/config.jsp
- wp#d/wpad.dat
UDP:
- DNS ASK sv#.####matichelperdtx.com
- DNS ASK wp#d
Miscellaneous:
Searches for the following windows:
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'IEFrame' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
Modifies value of AutoConfigURL parameter
