Trojan.Click2.54733

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'msg2' = 'E:\WINDOWS\system32\updater2\start.cmd'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'msg' = '<SYSTEM32>\updater\start.cmd'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'msg3' = 'F:\WINDOWS\system32\updater2\start.cmd'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'msg1' = '<Drive name for removable media>:\WINDOWS\system32\updater\start.cmd'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'msg' = '<SYSTEM32>\updater2\start.cmd'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'msg' = '<SYSTEM32>\updater3\start.cmd'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'msg1' = '<Drive name for removable media>:\WINDOWS\system32\updater2\start.cmd'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'msg1' = '<Drive name for removable media>:\WINDOWS\system32\updater3\start.cmd'

Malicious functions:

To bypass firewall, removes or modifies the following registry keys:

[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'DoNotAllowExceptions' = '00000000'
[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'

Creates and executes the following:

Executes the following:

'<SYSTEM32>\reg.exe' add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v msg /t REG_SZ /d <SYSTEM32>\updater\start.cmd /f
'<SYSTEM32>\reg.exe' add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v msg1 /t REG_SZ /d <Drive name for removable media>:\WINDOWS\system32\updater2\start.cmd /f
'<SYSTEM32>\reg.exe' add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v msg2 /t REG_SZ /d E:\WINDOWS\system32\updater2\start.cmd /f
'<SYSTEM32>\reg.exe' add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v msg3 /t REG_SZ /d F:\WINDOWS\system32\updater2\start.cmd /f
'<SYSTEM32>\reg.exe' add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v msg1 /t REG_SZ /d <Drive name for removable media>:\WINDOWS\system32\updater\start.cmd /f
'%PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE' http://av###.net.ua
'<SYSTEM32>\netsh.exe' firewall set opmode disable
'<SYSTEM32>\cmd.exe' /c ""<SYSTEM32>\updater\msg.bat" "
'<SYSTEM32>\reg.exe' add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v msg /t REG_SZ /d <SYSTEM32>\updater2\start.cmd /f
'<SYSTEM32>\reg.exe' add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v msg1 /t REG_SZ /d <Drive name for removable media>:\WINDOWS\system32\updater3\start.cmd /f
'<SYSTEM32>\reg.exe' add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v msg /t REG_SZ /d <SYSTEM32>\updater3\start.cmd /f

Modifies file system :

Creates the following files:

<SYSTEM32>\updater2\Config\Advanced\masters.txt
<SYSTEM32>\updater\wininit.exe
<SYSTEM32>\updater2\Config\hostnames.txt
<SYSTEM32>\updater2\Config\clcmds.txt
<SYSTEM32>\updater\config.txt
<SYSTEM32>\updater\Config\rules.txt
<SYSTEM32>\updater\start.cmd
<SYSTEM32>\updater\msg.bat
<SYSTEM32>\updater2\Config\mappings.txt
<SYSTEM32>\updater2\start.cmd
<SYSTEM32>\updater2\msg.bat
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\avril.net[1]
<SYSTEM32>\updater2\wininit.exe
<SYSTEM32>\updater2\Config\players.txt
<SYSTEM32>\updater2\Config\maps.txt
<SYSTEM32>\updater2\config.txt
<SYSTEM32>\updater2\Config\rules.txt
<SYSTEM32>\updater3\Config\players.txt
<SYSTEM32>\updater3\Config\maps.txt
<SYSTEM32>\updater3\config.txt
<SYSTEM32>\updater3\Config\rules.txt
<SYSTEM32>\updater3\Config\clcmds.txt
<SYSTEM32>\updater3\Config\Advanced\masters.txt
<SYSTEM32>\updater3\Config\mappings.txt
<SYSTEM32>\updater3\Config\hostnames.txt
<SYSTEM32>\updater3\msg.bat
<SYSTEM32>\updater\Config\mappings.txt
<SYSTEM32>\updater\Config\hostnames.txt
<SYSTEM32>\updater\Config\players.txt
<SYSTEM32>\updater\Config\maps.txt
<SYSTEM32>\updater3\svchost.exe
<SYSTEM32>\updater3\start.cmd
<SYSTEM32>\updater\Config\clcmds.txt
<SYSTEM32>\updater\Config\Advanced\masters.txt