Technical Information
Malicious functions:
Executes the following:
- '<SYSTEM32>\sc.exe' stop winmgmt
- '<SYSTEM32>\ntvdm.exe' -f -i1
Terminates or attempts to terminate
the following user processes:
- fsavgui.exe
- fsav32.exe
- bdagent.exe
- 360tray.exe
- zlclient.exe
- MCAGENT.EXE
- GUARD.EXE
- ccapp.exe
- AVP.EXE
- ekrn.exe
- spidernt.exe
- AVGCTRL.EXE
- avgcc.exe
Modifies file system :
Creates the following files:
- %WINDIR%\Temp\scs2.tmp
- %WINDIR%\Temp\scs1.tmp
Deletes the following files:
- %WINDIR%\Temp\scs2.tmp
- %WINDIR%\Temp\scs1.tmp
Miscellaneous:
Searches for the following windows:
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-9e4.9e8.380001'
