Technical Information
Malicious functions:
Creates and executes the following:
- '%PROGRAM_FILES%\Winsearchag\installwin.exe'
Executes the following:
- '<SYSTEM32>\cmd.exe' /c "%PROGRAM_FILES%\Winsearchag\unst.bat"
Modifies file system :
Creates the following files:
- %PROGRAM_FILES%\Winsearchag\Uninstall.exe
- %PROGRAM_FILES%\Winsearchag\cleversearchag.dll
- %PROGRAM_FILES%\Winsearchag\installwin.exe
- %PROGRAM_FILES%\Winsearchag\unst.bat
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\execute[1].php
- %PROGRAM_FILES%\Winsearchag\Uninstall.ini
- %PROGRAM_FILES%\Winsearchag\winsearchagdl.exe
- <SYSTEM32>\VB6KO.DLL
- %TEMP%\$inst\temp_0.tmp
- %TEMP%\$inst\2.tmp
- %PROGRAM_FILES%\Winsearchag\winsearchag.dll
- <SYSTEM32>\INETKO.DLL
- <SYSTEM32>\MSINET.OCX
Deletes the following files:
- %PROGRAM_FILES%\Winsearchag\installwin.exe
- %TEMP%\$inst\2.tmp
- %TEMP%\$inst\temp_0.tmp
Network activity:
Connects to:
- '12#.#8.93.46':80
- 'localhost':1035
TCP:
HTTP GET requests:
- 12#.#8.93.46/~serviceitem/execute.php?m_################################################################
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
