Technical Information
Malicious functions:
Creates and executes the following:
- 'C:\AdsFix\AF.exe'
- 'C:\AdsFix\AF.exe' (downloaded from the Internet)
Modifies file system :
Creates the following files:
- %TEMP%\aut8.tmp
- C:\AdsFix\Res\Virus.ico
- C:\AdsFix\Res\Sh_M.ico
- C:\AdsFix\streams.exe
- %TEMP%\aut7.tmp
- %TEMP%\aut9.tmp
- C:\AdsFix\upd
- C:\AdsFix\AF.exe
- C:\AdsFix\winlogon.exe
- C:\AdsFix\Res\Monster.ico
- %TEMP%\autA.tmp
- C:\AdsFix\svchost.exe
- %TEMP%\aut3.tmp
- %TEMP%\aut2.tmp
- %TEMP%\aut1.tmp
- C:\AdsFix\smss.exe
- C:\AdsFix\svchost.com
- C:\AdsFix\wininit.com
- %TEMP%\aut6.tmp
- %TEMP%\aut5.tmp
- %TEMP%\aut4.tmp
- C:\AdsFix\wininit.exe
Deletes the following files:
- %TEMP%\aut7.tmp
- %TEMP%\aut6.tmp
- %TEMP%\aut8.tmp
- %TEMP%\autA.tmp
- %TEMP%\aut9.tmp
- %TEMP%\aut2.tmp
- %TEMP%\aut1.tmp
- %TEMP%\aut3.tmp
- %TEMP%\aut5.tmp
- %TEMP%\aut4.tmp
Network activity:
Connects to:
- 'www.ah#.li':80
- 'www.te######ger.sosvirus.net':80
TCP:
HTTP GET requests:
- www.ah#.li/2159847/AdsFix.exe
- www.te######ger.sosvirus.net/gen-hackman/Update.Tools/upd.AdsFix
UDP:
- DNS ASK www.ah#.li
- DNS ASK www.te######ger.sosvirus.net
Miscellaneous:
Searches for the following windows:
- ClassName: 'BUTTON' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
