Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\netservice142] 'Startup' = 'Startup'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\netservice142] 'DllName' = '%ProgramFiles%\netmeeting\netservice142.dll'
Malicious functions:
Executes the following:
- '<SYSTEM32>\net1.exe' stop SharedAccess
- '<SYSTEM32>\net.exe' stop SharedAccess
Injects code into
the following system processes:
- %WINDIR%\Explorer.EXE
- <SYSTEM32>\winlogon.exe
the following user processes:
- iexplore.exe
Modifies file system:
Creates the following files:
- %ProgramFiles%\NetMeeting\netservice142.dll
Network activity:
Connects to:
- '74.##5.232.51':80
TCP:
HTTP GET requests:
- http:/// via 74.##5.232.51
UDP:
- DNS ASK www.google.com
