Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Update4' = '<Full path to virus>'
Malicious functions:
Terminates or attempts to terminate
the following user processes:
- iexplore.exe
Modifies file system:
Creates the following files:
- <SYSTEM32>\zlib1.dll
- <SYSTEM32>\ssleay32.dll
Network activity:
Connects to:
- '74.##5.232.51':80
- '20#.#2.89.232':80
- 'localhost':1039
TCP:
HTTP GET requests:
- http://www.google.com/ via 74.##5.232.51
- http://20#.#2.89.232/www/mc/dll/zlib1.dll
- http://20#.#2.89.232/www/mc/dll/ssleay32.dll
UDP:
- DNS ASK ASK www.google.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
