Technical Information
Malicious functions:
To complicate detection of its presence in the operating system,
blocks the following features:
- User Account Control (UAC)
Executes the following:
- '<SYSTEM32>\ntvdm.exe' -f -i1
Modifies file system:
Creates the following files:
- %WINDIR%\Temp\scs1.tmp
- %WINDIR%\Temp\scs2.tmp
- %TEMP%\~DFEED7.tmp
- %TEMP%\GoogleUpdater.exe
- %TEMP%\my\zip.exe
Deletes the following files:
- %WINDIR%\Temp\scs2.tmp
- %WINDIR%\Temp\scs1.tmp
Network activity:
Connects to:
- 'bi###forum.com':80
- 'localhost':1037
TCP:
HTTP GET requests:
- http://bi###forum.com/GoogleUpdater.exe
UDP:
- DNS ASK bi###forum.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-b54.b58.380001'
