Technical Information
To ensure autorun and distribution:
Substitutes the following executable system files:
- <SYSTEM32>\dsound.dll with <SYSTEM32>\dsound.dll.dat
Malicious functions:
Executes the following:
- <SYSTEM32>\cmd.exe /c """%TEMP%\tempVidio.bat"" "
Modifies file system :
Creates the following files:
- <SYSTEM32>\dsound.dll.dat
- %TEMP%\Temp\JK14_testVC2008.exe
- %TEMP%\tempVidio.bat
- %CommonProgramFiles%\System\kb801668.dla
- %TEMP%\Temp\6ФВ23ИХCSOёьРВНёКУЧФГй.exe
- %TEMP%\Temp\cso.exe
- %TEMP%\kb801668.sve
Sets the 'hidden' attribute to the following files:
- %CommonProgramFiles%\System\kb801668.dla
Deletes the following files:
- %TEMP%\Temp\cso.exe
Moves the following system files:
- from <SYSTEM32>\dsound.dll to <SYSTEM32>\dsound.dll.YIDO
Miscellaneous:
Searches for the following windows:
- ClassName: 'Valve001' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
