Technical Information
To ensure autorun and distribution:
Substitutes the following executable system files:
- <SYSTEM32>\dsound.dll with <SYSTEM32>\dsound.dll.dat
Malicious functions:
Executes the following:
- <SYSTEM32>\cmd.exe /c """%TEMP%\tempVidio.bat"" "
Modifies file system :
Creates the following files:
- %CommonProgramFiles%\System\kb098717.dla
- <SYSTEM32>\dsound.dll.dat
- %TEMP%\tempVidio.bat
- %TEMP%\Temp\4-13xf.exe
- %TEMP%\Temp\111.exe
- %TEMP%\kb098717.sve
Sets the 'hidden' attribute to the following files:
- %CommonProgramFiles%\System\kb098717.dla
Deletes the following files:
- %TEMP%\Temp\111.exe
Moves the following system files:
- from <SYSTEM32>\dsound.dll to <SYSTEM32>\dsound.dll.KMGJ
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
