Technical Information
To ensure autorun and distribution:
Substitutes the following executable system files:
- <SYSTEM32>\dsound.dll with <SYSTEM32>\dsound.dll.dat
Malicious functions:
Executes the following:
- <SYSTEM32>\cmd.exe /c """%TEMP%\tempVidio.bat"" "
Modifies file system :
Creates the following files:
- %CommonProgramFiles%\System\kb247193.dla
- <SYSTEM32>\dsound.dll.dat
- %TEMP%\tempVidio.bat
- %TEMP%\Temp\6-22НёКУ.exe
- %TEMP%\Temp\yang611.exe
- %TEMP%\kb247193.sve
Sets the 'hidden' attribute to the following files:
- %CommonProgramFiles%\System\kb247193.dla
Deletes the following files:
- %TEMP%\Temp\yang611.exe
Moves the following system files:
- from <SYSTEM32>\dsound.dll to <SYSTEM32>\dsound.dll.WZEX
Miscellaneous:
Searches for the following windows:
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
