Technical Information
Malicious functions:
Creates and executes the following:
- <SYSTEM32>\AppData.exe
Executes the following:
- <SYSTEM32>\cmd.exe /c ""%TEMP%\7ZSfx000.cmd" "
- <SYSTEM32>\cacls.exe "%APPDATA%/SogouExplorer/config.xml" /g %USERNAME%:r
- <SYSTEM32>\regini.exe regset_sd.ini
- <SYSTEM32>\ping.exe 127.0.0.1 -n 1
- <SYSTEM32>\regini.exe regset.ini
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system :
Creates the following files:
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\cwdgt0y8.default\search.sqlite
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\cwdgt0y8.default\secmod.db
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\cwdgt0y8.default\sessionstore.bak
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\cwdgt0y8.default\search.json
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\cwdgt0y8.default\places.sqlite
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\cwdgt0y8.default\pluginreg.dat
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\cwdgt0y8.default\prefs.js
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\cwdgt0y8.default\sessionstore.js
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\cwdgt0y8.default\bookmarkbackups\bookmarks-2011-11-10.json
- C:\Documents and Settings\Default User\Application Data\Microsoft\Windows\Themes\Custom.theme
- C:\Documents and Settings\Default User\Application Data\Microsoft\Media Player\0007F0B7.wpl
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\userContent-example.css
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\cwdgt0y8.default\signons.sqlite
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\cwdgt0y8.default\webappsstore.sqlite
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\userChrome-example.css
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\cwdgt0y8.default\compatibility.ini
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\cwdgt0y8.default\content-prefs.sqlite
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\cwdgt0y8.default\cookies.sqlite
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\cwdgt0y8.default\chromeappsstore.sqlite
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\profiles.ini
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\cwdgt0y8.default\bookmarks.html
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\cwdgt0y8.default\cert8.db
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\cwdgt0y8.default\downloads.sqlite
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\cwdgt0y8.default\localstore.rdf
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\cwdgt0y8.default\mimeTypes.rdf
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\cwdgt0y8.default\permissions.sqlite
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\cwdgt0y8.default\key3.db
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions.ini
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions.sqlite
- C:\Documents and Settings\Default User\Application Data\Mozilla\Firefox\Profiles\cwdgt0y8.default\formhistory.sqlite
- C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\Desktop.htt
- C:\Documents and Settings\Default User\Favorites\3699小游戏.url
- C:\Documents and Settings\Default User\Favorites\机票购买.url
- C:\Documents and Settings\Default User\Favorites\淘宝每日低价商品抢购中！.url
- C:\Documents and Settings\Default User\Favorites\2626安全网址导航.url
- C:\Documents and Settings\Default User\Application Data\360SE\360se_s.ini
- C:\Documents and Settings\Default User\Application Data\360SE\data\360sefav.db
- C:\Documents and Settings\Default User\Application Data\360SE\data\BlankData.ini
- C:\Documents and Settings\Default User\Favorites\电脑技术网址大全.url
- C:\Documents and Settings\Default User\Favorites\链接\淘宝每日低价商品抢购中！.url
- C:\Documents and Settings\Default User\Favorites\链接\电脑技术网址大全.url
- C:\Documents and Settings\Default User\Favorites\链接\系统之家-最新XP系统下载.url
- C:\Documents and Settings\Default User\Favorites\链接\机票购买.url
- C:\Documents and Settings\Default User\Favorites\系统之家-最新XP系统下载.url
- C:\Documents and Settings\Default User\Favorites\链接\2626安全网址导航.url
- C:\Documents and Settings\Default User\Favorites\链接\3699小游戏.url
- C:\Documents and Settings\Default User\Application Data\Microsoft\Address Book\%USERNAME%.wab
- C:\Documents and Settings\Default User\Application Data\Microsoft\Address Book\%USERNAME%.wab~
- C:\Documents and Settings\Default User\Application Data\Maxthon3\Users\guest\QuickAccess\QaConfig.dat
- C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk
- C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini
- C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
- C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf
- C:\Documents and Settings\Default User\Application Data\Maxthon3\Users\guest\Favorite\Favorite.dat
- C:\Documents and Settings\Default User\Application Data\CoralExplorer\Users\Default\StartPageConfig.data
- C:\Documents and Settings\Default User\Application Data\360SE\360SE.ini
- C:\Documents and Settings\Default User\Application Data\360SE\360seie6.ini
- C:\Documents and Settings\Default User\Application Data\CoralExplorer\Users\Default\Favorites.data
- C:\Documents and Settings\Default User\Application Data\Maxthon3\Users\guest\Config\config.dat
- C:\Documents and Settings\Default User\Application Data\Maxthon3\Users\guest\Config\config.ini
- C:\Documents and Settings\Default User\Application Data\CoralExplorer\Users\Default\Default.cfg
- C:\Documents and Settings\Default User\Application Data\SogouExplorer\y.txt
- %HOMEPATH%\Favorites\链接\2626安全网址导航.url
- %TEMP%\autB.tmp
- %HOMEPATH%\Favorites\链接\淘宝每日低价商品抢购中！.url
- %TEMP%\autA.tmp
- %HOMEPATH%\Favorites\3699小游戏.url
- %TEMP%\aut9.tmp
- %HOMEPATH%\Favorites\电脑技术网址大全.url
- %TEMP%\autC.tmp
- %HOMEPATH%\Favorites\链接\3699小游戏.url
- %TEMP%\autF.tmp
- %HOMEPATH%\Favorites\链接\电脑技术网址大全.url
- %TEMP%\autE.tmp
- %HOMEPATH%\Favorites\链接\系统之家-最新XP系统下载.url
- %TEMP%\autD.tmp
- %HOMEPATH%\Favorites\链接\机票购买.url
- %TEMP%\aut3.tmp
- <SYSTEM32>\regset_sd.ini
- %TEMP%\aut4.tmp
- <SYSTEM32>\regset.ini
- %TEMP%\aut1.tmp
- <SYSTEM32>\AppData.exe
- %TEMP%\aut2.tmp
- %HOMEPATH%\Favorites\2626安全网址导航.url
- %TEMP%\aut7.tmp
- %HOMEPATH%\Favorites\系统之家-最新XP系统下载.url
- %TEMP%\aut8.tmp
- %HOMEPATH%\Favorites\机票购买.url
- %TEMP%\aut5.tmp
- %HOMEPATH%\Favorites\淘宝每日低价商品抢购中！.url
- %TEMP%\aut6.tmp
- %TEMP%\aut10.tmp
- %APPDATA%\CoralExplorer\Users\Default\StartPageConfig.data
- %APPDATA%\Tencent\QQBrowser\webkit_cache\2\Local Storage\__0.localstorage
- %TEMP%\7ZSfx000.cmd
- %APPDATA%\CoralExplorer\Users\Default\Favorites.data
- %APPDATA%\SogouExplorer\Favorite2.dat
- %APPDATA%\Maxthon3\Users\guest\QuickAccess\QaConfig.dat
- %APPDATA%\Tencent\TencentTraveler\100\TtConf.dat
- C:\Documents and Settings\Default User\Application Data\winscp.rnd
- C:\Documents and Settings\Default User\Application Data\Tencent\QQBrowser\user_data\0\config.db
- C:\Documents and Settings\Default User\Application Data\SogouExplorer\config.xml
- C:\Documents and Settings\Default User\Application Data\SogouExplorer\Favorite2.dat
- C:\Documents and Settings\Default User\Application Data\Tencent\QQBrowser\user_data\0\Bookmarks
- C:\Documents and Settings\Default User\Application Data\Tencent\TencentTraveler\100\navinfo.db
- C:\Documents and Settings\Default User\Application Data\Tencent\TencentTraveler\100\TtConf.dat
- C:\Documents and Settings\Default User\Application Data\Tencent\QQBrowser\webkit_cache\2\Local Storage\__0.localstorage
- %APPDATA%\360SE\360SE.ini
- %APPDATA%\360SE\360seie6.ini
- %APPDATA%\360SE\360se_s.ini
- %APPDATA%\SogouExplorer\y.txt
- <SYSTEM32>\NTUSER.DAT
- %APPDATA%\Tencent\QQBrowser\user_data\0\Bookmarks
- %APPDATA%\SogouExplorer\config.xml
- %APPDATA%\360SE\data\BlankData.ini
- %APPDATA%\CoralExplorer\Users\Default\Default.cfg
- %APPDATA%\Maxthon3\Users\guest\Config\config.dat
- %APPDATA%\Maxthon3\Users\guest\Favorite\Favorite.dat
- %APPDATA%\Tencent\TencentTraveler\100\navinfo.db
- %APPDATA%\Maxthon3\Users\guest\Config\config.ini
- %APPDATA%\360SE\data\360sefav.db
- %APPDATA%\Tencent\QQBrowser\user_data\0\config.db
Sets the 'hidden' attribute to the following files:
- %APPDATA%\CoralExplorer\Users\Default\StartPageConfig.data
Deletes the following files:
- %TEMP%\autF.tmp
- %TEMP%\aut10.tmp
- %TEMP%\autE.tmp
- %TEMP%\autC.tmp
- %TEMP%\autD.tmp
- <SYSTEM32>\regset.ini
- <SYSTEM32>\regset_sd.ini
- %APPDATA%\SogouExplorer\y.txt
- <SYSTEM32>\AppData.exe
- %TEMP%\7ZSfx000.cmd
- %TEMP%\autB.tmp
- %TEMP%\aut4.tmp
- %TEMP%\aut5.tmp
- %TEMP%\aut3.tmp
- %TEMP%\aut1.tmp
- %TEMP%\aut2.tmp
- %TEMP%\aut9.tmp
- %TEMP%\autA.tmp
- %TEMP%\aut8.tmp
- %TEMP%\aut6.tmp
- %TEMP%\aut7.tmp
Deletes itself.
