Technical Information
Malicious functions:
Creates and executes the following:
- 'C:\winupdate3.exe' (downloaded from the Internet)
- 'C:\winupdate2.exe' (downloaded from the Internet)
- 'C:\winupdate1.exe' (downloaded from the Internet)
Executes the following:
- 'C:\winupdate3.exe'
- 'C:\winupdate2.exe'
- 'C:\winupdate1.exe'
Terminates or attempts to terminate
the following user processes:
- NAVAPW32.EXE
- zapro.exe
- ZONEALARM.EXE
- AVPM.EXE
- AVP.EXE
- AVP32.EXE
- AVPCC.EXE
Modifies file system:
Creates the following files:
- C:\winupdatex.exe
- C:\winupdate3.exe
- C:\winupdate1.exe
- C:\winupdate2.exe
Deletes the following files:
- C:\winupdatex.exe
- C:\winupdate2.exe
- C:\winupdate1.exe
Network activity:
Connects to:
- 'hi###.hotlog.ru':80
- 'www.to###paeni.ch':80
- 'localhost':1035
TCP:
HTTP GET requests:
- http://hi###.hotlog.ru/cgi-bin/hotlog/count?&s################################################################################################
- http://www.to###paeni.ch/images/images.php?w=#
UDP:
- DNS ASK hi###.hotlog.ru
- DNS ASK www.to###paeni.ch
