Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\USA47-6BETZ-TZTXG-TRKTK.html
Malicious functions:
Executes the following:
- '%ProgramFiles%\Internet Explorer\IEXPLORE.EXE' %APPDATA%\USA47-6BETZ-TZTXG-TRKTK.html
Modifies file system:
Creates the following files:
- C:\Muldrop.lnk
- C:\Far2.lnk
- C:\Documents and Settings.lnk
- %WINDIR%.lnk
- <STUBS_DIR>.lnk
- %ProgramFiles%.lnk
- C:\d4a40aaa193db030.exe
- %APPDATA%\USA47-6BETZ-TZTXG-TRKTK.html
- %APPDATA%\USA47-6BETZ-TZTXG-TRKTK
- %APPDATA%\2296801295
- <Current directory>.lnk
- <LS_APPDATA>\Microsoft\Internet Explorer\MSIMGSIZ.DAT
- C:\USA47-6BETZ-TZTXG-TRKTK.html
Sets the 'hidden' attribute to the following files:
- C:\d4a40aaa193db030.exe
Miscellaneous:
Searches for the following windows:
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
