Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Classes\ywsfile\shell\open\command] '' = '<Full path to file> %1'
Modifies file system:
Creates the following files:
- <Current directory>\yyerror.txt
- %APPDATA%\YYebookset\yywsuppz.ini
- %APPDATA%\YYebookset\saopyyf
- %APPDATA%\YYebookset\opfilejlA
- %APPDATA%\yyinif.ini
- %APPDATA%\YYebookset\weblinkt
- %APPDATA%\YYebookset\yywsini1.ini
Sets the 'hidden' attribute to the following files:
- %APPDATA%\YYebookset\opfilejlA
Network activity:
Connects to:
- 'www.yy##ook.com':80
- 'localhost':1040
- 'www.un##45.com':80
TCP:
HTTP GET requests:
- http://www.yy##ook.com/fristlink/yylink.asp?jq#################################################################################
- http://www.yy##ook.com/BTWEB/btweb.asp?jq#####################################################################################
- http://www.un##45.com/yyws/softupdate/softup.asp?so###########
UDP:
- DNS ASK www.yy##ook.com
- DNS ASK www.un##45.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: '<Full path to file>' WindowName: ''
