Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'MS Scandisk' = '%WINDIR%\Scandisk.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'MS Scandisk' = '%WINDIR%\Scandisk.exe'
Malicious functions:
Terminates or attempts to terminate
the following user processes:
- ZONEALARM.EXE
- outpost.exe
Modifies file system:
Creates the following files:
- %WINDIR%\Scandisk.exe
Miscellaneous:
Searches for the following windows:
- ClassName: 'TfrmAnLBSrv3' WindowName: 'MS2000'
- ClassName: 'TApplication' WindowName: 'МSWin'
- ClassName: 'TApplication' WindowName: '?SWin'
Creates and executes the following:
- '%WINDIR%\Scandisk.exe'
