Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\Software\Classes\CLSID\{5172ec55-e786-48a9-8fd9-c27c6a99f249}\Shell\Open\Command] '' = '%ProgramFiles%\SafetyCenter\protector.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'SafetyCenter' = '%ProgramFiles%\SafetyCenter\start.exe'
Malicious functions
Terminates or attempts to terminate
the following user processes:
- firefox.exe
Registers BHO
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{2414A739-9651-441B-BC10-D773267CC19D}]
Modifies file system
Creates the following files
- %ProgramFiles%\safetycenter\sound.wav
- %ProgramFiles%\safetycenter\main.ico
- %ProgramFiles%\safetycenter\protector.exe
- %ProgramFiles%\safetycenter\start.exe
- %ProgramFiles%\safetycenter\new.exe
- %ProgramFiles%\safetycenter\uninstall.exe
- %TEMP%\~1.dll
Miscellaneous
Searches for the following windows
- ClassName: 'TForm1' WindowName: 'Safety Center'
- ClassName: 'MS_WINHELP' WindowName: ''
Creates and executes the following
- '<SYSTEM32>\regsvr32.exe' /s %TEMP%\~1.dll' (with hidden window)
Executes the following
- '<SYSTEM32>\regsvr32.exe' /s %TEMP%\~1.dll
