Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\Software\Classes\PROTOCOLS\Filter\text/html] 'CLSID' = '{1AC983F7-44B6-44FA-A61D-3EF661051CA5}'
- [<HKLM>\Software\Classes\PROTOCOLS\Filter\text/plain] 'CLSID' = '{1AC983F7-44B6-44FA-A61D-3EF661051CA5}'
- [<HKLM>\Software\Classes\PROTOCOLS\Filter\text/html] 'CLSID' = '{46E5ACED-F699-4412-9E0A-0F119F883E2E}'
- [<HKLM>\Software\Classes\PROTOCOLS\Filter\text/plain] 'CLSID' = '{46E5ACED-F699-4412-9E0A-0F119F883E2E}'
Malicious functions
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system
Creates the following files
- %WINDIR%\syswow64\gbb.dll
- C:\filter.log
Modifies the HOSTS file.
Network activity
Connects to
- '81.##1.105.36':80
