Hi Chenan,
As soon as the Trojan is activated, it leaves following files on the computer::
%Windir%\nview.dll
The virus furthermore creates the following file:
%System%\atmapi.sys
Then the virus creates the following registry value:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows"zwpInit_Dlls" = “C:\WINDOWS\nview.dll”
The Trojan changes following files to start the threat every time the OS starts:
%System%\user32.dll
%System%\dllcache\user32.dll
The original legit file user32.dll the Trojan keeps within the following folder:
%System%[RANDOM FILE NAME]
The threat makes the computer restarts whenever the user32.dll file takes effect.
The virus creates the following encrypted DLL files:
%Windir%\Help\access.cni
%Windir%\Help\mwrem.cin
The virus saves the encrypted information especially in these DLL’s and then uses the following registry values to do so:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\”zwpInit_Dlls” = “C:\WINDOWS\nview.dll”
HKEY_LOCAL_MACHINE\SOFTWARE\1"Path" = “C:\WINDOWS\help\access.cni”
HKEY_LOCAL_MACHINE\SOFTWARE\1"Key" = “[ENCRYPTION KEY]”
HKEY_LOCAL_MACHINE\SOFTWARE\1"DLoad" = “0”
HKEY_LOCAL_MACHINE\SOFTWARE\2"Path" = “C:\WINDOWS\help\mwrem.cin”
HKEY_LOCAL_MACHINE\SOFTWARE\2"Key" = “[ENCRYPTION KEY]”
HKEY_LOCAL_MACHINE\SOFTWARE\2"DLoad" = “0”
Finally the Trojan opens up a backdoor on the infected machine to access to address with IP-number 58.65.239.86 enabling the attacker to do the following:
Closing down processes
Monitoring network traffic
Downloading of executable files
To cleanse one should make a copy of the registry first, in case something should go wrong,
Disable temporarily system restore and cleanse running SafeMode, then re-enable system restore and
normal mode when the malware has left your computer, you can first try a full scan with DrWeb’s CureIt,
polonus