Virus.ALS.BURSTED.D

This Virus arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It does not have any backdoor routine.

It does not have any downloading capability.

It gathers certain information on the affected computer.

Arrival Details

This Virus arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Other System Modifications

This Virus modifies the following registry entries to hide files with Hidden attributes:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced\Folder\Hidden\
SHOWALL
CheckedValue = 0

(Note: The default value data of the said registry entry is 1.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced\Folder\Hidden\
NOHIDDEN
CheckedValue = 0

(Note: The default value data of the said registry entry is 2.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced\Folder\Hidden\
NOHIDDEN
DefaultValue = 0

(Note: The default value data of the said registry entry is 2.)

Backdoor Routine

This Virus does not have any backdoor routine.

Rootkit Capabilities

This Virus does not have rootkit capabilities.

Download Routine

This Virus does not have any downloading capability.

Information Theft

This Virus gathers the following information on the affected computer:

• MAC Address (all network adapters via WMI)
• System date and time

Other Details

This Virus does the following:

• It does not execute if any of the following conditions are NOT met:
  • The system date is later than September 9, 2009
  • The systems MAC address matches one of the 500 predetermined target variations
  • The current system time minute is even
• It infects the following AuatoCAD startup files:
  • {AutoCAD menu name}doc.lsp
  • {AutoCAD menu name}.mnl
  • {DWG folder path}\acaddoc.lsp
• It uses the following as infection marker:
  • ;;;jjyy
• It sets the following attributes on infected files:
  • Hidden
  • System
• It establishes persistence by inserting its malicious code into the "s::startup" function, causing AutoCAD to run it automatically on startup and when drawings are opened.
• It disables command echo to hide malicious activity:
  • Sets the AutoCAD system variable cmdecho = 0
• It re-enables file dialogs to maintain operational stealth:
  • Sets the AutoCAD system variable filedia = 1
• Attempts to load GBTXT.shx through a text style named "shxfont"