Zhelatin.TQ does the following upon initial installation:

1. Disable Windows File Protection
2. Drop its rootkit component %SystemDirectory%diperto[random]-[random].sys
3. Drop its configuration file %SystemDirectory%diperto.ini
4. Exits the current process

To enable execution of startup, the loader component will create a Service to automatically execute the Driver on next reboot resulting in adding of the following registry keys / sub keys in:

HKLMSystemCurrentControlSetServicesdiperto[random]-[random]

The malware then tries to communicate with the other peers via the Overnet P2P protocol on how to proceed. It is basically downloading other component/configuration via the P2P network. The malware has the ability to do the following:

• Harvest email addresses but avoid those that contain certain strings
• Download messages to be use in spam
• Send spam emails

Last update 13 February 2008

 

TOP