Dialer.ICcontrol

Printer Friendly Page

Updated: February 13, 2007 11:46:36 AM

Type: Dialer

Risk Impact: High

File Names: icc.dll iccontrol.exe natydave1.exe sp2ydave1.exe ydave1.exe

Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows XP

When Dialer.ICcontrol is executed, it performs the following actions:

Creates the following files:
- %Windir%\icc.dll
- %Windir%\iccontrol.exe
- %Windir%\madchook.dll (non-malicious component)
  
  Note: %Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.
Adds the value:

"ICcontrol" = "%Windir%\iccontrol.exe"

to the registry subkey:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Runso that it runs every time Windows starts.
Registers the following service:

Service Name: mchInjDrv
Path to executable: "\??\%UserTemp%\mc2A.tmp"

Note: %UserTemp% is a variable that refers to the current user's temporary folder. By default, this is C:\Documents and Settings\[CURRENT USER]\Local Settings\Temp (Windows NT/2000/XP).
Adds the values:

"DisplayName" = "Internet Connection Control" "UninstallString" = "%Windir%\iccontrol.exe /Remove"

to the registry subkey:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ICcontrol
Adds the value:

"iccontrol" = "08714715287"

to the registry subkey:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5158BCD9-12AB-4301-8F5B-D4911E2AF3FA}
Modifies the value:

"UserInit" = "S7=240"

in the registry subkey:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000
Modifies internet proxy settings for used dial-up connections.
Modifies the values:

"ProxyServer" = "[proxy uri]" "ProxyOverride" = "local"

in the registry subkey:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Enables the proxy by modifying the value:

"ProxyEnable" = 1

in the following registry subkeys:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Hardware Profiles \Current\Software\Microsoft\windows\CurrentVersion\Internet Settings HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings

Removal

Summary

Search Threats

Search by name

_{Example: W32.Beagle.AG@mm}