NetWorkControl
Threat LevelDamageDistribution

Effects 

NetWorkControl carries out the following actions:

• It reaches the computer in a file with the following icon:
  
  
• Once run and after few seconds, it starts displaying warning messages like the following, informing users of an attack to the computer:
  
  
• Other of the messages indicates that no software to block IP addresses has been found in the computer and shows a list of programs, inviting users to install a certain antivirus:
  
  
• This antivirus, called ShieldEC, is just another fake antivirus program or rogueware.
• If users decide to install this program, a window like the following will be displayed, requiring users an activation code:
  
  
• From this moment on, the computer will be blocked, except from the window belonging to the program, which cannot be closed.
• If users restart the computer, the following message will be displayed:
  
  

Infection strategy 

NetWorkControl creates a folder called NetworkControl in the root directory of the C: drive. In this folder, it creates the following files:

• NC.EXE
• CHECKER.EXE
• TMP.DLL
• SEGOEUI.TTF

Additionally, it creates the file I.BAT in the folder Local Settings of the Documents and Settings directory of the user that has logged in.

NetWorkControl creates the following entries in the Windows Registry:

• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
  Shell = C:\NetworkControl\nc.exe -reboot
  By creating this entry, NetWorkControl ensures that it is run whenever Windows is started.
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
  WarnonBadCertRecving = 00, 00, 00, 00
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
  WarnOnPostRedirect = 00, 00, 00, 00
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
  WarnOnZoneCrossing = 00, 00, 00, 00
  By creating these entries, NetWorkControl changes the Internet security settings, so that warning messages are not displayed.

NetWorkControl modifies the following Windows Registry entry, in order to change the Internet security settings and not show warning messages:

• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
  WarnOnPost = 01, 00, 00, 00
  It changes this entry to:
  HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
  WarnOnPost = 00, 00, 00, 00

Means of transmission 

NetWorkControl can reach the computer when the user accesses certain websites which display banners or pop-up windows which lead to the download of this program. It can also reach the computer in a link that can be received via spam messages, fraudulent websites, etc.

Further Details  

NetWorkControl is 1,147,392 bytes in size.