Virus:Win32/Xpaj.gen!A

Virus:Win32/Xpaj.gen!A is a polymorphic, entry point obscuring (EPO) virus that infects Windows PE files. The virus also attempts to download additional files from remote hosts.

Win32/Xpaj.gen!A infects files with the following file extensions:

The virus initially creates a file in the Windows directory with a file name in the following format:

The virus uses this file as an infection marker.

 

Win32/Xpaj targets files to infect first in the %programfiles% folder and then the %windir% folder. It cycles through these folders recursively. It creates a list of all acceptable files (those that have the correct file extensions as listed above) in these directories and their subdirectories recursively and then randomly chooses files to infect from this list.

 

Win32/Xpaj does not directly infect files, but rather uses the following method:

Note that before being overwritten, the original file is copied to the %temp% folder but it is deleted after the original file is overwritten; hence, after infection there are no copies remaining of the original uninfected file.

 

Win32/Xpaj does not infect protected Windows files.

Win32/Xpaj attempts to download additional code from the Internet. It contains a hardcoded IP, 74.72.199.125, that it tries to connect to initially. It also generates thousands of pseudo-random domain names which it tries to resolve to their corresponding IP addresses before connecting. See below for examples of domain names generated by Win32/Xpaj:

 

Win32/Xpaj may try to test Internet connectivity be connecting to microsoft.com.