Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = 'test'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'run' = 'test'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setup.exe] 'Debugger' = 'test'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'GinaDLL' = 'test'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Taskman' = 'test'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system] 'Shell' = 'test'
- [<HKLM>\SOFTWARE\Microsoft\Command Processor] 'AutoRun' = 'test'
- [<HKLM>\SYSTEM\ControlSet001\Control\Session Manager\SubSystems] 'windows' = 'test'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IniFileMapping\win.ini] 'run' = 'test'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IniFileMapping\win.ini] 'Winlogon' = 'test'
- [<HKLM>\SOFTWARE\Classes\Folder\shellex\ColumnHandlers] 'test' = 'test'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IniFileMapping\win.ini] 'load' = 'test'
- [<HKLM>\SYSTEM\ControlSet001\Control\Session Manager] 'SetupExecute' = 'test'
- [<HKLM>\SYSTEM\ControlSet001\Control\Session Manager] 'Execute' = 'test'
- [<HKLM>\SOFTWARE\Microsoft\Code Store Database\Distribution Units] 'test' = 'test'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule] 'DllName' = 'test'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'AVP' = 'test'
- [<HKLM>\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}] 'StubPath' = 'test'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'UIHost' = 'test'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'test'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = 'test'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'System' = 'test'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32] 'test' = 'test'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] 'test' = 'test'
- [<HKLM>\SOFTWARE\Policies\Microsoft\Windows\System\Scripts\Startup] 'test' = 'test'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run] 'test' = 'test'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler] 'test' = 'test'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] 'AppInit_DLLs' = 'test'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] 'test' = 'test'
- [<HKCU>\Control Panel\Desktop] 'SCRNSAVE.EXE' = 'test'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\test] 'ImagePath' = 'test'
- [<HKLM>\SYSTEM\ControlSet001\Services\test\Parameters] 'ServiceDll' = 'test'
Malicious functions:
To complicate detection of its presence in the operating system,
blocks the following features:
- System File Checker (SFC)
Modifies settings of Windows Internet Explorer:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0] 'test' = 'test'
- [<HKLM>\SOFTWARE\Microsoft\Internet Explorer\Main] 'Window Title' = 'test'
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system :
Creates the following files:
- <Current directory>\<Virus name>.txt
