Technical Information
To ensure autorun and distribution:
Creates the following files on removable media:
- <Drive name for removable media>:\AUTORUN.INF
Malicious functions:
Executes the following:
- %WINDIR%\explorer.exe ""
Modifies file system :
Creates the following files:
- C:\AUTORUN.INF
- %TEMP%\a91028.bat
Sets the 'hidden' attribute to the following files:
- %TEMP%\a91028.bat
Deletes the following files:
- %TEMP%\a91028.bat
Miscellaneous:
Searches for the following windows:
- ClassName: '' WindowName: 'GINA Logon'
- ClassName: '' WindowName: ''
