Trojan.Siggen31.4659

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[HKLM\Software\Classes\cfxxefile\shell\open\command] '' = '"%1" %*'
[HKLM\Software\Classes\exefile\shell\open\command] '' = '"%1" %*'
[HKLM\Software\Classes\.com] '' = 'comfile'
[HKLM\Software\Classes\.exe] '' = 'exefile'
[HKLM\Software\Classes\.bat] '' = 'batfile'
[HKLM\Software\Classes\.cmd] '' = 'cmdfile'
[HKLM\Software\Classes\.pif] '' = 'piffile'
[HKLM\Software\Classes\comfile\shell\open\command] '' = '"%1" %*'
[HKLM\Software\Classes\batfile\shell\open\command] '' = '"%1" %*'
[HKLM\Software\Classes\cmdfile\shell\open\command] '' = '"%1" %*'
[HKLM\Software\Classes\piffile\shell\open\command] '' = '"%1" %*'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce] '' = ''
[HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce] 'GrpConv' = 'grpconv -o'

Malicious functions

To complicate detection of its presence in the operating system,

blocks the following features:

System Restore (SR)

Terminates or attempts to terminate

the following system processes:

%WINDIR%\syswow64\cscript.exe

Modifies file system

Creates the following files

C:\32788r22fwjfw\license\curl - license.txt
C:\32788r22fwjfw\system_ini.dat
C:\32788r22fwjfw\vipev.dat
C:\32788r22fwjfw\vistamcode.dat
C:\32788r22fwjfw\vistareg.dat
C:\32788r22fwjfw\vun.dat
C:\32788r22fwjfw\w2kreg.dat
C:\32788r22fwjfw\w7mcode.dat
C:\32788r22fwjfw\w7reg.dat
C:\32788r22fwjfw\xpmcode.dat
C:\32788r22fwjfw\svchost.vista.x64.dat
C:\32788r22fwjfw\xpreg.dat
C:\32788r22fwjfw\svchost.w7.x64.dat
C:\32788r22fwjfw\zhsvc.dat
C:\32788r22fwjfw\erdntdos.loc
C:\32788r22fwjfw\erdntwin.loc
C:\32788r22fwjfw\erunt.loc
C:\32788r22fwjfw\srizbi.md5
C:\32788r22fwjfw\files.pif
C:\32788r22fwjfw\hwid.pif
C:\32788r22fwjfw\md5sum.pif
C:\32788r22fwjfw\md5sum00.pif
C:\32788r22fwjfw\n.pif
C:\32788r22fwjfw\zdomain.dat
C:\32788r22fwjfw\license\unxutilsdist.pif
C:\32788r22fwjfw\erdnt.e_e
C:\32788r22fwjfw\svchost.w7.dat
C:\32788r22fwjfw\svchost.vista.dat
C:\32788r22fwjfw\svchost.dat
C:\32788r22fwjfw\cregc.dat
C:\32788r22fwjfw\dnl.dat
C:\32788r22fwjfw\fin.dat
C:\32788r22fwjfw\imefile.dat
C:\32788r22fwjfw\localservice.dat
C:\32788r22fwjfw\localservicenetworkrestricted.dat
C:\32788r22fwjfw\localsystemnetworkrestricted.dat
C:\32788r22fwjfw\ndis_combofix.dat
C:\32788r22fwjfw\netsvc.bad.dat
C:\32788r22fwjfw\netsvc.dat
C:\32788r22fwjfw\023w7.dat
C:\32788r22fwjfw\netsvc.vista.dat
C:\32788r22fwjfw\networkservice.dat
C:\32788r22fwjfw\policies.dat
C:\32788r22fwjfw\powp.dat
C:\32788r22fwjfw\purity.dat
C:\32788r22fwjfw\rclink.dat
C:\32788r22fwjfw\region.dat
C:\32788r22fwjfw\rogues.dat
C:\32788r22fwjfw\safeboot.dat
C:\32788r22fwjfw\safeboot.def.dat
C:\32788r22fwjfw\safeboot.def.vista.dat
C:\32788r22fwjfw\safeboot.def.w7.dat
C:\32788r22fwjfw\netsvc.xp.dat
C:\32788r22fwjfw\svc_wht.dat
C:\32788r22fwjfw\023v.dat
C:\32788r22fwjfw\creg.dat
C:\32788r22fwjfw\exe.reg
C:\32788r22fwjfw\regdacl.sed
C:\32788r22fwjfw\swreg.cfxxe
C:\32788r22fwjfw\w6432.dat
C:\32788r22fwjfw\n_\28141
C:\32788r22fwjfw\mui00
C:\32788r22fwjfw\mui
C:\32788r22fwjfw\en-us\attrib.cfxxe.mui
C:\32788r22fwjfw\en-us\cscript.cfxxe.mui
C:\32788r22fwjfw\en-us\ping.cfxxe.mui
C:\32788r22fwjfw\en-us\route.cfxxe.mui
C:\32788r22fwjfw\en-us\regt.cfxxe.mui
C:\32788r22fwjfw\set.txt
C:\32788r22fwjfw\vercf.bat
C:\32788r22fwjfw\cmdmui00
C:\32788r22fwjfw\nircmdb.exe
C:\32788r22fwjfw\pv.exe
C:\32788r22fwjfw\pv.txt
C:\32788r22fwjfw\pev.cfxxe
C:\32788r22fwjfw\n_\26770
C:\32788r22fwjfw\nlscodepageacp00
C:\32788r22fwjfw\chcp.bat
C:\32788r22fwjfw\nlslanguage00
C:\32788r22fwjfw\nlslanguagedefault
C:\32788r22fwjfw\cfversionold00
C:\32788r22fwjfw\muisubst.dat
C:\32788r22fwjfw\en-us\cf23469.cfxxe.mui
C:\32788r22fwjfw\winnt00
C:\32788r22fwjfw\osver00
C:\32788r22fwjfw\startupfile.cfx
C:\32788r22fwjfw\regdo.sed
C:\32788r22fwjfw\run2.sed
C:\32788r22fwjfw\toolbar.sed
C:\32788r22fwjfw\asp.str
C:\32788r22fwjfw\dpf.str
C:\32788r22fwjfw\rust.str
C:\32788r22fwjfw\av.vbs
C:\32788r22fwjfw\bootdrv.vbs
C:\32788r22fwjfw\drvrun.vbs
C:\32788r22fwjfw\ksvchost.vbs
C:\32788r22fwjfw\lnkread.vbs
C:\32788r22fwjfw\osid.vbs
C:\32788r22fwjfw\restore_pt.vbs
C:\32788r22fwjfw\svcdrv.vbs
C:\32788r22fwjfw\wmi_rem.vbs
C:\32788r22fwjfw\image001.gif
C:\32788r22fwjfw\license\pv_5_2_2.zip
C:\32788r22fwjfw\license\streamtools.zip
C:\32788r22fwjfw\en-us\cmd.cfxxe.mui
C:\32788r22fwjfw\cmd.cfxxe
C:\32788r22fwjfw\prep.done
C:\32788r22fwjfw\osver
C:\32788r22fwjfw\mtpt00
C:\32788r22fwjfw\xpsboot.reg
C:\32788r22fwjfw\embedded.sed
C:\32788r22fwjfw\ddsdo.sed
C:\32788r22fwjfw\023.dat
C:\32788r22fwjfw\vwintemp.dacl
C:\32788r22fwjfw\nircmd.chm
C:\32788r22fwjfw\cset.cmd
C:\32788r22fwjfw\fd-sv.cmd
C:\32788r22fwjfw\fkmgen.cmd
C:\32788r22fwjfw\gethive.cmd
C:\32788r22fwjfw\install-rc.cmd
C:\32788r22fwjfw\katch.cmd
C:\32788r22fwjfw\kill-all.cmd
C:\32788r22fwjfw\nt-os.cmd
C:\32788r22fwjfw\p.cmd
C:\32788r22fwjfw\cf-script.cmd
C:\32788r22fwjfw\regscan.cmd
C:\32788r22fwjfw\cregc.cmd
C:\32788r22fwjfw\rkey.cmd
C:\32788r22fwjfw\srestore.cmd
C:\32788r22fwjfw\suppscan.cmd
C:\32788r22fwjfw\update-cf.cmd
C:\32788r22fwjfw\badclsid.c
C:\32788r22fwjfw\clsid.c
C:\32788r22fwjfw\prep.inf
C:\32788r22fwjfw\ncmd.com
C:\32788r22fwjfw\pv.com
C:\32788r22fwjfw\license\unxutilsdist.com
C:\32788r22fwjfw\regscan64.cmd
C:\32788r22fwjfw\catch-sub.cmd
C:\32788r22fwjfw\snapshot.cmd
C:\32788r22fwjfw\boot-rk.cmd
C:\32788r22fwjfw\awf.cmd
C:\32788r22fwjfw\license\dumphive-license.txt
C:\32788r22fwjfw\license\fi - license.txt
C:\32788r22fwjfw\license\mtee.txt.txt
C:\32788r22fwjfw\license\zip - license.txt
C:\32788r22fwjfw\license\unxutilsdist.html
C:\32788r22fwjfw\boot.bat
C:\32788r22fwjfw\c.bat
C:\32788r22fwjfw\combobatch.bat
C:\32788r22fwjfw\delclsid.bat
C:\32788r22fwjfw\delclsid64.bat
C:\32788r22fwjfw\find3m.bat
C:\32788r22fwjfw\fixlsp.bat
C:\32788r22fwjfw\license\extract.txt
C:\32788r22fwjfw\history.bat
C:\32788r22fwjfw\list-b.bat
C:\32788r22fwjfw\list-c.bat
C:\32788r22fwjfw\list-d.bat
C:\32788r22fwjfw\list.bat
C:\32788r22fwjfw\moveit.bat
C:\32788r22fwjfw\nd_.bat
C:\32788r22fwjfw\setenvmt.bat
C:\32788r22fwjfw\assoc.cmd
C:\32788r22fwjfw\auto-rc.cmd
C:\32788r22fwjfw\av.cmd
C:\32788r22fwjfw\firefox.exe
C:\32788r22fwjfw\lang.bat
C:\32788r22fwjfw\license\firefox.exe
C:\32788r22fwjfw\create.cmd
C:\32788r22fwjfw\hidec.exe
C:\32788r22fwjfw\catchme.cfxxe
C:\32788r22fwjfw\dd.cfxxe
C:\32788r22fwjfw\dumphive.cfxxe
C:\32788r22fwjfw\erunt.cfxxe
C:\32788r22fwjfw\extract.cfxxe
C:\32788r22fwjfw\filekill.cfxxe
C:\32788r22fwjfw\grep.cfxxe
C:\32788r22fwjfw\gsar.cfxxe
C:\32788r22fwjfw\handle.cfxxe
C:\32788r22fwjfw\mbr.cfxxe
C:\32788r22fwjfw\mtee.cfxxe
C:\32788r22fwjfw\license\ncmd.cfxxe
C:\32788r22fwjfw\nircmd.cfxxe
C:\32788r22fwjfw\nircmdc.cfxxe
C:\32788r22fwjfw\pausep.cfxxe
C:\32788r22fwjfw\rmbr.cfxxe
C:\32788r22fwjfw\s0rt.cfxxe
C:\32788r22fwjfw\sed.cfxxe
C:\32788r22fwjfw\setpath.cfxxe
C:\32788r22fwjfw\swsc.cfxxe
C:\32788r22fwjfw\swxcacls.cfxxe
C:\32788r22fwjfw\tail.cfxxe
C:\32788r22fwjfw\zip.cfxxe
C:\32788r22fwjfw\mbr.chk
C:\32788r22fwjfw\templatesfolder.cfx
C:\32788r22fwjfw\iexplore.exe
C:\32788r22fwjfw\combofix-download.cfxxe
C:\32788r22fwjfw\vista.krl
C:\32788r22fwjfw\newcfuser
C:\32788r22fwjfw\startmenufolder.cfx
C:\32788r22fwjfw\pev.exe
C:\32788r22fwjfw\swreg.exe
C:\32788r22fwjfw\ffdefstr.dll
C:\32788r22fwjfw\w_sock.dll
C:\32788r22fwjfw\w2k_sock.dll
C:\32788r22fwjfw\combo-fix.sys
C:\32788r22fwjfw\vinfo
C:\32788r22fwjfw\vinfo2
C:\32788r22fwjfw\appinit.bad
C:\32788r22fwjfw\appdatafile.cfx
C:\32788r22fwjfw\appdatafolder.cfx
C:\32788r22fwjfw\license\iexplore.exe
C:\32788r22fwjfw\desktopfile.cfx
C:\32788r22fwjfw\favoritesfile.cfx
C:\32788r22fwjfw\localappdatafile.cfx
C:\32788r22fwjfw\localappdatafolder.cfx
C:\32788r22fwjfw\localsettingsfile.cfx
C:\32788r22fwjfw\personalfile.cfx
C:\32788r22fwjfw\personalfolder.cfx
C:\32788r22fwjfw\profilesfile.cfx
C:\32788r22fwjfw\profilesfolder.cfx
C:\32788r22fwjfw\programsfile.cfx
C:\32788r22fwjfw\programsfolder.cfx
C:\32788r22fwjfw\startmenufile.cfx
C:\32788r22fwjfw\favoritefolder.cfx
C:\32788r22fwjfw\templatesfile.cfx
C:\32788r22fwjfw\abortp

Deletes the following files

C:\32788r22fwjfw\winnt00
C:\32788r22fwjfw\osver00
C:\32788r22fwjfw\mui00
C:\32788r22fwjfw\cmdmui00
C:\32788r22fwjfw\muisubst.dat
C:\32788r22fwjfw\md5sum00.pif
C:\32788r22fwjfw\ksvchost.vbs
C:\32788r22fwjfw\pv.txt
C:\32788r22fwjfw\nlscodepageacp00
C:\32788r22fwjfw\nlslanguage00
C:\32788r22fwjfw\cfversionold00

Moves the following files

from C:\32788r22fwjfw\pv.exe to C:\32788r22fwjfw\pv.cfxxe

Modifies the following files

%LOCALAPPDATA%\microsoft\windows\explorer\explorerstartuplog_runonce.etl

Substitutes the following files

C:\32788r22fwjfw\winnt00
C:\32788r22fwjfw\pv.exe

Miscellaneous

Searches for the following windows

ClassName: 'EDIT' WindowName: ''

Creates and executes the following

'C:\32788r22fwjfw\n.pif' exec hide 32788R22FWJFW\PEV.exe RIMPORT 32788R22FWJFW\EXE.reg
'C:\32788r22fwjfw\swreg.cfxxe' DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Option
'C:\32788r22fwjfw\pev.exe' -k NIRCMD.cfxxe
'C:\32788r22fwjfw\pev.exe' -k CSCRIPT.exe
'%WINDIR%\syswow64\cscript.exe' //NOLOGO //E:VBSCRIPT //B //T:05 "C:\32788R22FWJFW\ksvchost.vbs"
'C:\32788r22fwjfw\nircmd.cfxxe' CMDWAIT 6000 EXEC HIDE PEV -k CSCRIPT.exe
'C:\32788r22fwjfw\grep.cfxxe' -isq "processorArchitecture=.amd64." "%WINDIR%\SysNative\csrss.exe"
'C:\32788r22fwjfw\pev.exe' -rtd %WINDIR%\Sysnative
'C:\32788r22fwjfw\grep.cfxxe' -isq "ProductType.*WinNT" WinNT00
'C:\32788r22fwjfw\swreg.exe' QUERY "HKLM\System\Currentcontrolset\Control\ProductOptions" /v ProductType
'C:\32788r22fwjfw\grep.cfxxe' -is "currentversion.* 6.[01]" OsVer00
'C:\32788r22fwjfw\nircmd.cfxxe' KILLPROCESS "<Full path to file>"
'C:\32788r22fwjfw\swreg.exe' QUERY "hklm\software\microsoft\windows nt\currentversion" /v currentversion
'C:\32788r22fwjfw\nircmd.cfxxe' killprocess pev
'C:\32788r22fwjfw\swreg.cfxxe' ADD HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\procexp90.Sys /D Driver
'C:\32788r22fwjfw\swreg.cfxxe' ADD HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys /D Driver
'C:\32788r22fwjfw\grep.cfxxe' -F "6.0.6" OsVer
'C:\32788r22fwjfw\swreg.exe' QUERY "HKLM\SYSTEM\CurrentControlSet\Enum\Root\*PNP0296\0000\Control" /v ActiveService
'C:\32788r22fwjfw\swreg.exe' QUERY "HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_{79007602-0CDB-4405-9DBF-1257BB3226ED}\0000\Control" /v ActiveService
'C:\32788r22fwjfw\grep.cfxxe' -F "5.1.2" OsVer
'C:\32788r22fwjfw\pev.exe' RIMPORT C:\32788R22FWJFW\EXE.reg
'C:\32788r22fwjfw\n.pif' cmdwait 2500 exec hide "32788R22FWJFW\cmd.cfxxe" /c 32788R22FWJFW\p.cmd
'C:\32788r22fwjfw\cmd.cfxxe' /c 32788R22FWJFW\p.cmd
'C:\32788r22fwjfw\nircmd.cfxxe' cmdwait 1700 exec hide "32788R22FWJFW\cmd.cfxxe" /c 32788R22FWJFW\p.cmd
'C:\32788r22fwjfw\n.pif' cmdwait 1000 exec hide "32788R22FWJFW\cmd.cfxxe" /c 32788R22FWJFW\p.cmd
'C:\32788r22fwjfw\nircmd.cfxxe' exec hide 32788R22FWJFW\GSAR.cfxxe -if -s\:000M:000i:000c:000r:000o -r\:001M:000i:000c:000r:000o "<SYSTEM32>\cmd.exe" "32788R22FWJFW\cmd.cfxxe"
'C:\32788r22fwjfw\gsar.cfxxe' -if -s\:000M:000i:000c:000r:000o -r\:001M:000i:000c:000r:000o "<SYSTEM32>\cmd.exe" "32788R22FWJFW\cmd.cfxxe"
'C:\32788r22fwjfw\n.pif' exec hide 32788R22FWJFW\GSAR.cfxxe -if -s\:000M:000i:000c:000r:000o -r\:001M:000i:000c:000r:000o "<SYSTEM32>\cmd.exe" "32788R22FWJFW\cmd.cfxxe"
'C:\32788r22fwjfw\swreg.exe' acl "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32" /reset /q
'C:\32788r22fwjfw\grep.cfxxe' -F "6.1.7600" OsVer
'C:\32788r22fwjfw\firefox.exe' win close ititle "Security Central"
'C:\32788r22fwjfw\swreg.cfxxe' ACL "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows" /RESET /Q
'C:\32788r22fwjfw\sed.cfxxe' "/.* /!d; s/// " CFVersionOld00
'C:\32788r22fwjfw\swreg.cfxxe' QUERY HKLM\Software\Swearware /v combofix_wow
'C:\32788r22fwjfw\grep.cfxxe' -Fisq "/NoDisclaimer"
'C:\32788r22fwjfw\cmd.cfxxe' /S /D /c" SET SfxCmd "
'C:\32788r22fwjfw\swreg.cfxxe' QUERY hklm\system\currentcontrolset\enum\root\system
'C:\32788r22fwjfw\grep.cfxxe' -isq "09$" NlsLanguageDefault
'C:\32788r22fwjfw\sed.cfxxe' "/.* /!d; s///" NlsLanguage00
'C:\32788r22fwjfw\swreg.cfxxe' QUERY HKLM\System\CurrentControlSet\Control\NLS\Language /V Default
'C:\32788r22fwjfw\swreg.cfxxe' ADD "HKCU\Console" /V "InsertMode" /T REG_DWORD /D 1
'C:\32788r22fwjfw\swreg.cfxxe' ADD "HKCU\Console" /v "QuickEdit" /T REG_DWORD /D 0
'C:\32788r22fwjfw\swreg.cfxxe' ADD HKU\S-1-5-18\Console /V CodePage /T REG_DWORD /D "1252"
'C:\32788r22fwjfw\swreg.cfxxe' ADD HKCU\Console /V CodePage /T REG_DWORD /D "1252"
'C:\32788r22fwjfw\sed.cfxxe' "/.* /!d; s//@CHCP.com /" NlsCodePageACP00
'C:\32788r22fwjfw\swreg.cfxxe' QUERY "HKLM\SYSTEM\CurrentControlSet\Control\Nls\CodePage" /V ACP
'C:\32788r22fwjfw\swreg.cfxxe' COPY "HKCU\Console" "HKCU\Console_combofixbackup" /s
'C:\32788r22fwjfw\swreg.cfxxe' QUERY "HKCU\Console_combofixbackup"
'C:\32788r22fwjfw\pev.cfxxe' -outputtemp00 -rtf -c:##5# .\* and { License.exe or 32788R22FWJFW.exe or OsVer.exe or WinNT.exe or N_.exe }
'C:\32788r22fwjfw\sed.cfxxe' -r "/.* (.:\\[^\\]*)$/!d; s//\1/"
'C:\32788r22fwjfw\swreg.cfxxe' QUERY "HKLM\Software\Swearware" /V LastDir
'C:\32788r22fwjfw\pev.exe' UZIP License\pv_5_2_2.zip .\
'C:\32788r22fwjfw\nircmd.cfxxe' infobox "Incompatible OS. ComboFix only works for workstations with Windows 2000 and XP~n~nOS incompatible. ComboFix ne fonctionne que pour Windows 2000 et XP~n~nOS niet compatibel. ComboFix ka...
'C:\32788r22fwjfw\cmd.cfxxe' /c VER
'C:\32788r22fwjfw\pev.exe' -limit1 -rtf -sasize "C:\32788R22FWJFW\en-US\*.cfxxe.mui"
'C:\32788r22fwjfw\grep.cfxxe' -Fsqix en-US MUI
'C:\32788r22fwjfw\sed.cfxxe' -r -n "G; s/\n/&&/; /^([ -~]*\n).*\n\1/d; s/\n//; h; P"
'C:\32788r22fwjfw\sed.cfxxe' -r "/.* /!d; s///; s/(\\0)*$//; s/\\0/\n/g" MUI00
'C:\32788r22fwjfw\swreg.cfxxe' QUERY "HKCU\Control Panel\International" /v LocaleName
'C:\32788r22fwjfw\swreg.cfxxe' QUERY "HKCU\Control Panel\Desktop\MuiCached" /v "MachinePreferredUILanguages"
'C:\32788r22fwjfw\swreg.cfxxe' ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted" /V "<Full path to file>" /T REG_DWORD /D 1
'C:\32788r22fwjfw\nircmd.cfxxe' shellcopy <SYSTEM32>\en-us\cmd.exe.mui 32788R22FWJFW\EN-US\cmd.cfxxe.mui yestoall noerrorui silent nosecattr
'C:\32788r22fwjfw\nircmd.cfxxe' WIN CLOSE CLASS "#32770"
'C:\32788r22fwjfw\n.pif' shellcopy <SYSTEM32>\en-us\cmd.exe.mui 32788R22FWJFW\EN-US\cmd.cfxxe.mui yestoall noerrorui silent nosecattr
'C:\32788r22fwjfw\n.pif' cmdwait 3000 exec hide 32788R22FWJFW\swreg.exe acl "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32" /reset /q
'C:\32788r22fwjfw\hidec.exe' 32788R22FWJFW\SWREG.exe acl "hklm\software\microsoft\windows nt\currentversion\windows" /DE:F /Q
'C:\32788r22fwjfw\license\iexplore.exe' -k * and { "%ALLUSERSPROFILE%\*" or "%TEMP%\*" or "%APPDATA%\*" } not "<Full path to file>"
'C:\32788r22fwjfw\firefox.exe' win close ititle "System Tool"
'C:\32788r22fwjfw\hidec.exe' 32788R22FWJFW\pev.exe -loadline32788R22FWJFW\License\UnxUtilsDist.com and not "<Full path to file>"
'C:\32788r22fwjfw\pev.exe' -loadline32788R22FWJFW\License\UnxUtilsDist.com and not "<Full path to file>"
'C:\32788r22fwjfw\license\iexplore.exe' -loadline32788R22FWJFW\License\UnxUtilsDist.com and not "<Full path to file>"
'C:\32788r22fwjfw\n.pif' exec hide 32788R22FWJFW\pev.exe -loadline32788R22FWJFW\License\UnxUtilsDist.com and not "<Full path to file>"
'C:\32788r22fwjfw\iexplore.exe' exec hide 32788R22FWJFW\License\iexplore.exe -loadline32788R22FWJFW\License\UnxUtilsDist.com and not "<Full path to file>"
'C:\32788r22fwjfw\hidec.exe' 32788R22FWJFW\pev.exe -loadline32788R22FWJFW\License\UnxUtilsDist.pif and not "<Full path to file>"
'C:\32788r22fwjfw\pev.exe' -loadline32788R22FWJFW\License\UnxUtilsDist.pif and not "<Full path to file>"
'C:\32788r22fwjfw\license\iexplore.exe' -loadline32788R22FWJFW\License\UnxUtilsDist.pif and not "<Full path to file>"
'C:\32788r22fwjfw\license\iexplore.exe' -rk { "%ProgramFiles(x86)%\*" or "%CommonProgramFiles(x86)%\*" or "%HOMEPATH%\*" } not "<Full path to file>"
'C:\32788r22fwjfw\n.pif' exec hide 32788R22FWJFW\pev.exe -loadline32788R22FWJFW\License\UnxUtilsDist.pif and not "<Full path to file>"
'C:\32788r22fwjfw\license\iexplore.exe' -s450000-1400000 -t!k -t!o -t!g -k C:\*.exe and not "<Full path to file>"
'C:\32788r22fwjfw\iexplore.exe' exec hide 32788R22FWJFW\License\iexplore.exe -loadline32788R22FWJFW\License\UnxUtilsDist.pif and not "<Full path to file>"
'C:\32788r22fwjfw\iexplore.exe' exec hide 32788R22FWJFW\License\iexplore.exe -rk { "%ProgramFiles(x86)%\*" or "%CommonProgramFiles(x86)%\*" or "%HOMEPATH%\*" } not "<Full path to file>"
'C:\32788r22fwjfw\firefox.exe' win close ititle "SysInternals"
'C:\32788r22fwjfw\iexplore.exe' exec hide 32788R22FWJFW\License\iexplore.exe -k * and { "%ALLUSERSPROFILE%\*" or "%TEMP%\*" or "%APPDATA%\*" } not "<Full path to file>"
'C:\32788r22fwjfw\iexplore.exe' exec2 hide C:\32788R22FWJFW\License 32788R22FWJFW\License\iexplore.exe -s450000-1400000 -t!k -t!o -t!g -k C:\*.exe and not "<Full path to file>"
'C:\32788r22fwjfw\iexplore.exe' win close class consolewindowclass
'C:\32788r22fwjfw\iexplore.exe' win close ititle "Enterprise Suite"
'C:\32788r22fwjfw\iexplore.exe' win close ititle "Virus Protect"
'C:\32788r22fwjfw\iexplore.exe' win close ititle "Antivirus S"
'C:\32788r22fwjfw\iexplore.exe' win close ititle "Security essentials"
'C:\32788r22fwjfw\iexplore.exe' win close ititle "Security Central"
'C:\32788r22fwjfw\iexplore.exe' win close ititle "Security Tool"
'C:\32788r22fwjfw\iexplore.exe' win close ititle "SysInternals"
'C:\32788r22fwjfw\iexplore.exe' win close ititle " Security"
'C:\32788r22fwjfw\iexplore.exe' win close ititle "System Tool"
'C:\32788r22fwjfw\pev.exe' RIMPORT 32788R22FWJFW\EXE.reg
'C:\32788r22fwjfw\nircmd.cfxxe' LOOP 2 80 BEEP 3000 200
'C:\32788r22fwjfw\swreg.cfxxe' ACL "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows" /RO:F /RA:F /Q
'C:\32788r22fwjfw\firefox.exe' win close ititle "Security Tool"
'C:\32788r22fwjfw\firefox.exe' win close ititle "Antivirus S"
'C:\32788r22fwjfw\firefox.exe' win close ititle " Security"
'C:\32788r22fwjfw\swreg.exe' acl "hklm\software\microsoft\windows nt\currentversion\windows" /DE:F /Q
'C:\32788r22fwjfw\n.pif' cmdwait 150 exec hide 32788R22FWJFW\SWREG.exe acl "hklm\software\microsoft\windows nt\currentversion\windows" /DE:F /Q
'C:\32788r22fwjfw\hidec.exe' 32788R22FWJFW\SWREG.exe acl "hklm\software\microsoft\windows nt\currentversion\windows" /O Guest /Q
'C:\32788r22fwjfw\swreg.exe' acl "hklm\software\microsoft\windows nt\currentversion\windows" /O Guest /Q
'C:\32788r22fwjfw\swreg.exe' acl "HKLM\SOFTWARE\Microsoft\Command Processor" /reset /q
'C:\32788r22fwjfw\swreg.exe' acl "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32" /da:r /q
'C:\32788r22fwjfw\swreg.exe' acl "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" /reset /q
'C:\32788r22fwjfw\n.pif' exec hide 32788R22FWJFW\SWREG.exe acl "hklm\software\microsoft\windows nt\currentversion\windows" /O Guest /Q
'C:\32788r22fwjfw\swxcacls.cfxxe' "<SYSTEM32>\cmd.exe" /P /GA:F /GS:F /GU:X /GP:X /I ENABLE /Q
'C:\32788r22fwjfw\hidec.exe' 32788R22FWJFW\SWXCACLS.cfxxe "<SYSTEM32>\cmd.exe" /P /GA:F /GS:F /GU:X /GP:X /I ENABLE /Q
'C:\32788r22fwjfw\hidec.exe' 32788R22FWJFW\swreg.exe acl "HKLM\SOFTWARE\Microsoft\Command Processor" /reset /q
'C:\32788r22fwjfw\hidec.exe' 32788R22FWJFW\swreg.exe acl "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" /reset /q
'C:\32788r22fwjfw\hidec.exe' 32788R22FWJFW\swreg.exe acl "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32" /da:r /q
'C:\32788r22fwjfw\hidec.exe' 32788R22FWJFW\PEV.exe RIMPORT 32788R22FWJFW\EXE.reg
'C:\32788r22fwjfw\n.pif' shexec install 32788R22FWJFW\Prep.inf
'C:\32788r22fwjfw\license\firefox.exe' -loadline32788R22FWJFW\License\UnxUtilsDist.com and not "<Full path to file>"
'C:\32788r22fwjfw\license\firefox.exe' -loadline32788R22FWJFW\License\UnxUtilsDist.pif and not "<Full path to file>"
'C:\32788r22fwjfw\license\firefox.exe' -rk { "%ProgramFiles(x86)%\*" or "%CommonProgramFiles(x86)%\*" or "%APPDATA%\*" or "%HOMEPATH%\*" } not "<Full path to file>"
'C:\32788r22fwjfw\license\firefox.exe' -k * and { "%ALLUSERSPROFILE%\*" or "%TEMP%\*" } not "<Full path to file>"
'C:\32788r22fwjfw\license\firefox.exe' -s450000-1400000 -t!k -t!o -t!g -k C:\*.exe and not "<Full path to file>"
'C:\32788r22fwjfw\firefox.exe' exec hide 32788R22FWJFW\License\FireFox.exe -loadline32788R22FWJFW\License\UnxUtilsDist.com and not "<Full path to file>"
'C:\32788r22fwjfw\firefox.exe' exec hide 32788R22FWJFW\License\FireFox.exe -loadline32788R22FWJFW\License\UnxUtilsDist.pif and not "<Full path to file>"
'C:\32788r22fwjfw\firefox.exe' exec hide 32788R22FWJFW\License\FireFox.exe -rk { "%ProgramFiles(x86)%\*" or "%CommonProgramFiles(x86)%\*" or "%APPDATA%\*" or "%HOMEPATH%\*" } not "<Full path to file>"
'C:\32788r22fwjfw\firefox.exe' exec hide 32788R22FWJFW\License\FireFox.exe -k * and { "%ALLUSERSPROFILE%\*" or "%TEMP%\*" } not "<Full path to file>"
'C:\32788r22fwjfw\firefox.exe' exec2 hide C:\32788R22FWJFW\License 32788R22FWJFW\License\FireFox.exe -s450000-1400000 -t!k -t!o -t!g -k C:\*.exe and not "<Full path to file>"
'C:\32788r22fwjfw\firefox.exe' win close class consolewindowclass
'C:\32788r22fwjfw\firefox.exe' win close ititle "Enterprise Suite"
'C:\32788r22fwjfw\firefox.exe' win close ititle "Virus Protect"
'C:\32788r22fwjfw\firefox.exe' win close ititle "Security essentials"
'C:\32788r22fwjfw\nircmdc.cfxxe' QBOXCOMTOP "The following websites are not in any way affiliated to ComboFix:~n~n http://www.combofixdownload.biz~n http://www.combofix.org~n http://www.combofixdownload.com~n~nIf you...

Executes the following

'%WINDIR%\syswow64\chcp.com' 1252
'%WINDIR%\syswow64\grpconv.exe' -o
'%WINDIR%\syswow64\runonce.exe' -r
'%WINDIR%\syswow64\infdefaultinstall.exe' "C:\32788R22FWJFW\Prep.inf"
'C:\32788r22fwjfw\cmd.cfxxe' /c 32788R22FWJFW\p.cmd' (with hidden window)
'C:\32788r22fwjfw\gsar.cfxxe' -if -s\:000M:000i:000c:000r:000o -r\:001M:000i:000c:000r:000o "<SYSTEM32>\cmd.exe" "32788R22FWJFW\cmd.cfxxe"' (with hidden window)
'C:\32788r22fwjfw\swreg.exe' acl "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32" /reset /q' (with hidden window)
'C:\32788r22fwjfw\swreg.exe' acl "hklm\software\microsoft\windows nt\currentversion\windows" /DE:F /Q' (with hidden window)
'C:\32788r22fwjfw\swreg.exe' acl "hklm\software\microsoft\windows nt\currentversion\windows" /O Guest /Q' (with hidden window)
'C:\32788r22fwjfw\swreg.exe' acl "HKLM\SOFTWARE\Microsoft\Command Processor" /reset /q' (with hidden window)
'C:\32788r22fwjfw\swreg.exe' acl "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32" /da:r /q' (with hidden window)
'C:\32788r22fwjfw\swreg.exe' acl "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" /reset /q' (with hidden window)
'C:\32788r22fwjfw\pev.exe' -k CSCRIPT.exe' (with hidden window)
'C:\32788r22fwjfw\license\firefox.exe' -loadline32788R22FWJFW\License\UnxUtilsDist.com and not "<Full path to file>"' (with hidden window)
'C:\32788r22fwjfw\license\firefox.exe' -rk { "%ProgramFiles(x86)%\*" or "%CommonProgramFiles(x86)%\*" or "%APPDATA%\*" or "%HOMEPATH%\*" } not "<Full path to file>"' (with hidden window)
'C:\32788r22fwjfw\license\firefox.exe' -loadline32788R22FWJFW\License\UnxUtilsDist.pif and not "<Full path to file>"' (with hidden window)
'C:\32788r22fwjfw\license\firefox.exe' -k * and { "%ALLUSERSPROFILE%\*" or "%TEMP%\*" } not "<Full path to file>"' (with hidden window)
'C:\32788r22fwjfw\license\firefox.exe' -s450000-1400000 -t!k -t!o -t!g -k C:\*.exe and not "<Full path to file>"' (with hidden window)
'C:\32788r22fwjfw\pev.exe' -loadline32788R22FWJFW\License\UnxUtilsDist.com and not "<Full path to file>"' (with hidden window)
'C:\32788r22fwjfw\license\iexplore.exe' -loadline32788R22FWJFW\License\UnxUtilsDist.com and not "<Full path to file>"' (with hidden window)
'C:\32788r22fwjfw\pev.exe' -loadline32788R22FWJFW\License\UnxUtilsDist.pif and not "<Full path to file>"' (with hidden window)
'C:\32788r22fwjfw\license\iexplore.exe' -loadline32788R22FWJFW\License\UnxUtilsDist.pif and not "<Full path to file>"' (with hidden window)
'C:\32788r22fwjfw\license\iexplore.exe' -rk { "%ProgramFiles(x86)%\*" or "%CommonProgramFiles(x86)%\*" or "%HOMEPATH%\*" } not "<Full path to file>"' (with hidden window)
'C:\32788r22fwjfw\license\iexplore.exe' -s450000-1400000 -t!k -t!o -t!g -k C:\*.exe and not "<Full path to file>"' (with hidden window)
'C:\32788r22fwjfw\license\iexplore.exe' -k * and { "%ALLUSERSPROFILE%\*" or "%TEMP%\*" or "%APPDATA%\*" } not "<Full path to file>"' (with hidden window)
'C:\32788r22fwjfw\swxcacls.cfxxe' "<SYSTEM32>\cmd.exe" /P /GA:F /GS:F /GU:X /GP:X /I ENABLE /Q' (with hidden window)
'C:\32788r22fwjfw\pev.exe' RIMPORT 32788R22FWJFW\EXE.reg' (with hidden window)

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial