Sets the 'hidden' attribute to the following files:
<Full path to virus>
Deletes the following files:
%WINDIR%\Media\Windows XP Logon Sound.wav
%WINDIR%\Media\Windows XP Logoff Sound.wav
%WINDIR%\Media\Windows XP Minimize.wav
%WINDIR%\Media\Windows XP Menu Command.wav
%WINDIR%\Media\Windows XP Information Bar.wav
%WINDIR%\Media\Windows XP Hardware Fail.wav
%WINDIR%\Media\Windows XP Exclamation.wav
%WINDIR%\Media\Windows XP Hardware Remove.wav
%WINDIR%\Media\Windows XP Hardware Insert.wav
%WINDIR%\Media\Windows XP Notify.wav
%WINDIR%\Media\Windows XP Shutdown.wav
%WINDIR%\Media\Windows XP Ringout.wav
%WINDIR%\Media\Windows XP Startup.wav
%WINDIR%\Media\Windows XP Start.wav
%WINDIR%\Media\Windows XP Ringin.wav
%WINDIR%\Media\Windows XP Print complete.wav
%WINDIR%\Media\Windows XP Pop-up Blocked.wav
%WINDIR%\Media\Windows XP Restore.wav
%WINDIR%\Media\Windows XP Recycle.wav
%WINDIR%\Media\Windows XP Error.wav
%WINDIR%\Media\onestop.mid
%WINDIR%\Media\notify.wav
%WINDIR%\Media\ringin.wav
%WINDIR%\Media\recycle.wav
%WINDIR%\Media\flourish.mid
%WINDIR%\Media\chimes.wav
%TEMP%\RGI1.tmp
%WINDIR%\Media\ding.wav
%WINDIR%\Media\chord.wav
%WINDIR%\Media\ringout.wav
%WINDIR%\Media\Windows XP Critical Stop.wav
%WINDIR%\Media\Windows XP Battery Low.wav
%WINDIR%\Media\Windows XP Ding.wav
%WINDIR%\Media\Windows XP Default.wav
%WINDIR%\Media\Windows XP Battery Critical.wav
%WINDIR%\Media\tada.wav
%WINDIR%\Media\start.wav
%WINDIR%\Media\Windows XP Balloon.wav
%WINDIR%\Media\town.mid
Network activity:
Connects to:
'58.#9.58.27':443
Miscellaneous:
Searches for the following windows:
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'CJUCPUMNL' WindowName: 'oxscbwypv'
Download Dr.Web for Android
Free three-month trial
All protection features available
Renew your trial license in AppGallery/on Google Pay
By continuing to use this website, you are consenting to Doctor Web’s use of cookies and other technologies related to the collection of visitor statistics. Learn more