<SYSTEM32>\attrib.exe +h +s +r <Drive name for removable media>:\xwin.exe
<SYSTEM32>\attrib.exe +h +s +r C:\xwin.exe
<SYSTEM32>\net1.exe User %USERNAME% WINFX
<SYSTEM32>\attrib.exe +h +s +r I:\xwin.exe
<SYSTEM32>\attrib.exe +h +s +r S:\xwin.exe
<SYSTEM32>\attrib.exe +h +s +r R:\xwin.exe
<SYSTEM32>\attrib.exe +h +s +r Q:\xwin.exe
<SYSTEM32>\attrib.exe +h +s +r V:\xwin.exe
<SYSTEM32>\attrib.exe +h +s +r U:\xwin.exe
<SYSTEM32>\attrib.exe +h +s +r T:\xwin.exe
<SYSTEM32>\attrib.exe +h +s +r P:\xwin.exe
<SYSTEM32>\attrib.exe +h +s +r L:\xwin.exe
<SYSTEM32>\attrib.exe +h +s +r K:\xwin.exe
<SYSTEM32>\attrib.exe +h +s +r J:\xwin.exe
<SYSTEM32>\attrib.exe +h +s +r O:\xwin.exe
<SYSTEM32>\attrib.exe +h +s +r N:\xwin.exe
<SYSTEM32>\attrib.exe +h +s +r M:\xwin.exe
Modifies file system :
Creates the following files:
C:\autorun.inf
%WINDIR%\Help\Tours\mmTour\tour.bat
%WINDIR%\winFX.bat
%WINDIR%\WINFX.exe
C:\xwin.exe
Sets the 'hidden' attribute to the following files:
C:\autorun.inf
<Drive name for removable media>:\autorun.inf
<Drive name for removable media>:\xwin.exe
%WINDIR%\WINFX.exe
C:\xwin.exe
Miscellaneous:
Searches for the following windows:
ClassName: 'Shell_TrayWnd' WindowName: ''
Download Dr.Web for Android
Free three-month trial
All protection features available
Renew your trial license in AppGallery/on Google Pay
By continuing to use this website, you are consenting to Doctor Web’s use of cookies and other technologies related to the collection of visitor statistics. Learn more