Technical Information
- [<HKCU>\Control Panel\Desktop] 'SCRNSAVE.EXE' = '0x1.1039b0p-761ppdata\Microsoft\Windows\hRТ.scr'
- [<HKCU>\Control Panel\Desktop] 'SCRNSAVE.EXE' = '0x1.1039b0p-761ppdata\Microsoft\Windows\xТ.scr'
- [<HKCU>\Control Panel\Desktop] 'SCRNSAVE.EXE' = '0x1.1039b0p-761ppdata\Microsoft\Windows\eТ.scr'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'nvidgfx' = '%TEMP%\nvidgfx.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'nvidgfx' = '%APPDATA%\nvidgfx.exe'
- [<HKCU>\Control Panel\Desktop] 'SCRNSAVE.EXE' = '%APPDATA%\Microsoft\Windows\spacedots.scr'
- [<HKLM>\SYSTEM\ControlSet001\Services\Browser] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\SSDPSRV] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\upnphost] 'Start' = '00000002'
- <Drive name for removable media>:\protect.bat
- <Drive name for removable media>:\autorun.inf
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'DoNotAllowExceptions' = '00000000'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe' = '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe:*:Enabled:winhttpsvc'
- User Account Control (UAC)
- %APPDATA%\errorreporter.exe
- <SYSTEM32>\reg.exe ADD "HKLM\Software\Microsoft\Internet Explorer\Main" /v Show_URLinStatusBar /t REG_SZ /d yes /f
- <SYSTEM32>\reg.exe ADD "HKLM\Software\Microsoft\Internet Explorer\Main" /v Show_StatusBar /t REG_SZ /d yes /f
- <SYSTEM32>\reg.exe ADD "HKLM\Software\Microsoft\Internet Explorer\Main" /v Show_FullURL /t REG_SZ /d yes /f
- <SYSTEM32>\reg.exe ADD "HKLM\Software\Microsoft\Internet Explorer\MINIE" /v ShowStatusBar /t REG_DWORD /d 1 /f
- <SYSTEM32>\attrib.exe +R +H "C:\autorun.inf"
- <SYSTEM32>\reg.exe DELETE "HKCU\AppEvents\Schemes\Apps\Explorer\Navigating\.Default" /f
- <SYSTEM32>\reg.exe DELETE "HKCU\AppEvents\Schemes\Apps\Explorer\Navigating\.Current" /f
- <SYSTEM32>\reg.exe ADD "HKLM\Software\Microsoft\Internet Explorer\Main\FeatureControl" /v FEATURE_WEBOC_POPUPMANAGEMENT /t REG_DWORD /d 0 /f
- <SYSTEM32>\reg.exe DELETE "HKCU\software\microsoft\windows\currentversion\action center\checks" /f
- <SYSTEM32>\reg.exe ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v EnableBalloonTips /t REG_DWORD /d 0 /f
- <SYSTEM32>\net1.exe start browser
- <SYSTEM32>\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f
- <SYSTEM32>\reg.exe ADD "HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile" /v EnableFirewall /t REG_DWORD /d 0 /f
- <SYSTEM32>\reg.exe ADD "HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile" /v EnableFirewall /t REG_DWORD /d 0 /f
- <SYSTEM32>\reg.exe ADD "HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile" /v EnableFirewall /t REG_DWORD /d 0 /f
- <SYSTEM32>\attrib.exe +S +R +H "%APPDATA%\nvidgfx.exe"
- <SYSTEM32>\reg.exe ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v "DisableFirstRunCustomize" /t REG_DWORD /d "1" /f
- <SYSTEM32>\attrib.exe -S -R -H "%APPDATA%\nvidgfx.exe"
- <SYSTEM32>\attrib.exe +R +H "E:\protect.bat"
- <SYSTEM32>\attrib.exe +R +H "Z:protect.bat"
- <SYSTEM32>\attrib.exe +R +H "C:\protect.bat"
- <SYSTEM32>\attrib.exe +R +H "Z:\protect.bat"
- <SYSTEM32>\reg.exe ADD "HKCU\Software\Microsoft\Internet Explorer\Main" /v Check_Associations /t REG_SZ /d no /f
- <SYSTEM32>\attrib.exe +R +H "Z:\autorun.inf"
- <SYSTEM32>\attrib.exe +R +H "Z:autorun.inf"
- <SYSTEM32>\attrib.exe +R +H "E:\autorun.inf"
- <SYSTEM32>\attrib.exe -R -H "Z:\protect.bat"
- <SYSTEM32>\attrib.exe -R -H "Z:protect.bat"
- <SYSTEM32>\attrib.exe -R -H "E:\protect.bat"
- <SYSTEM32>\attrib.exe -R -H "C:\protect.bat"
- <SYSTEM32>\net1.exe start SSDPSRV
- <SYSTEM32>\reg.exe ADD "HKCU\Control Panel\Desktop" /v ScreenSaveTimeOut /t REG_SZ /d "60" /f
- <SYSTEM32>\reg.exe ADD "HKCU\Control Panel\Desktop" /v ScreenSaveActive /t REG_SZ /d "1" /f
- <SYSTEM32>\reg.exe ADD "HKCU\Control Panel\Desktop" /v "SCRNSAVE.EXE" /t REG_SZ /d "%APPDATA%\Microsoft\Windows\spacedots.scr" /f
- <SYSTEM32>\reg.exe ADD "HKCR\.zip\ShellNew" /v "FileName" /t REG_SZ /d "%APPDATA%\newzip.dat" /f
- <SYSTEM32>\reg.exe ADD "HKCR\.rar\ShellNew" /v "FileName" /t REG_SZ /d "%APPDATA%\newzip.dat" /f
- <SYSTEM32>\cmd.exe /c ""%APPDATA%\plugininstall.bat" "
- <SYSTEM32>\reg.exe ADD "HKCR\.zip\CompressedFolder\ShellNew" /v "FileName" /t REG_SZ /d "%APPDATA%\newzip.dat" /f
- <SYSTEM32>\attrib.exe +R +H +S "%APPDATA%\Microsoft\Windows\spacedots.scr"
- <SYSTEM32>\attrib.exe +R +H +S "%APPDATA%\nvidgfx.exe"
- <SYSTEM32>\attrib.exe -R -H -S "%APPDATA%\nvidgfx.exe"
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe
- <SYSTEM32>\reg.exe ADD "HKCU\software\microsoft\windows\currentversion\run" /v "nvidgfx" /t REG_SZ /d "%APPDATA%\nvidgfx.exe" /f
- <SYSTEM32>\attrib.exe -R -H -S "%APPDATA%\Microsoft\Windows\spacedots.scr"
- <SYSTEM32>\attrib.exe +R +H +S "<SYSTEM32>\atlsyn.exe"
- <SYSTEM32>\attrib.exe -R -H -S "<SYSTEM32>\atlsyn.exe"
- <SYSTEM32>\sc.exe config SSDPSRV start= auto
- <SYSTEM32>\sc.exe config upnphost start= auto
- <SYSTEM32>\netsh.exe firewall set opmode DISABLE
- <SYSTEM32>\sc.exe config browser start= auto
- <SYSTEM32>\net1.exe start upnphost
- <SYSTEM32>\net1.exe start seclogon
- <SYSTEM32>\winlogon.exe
- <SYSTEM32>\rundll32.exe
- <SYSTEM32>\attrib.exe "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe" +s +h
- <SYSTEM32>\notepad.exe
- <SYSTEM32>\netsh.exe firewall add allowedprogram "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe" "winhttpsvc" ENABLE
- <SYSTEM32>\attrib.exe "%WINDIR%\Microsoft.NET\Framework\v2.0.50727" +s +h
- <SYSTEM32>\netsh.exe advfirewall firewall add rule name="Open Port 5220" profile=public dir=in action=allow protocol=TCP localport=5220
- <SYSTEM32>\netsh.exe firewall add portopening TCP 5220 "Open Port 5220"
- <SYSTEM32>\netsh.exe advfirewall firewall add rule name="winhttpsvc" profile=public dir=in action=allow program="%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe" enable=yes
- <SYSTEM32>\notepad.exe
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe
- firefox.exe
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'ProxyOverride' = 'local'
- [<HKLM>\SYSTEM\ControlSet001\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings] 'ProxyEnable' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'ProxyEnable' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'ProxyServer' = '127.0.0.1:5220'
- C:\Documents and Settings\LocalService\Application Data\Microsoft\UPnP Device Host\upnphost\udhisapi.dll
- %APPDATA%\plugininstall.bat
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\lilliili[1].htm
- C:\protect.bat
- C:\autorun.inf
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\mediaguide[1].asp
- <SYSTEM32>\atlsyn.exe
- %APPDATA%\nvidgfx.exe
- %TEMP%\nvidgfx.exe
- %APPDATA%\Microsoft\Windows\spacedots.scr
- %APPDATA%\newzip.dat
- %APPDATA%\errorreporter.exe
- %APPDATA%\auth.dll
- <Drive name for removable media>:\autorun.inf
- %APPDATA%\newzip.dat
- C:\autorun.inf
- C:\protect.bat
- <Drive name for removable media>:\protect.bat
- <SYSTEM32>\atlsyn.exe
- %APPDATA%\nvidgfx.exe
- %APPDATA%\Microsoft\Windows\spacedots.scr
- %APPDATA%\errorreporter.exe
- %APPDATA%\auth.dll
- 'll####lllillll.in':5310
- 'll####lllillll.in':5320
- 'll##l.in':5390
- 'll####lllillll.in':5300
- 'll####lllillll.in':5370
- 'll####lllillll.in':5380
- 'll####lllillll.in':5330
- 'll####lllillll.in':5360
- 'll##l.in':5380
- 'll##l.in':5340
- 'll##l.in':5350
- 'll##l.in':5320
- 'll##l.in':5330
- 'localhost':1085
- 'wi####smedia.com':80
- 'll##l.in':5360
- 'll##l.in':5370
- 'll####lllillll.in':5390
- 'ii###li.info':5310
- 'ii###li.info':5320
- 'ii####liilli.info':5390
- 'ii###li.info':5300
- 'ii###li.info':5350
- 'ii###li.info':5360
- 'ii###li.info':5330
- 'ii###li.info':5340
- 'ii####liilli.info':5380
- 'ii####liilli.info':5320
- 'ii####liilli.info':5330
- 'ii####liilli.info':5300
- 'ii####liilli.info':5310
- 'ii####liilli.info':5360
- 'ii####liilli.info':5370
- 'ii####liilli.info':5340
- 'ii####liilli.info':5350
- 'il##il.in':5310
- 'il##il.in':5320
- 'ii##i.in':5390
- 'il##il.in':5300
- 'il##il.in':5350
- 'il##il.in':5360
- 'il##il.in':5330
- 'il##il.in':5340
- 'ii##i.in':5380
- 'ii##i.in':5320
- 'ii##i.in':5330
- 'ii##i.in':5300
- 'ii##i.in':5310
- 'ii##i.in':5360
- 'ii##i.in':5370
- 'ii##i.in':5340
- 'ii##i.in':5350
- 'il##il.in':5370
- 'li##li.in':5390
- 'localhost':5220
- 'li##li.in':5370
- 'li##li.in':5380
- 'll##l.in':5300
- 'll##l.in':5310
- '74.##5.232.51':80
- 'li###ili.info':80
- 'li##li.in':5360
- 'li##li.in':5300
- 'li##li.in':5310
- 'il##il.in':5380
- 'il##il.in':5390
- 'li##li.in':5340
- 'li##li.in':5350
- 'li##li.in':5320
- 'li##li.in':5330
- wi####smedia.com/redir/mediaguide.asp?WM############################################
- 74.##5.232.51/
- li###ili.info/
- DNS ASK wi####smedia.com
- DNS ASK ll##l.in
- DNS ASK ll####lllillll.in
- DNS ASK ii###li.info
- DNS ASK ii####liilli.info
- DNS ASK il##il.in
- DNS ASK ii##i.in
- DNS ASK li##li.in
- DNS ASK li###ili.info
- DNS ASK google.com
- ClassName: '' WindowName: 'RegCool'
- ClassName: '' WindowName: 'RegAlyzer'
- ClassName: '' WindowName: 'Registry'
- ClassName: '' WindowName: 'System Configuration'
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'WMPlayerApp' WindowName: ''
- ClassName: '' WindowName: 'Registry Editor'
- ClassName: 'ReBarWindow32' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'Indicator' WindowName: ''
- ClassName: 'WMP9DeskBand' WindowName: 'WMP9DeskBand'
- ClassName: '' WindowName: 'System Restore'
- ClassName: 'Type32_Main_Window' WindowName: ''
- ClassName: '' WindowName: ''