Trojan.MulDrop4.58416

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemOptimizer.exe] 'Debugger' = '%TEMP%\svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemControl.exe] 'Debugger' = '%TEMP%\svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UninstallManager.exe] 'Debugger' = '%TEMP%\svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinStylerThemeSvc.exe] 'Debugger' = '%TEMP%\svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Shredder.exe] 'Debugger' = '%TEMP%\svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgserv.exe] 'Debugger' = '%TEMP%\svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HijackThis.exe] 'Debugger' = '%TEMP%\svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PMLauncher.exe] 'Debugger' = '%TEMP%\svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ProcessManager.exe] 'Debugger' = '%TEMP%\svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bcw.exe] 'Debugger' = '%TEMP%\svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\serv.exe] 'Debugger' = '%TEMP%\svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sched.exe] 'Debugger' = '%TEMP%\svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bcb.exe] 'Debugger' = '%TEMP%\svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bdagent.exe] 'Debugger' = '%TEMP%\svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RescueCenter.exe] 'Debugger' = '%TEMP%\svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Undelete.exe] 'Debugger' = '%TEMP%\svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iknow process.exe] 'Debugger' = '%TEMP%\svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe] 'Debugger' = '%TEMP%\svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CProcess.exe] 'Debugger' = '%TEMP%\svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinRaR.exe] 'Debugger' = '%TEMP%\svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\denyexe.exe] 'Debugger' = '%TEMP%\svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\System Mechanic PROfessional v-5.0a.exe] 'Debugger' = '%TEMP%\svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QuickTimeInstaller.exe] 'Debugger' = '%TEMP%\svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msmsgs.exe] 'Debugger' = '%TEMP%\svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VBRezQ.exe] 'Debugger' = '%TEMP%\svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VB6.EXE] 'Debugger' = '%TEMP%\svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WindowsDefender.msi] 'Debugger' = '%TEMP%\svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bou1.exe] 'Debugger' = '%TEMP%\svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bou.exe] 'Debugger' = '%TEMP%\svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FrzState2k.exe] 'Debugger' = '%TEMP%\svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DF5serv.exe] 'Debugger' = '%TEMP%\svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Babon.exe] 'Debugger' = '%TEMP%\svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ShowKillProcess.exe] 'Debugger' = '%TEMP%\svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Visual Studio.exe] 'Debugger' = '%TEMP%\svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KeRe.exe] 'Debugger' = '%TEMP%\svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Cewek_Imoet.exe] 'Debugger' = '%TEMP%\svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VB5.exe] 'Debugger' = '%TEMP%\svchost.exe'
[<HKLM>\SOFTWARE\Classes\Msi.Patch\shell\Open\command] '' = '<SYSTEM32>\shell.exe'
[<HKLM>\SOFTWARE\Classes\Msi.Package\shell\Open\command] '' = '<SYSTEM32>\shell.exe'
[<HKLM>\SOFTWARE\Classes\mpegfile\shell\open\command] '' = '<SYSTEM32>\shell.exe'
[<HKLM>\SOFTWARE\Classes\fndfile\shell\open\command] '' = '<SYSTEM32>\shell.exe'
[<HKLM>\SOFTWARE\Classes\MSInfo.Document\Shell\Open\Command] '' = '<SYSTEM32>\shell.exe'
[<HKLM>\SOFTWARE\Classes\chm.file\shell\open\command] '' = '<SYSTEM32>\shell.exe'
[<HKLM>\SOFTWARE\Classes\lnkfile\shell\open\command] '' = '<SYSTEM32>\shell.exe'
[<HKLM>\SOFTWARE\Classes\WinRAR\shell\open\command] '' = '<SYSTEM32>\shell.exe'
[<HKLM>\SOFTWARE\Classes\mailto\shell\open\command] '' = '<SYSTEM32>\shell.exe'
[<HKLM>\SOFTWARE\Classes\Directory\shell\open\command] '' = '%WINDIR%\MySharona.exe'
[<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'Explorer.Exe "%WINDIR%\MySharona.exe"'
[<HKLM>\SOFTWARE\Classes\Folder\shell\open\command] '' = '%WINDIR%\MySharona.exe'
[<HKLM>\SOFTWARE\Classes\Drive\shell\open\command] '' = '%WINDIR%\MySharona.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\Userinit.Exe, %WINDIR%\MySharona.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'Explorer.Exe "%WINDIR%\MySharona.exe"'
[<HKCU>\Control Panel\Desktop] 'SCRNSAVE.EXE' = '<SYSTEM32>\MySharona.scr'
[<HKLM>\SOFTWARE\Microsoft\Command Processor] 'Autorun' = '%WINDIR%\MySharona.exe'
[<HKCU>\Software\Microsoft\Command Processor] 'Autorun' = '%WINDIR%\MySharona.exe'
[<HKLM>\SOFTWARE\Classes\3gpfile\shell\open\command] '' = '<SYSTEM32>\shell.exe'
[<HKLM>\SOFTWARE\Classes\mpgfile\shell\open\command] '' = '<SYSTEM32>\shell.exe'
[<HKLM>\SOFTWARE\Classes\jpegfile\shell\open\command] '' = '<SYSTEM32>\shell.exe'
[<HKLM>\SOFTWARE\Classes\jpgfile\shell\open\command] '' = '<SYSTEM32>\shell.exe'
[<HKLM>\SOFTWARE\Classes\wavfile\shell\open\command] '' = '<SYSTEM32>\shell.exe'
[<HKLM>\SOFTWARE\Classes\AVIFile\shell\open\command] '' = '<SYSTEM32>\shell.exe'
[<HKLM>\SOFTWARE\Classes\scrfile\shell\open\command] '' = '<SYSTEM32>\shell.exe'
[<HKLM>\SOFTWARE\Classes\mp3file\shell\open\command] '' = '<SYSTEM32>\shell.exe'
[<HKLM>\SOFTWARE\Classes\datfile\shell\open\command] '' = '<SYSTEM32>\shell.exe'
[<HKLM>\SOFTWARE\Classes\regfile\shell\open\command] '' = '<SYSTEM32>\shell.exe'
[<HKLM>\SOFTWARE\Classes\regedit\shell\open\command] '' = '<SYSTEM32>\shell.exe'
[<HKLM>\SOFTWARE\Classes\inifile\shell\open\command] '' = '<SYSTEM32>\shell.exe'
[<HKLM>\SOFTWARE\Classes\hlpfile\shell\open\command] '' = '<SYSTEM32>\shell.exe'
[<HKLM>\SOFTWARE\Classes\cmdfile\shell\open\command] '' = '<SYSTEM32>\shell.exe'
[<HKLM>\SOFTWARE\Classes\batfile\shell\open\command] '' = '<SYSTEM32>\shell.exe'
[<HKLM>\SOFTWARE\Classes\bmpfile\shell\open\command] '' = '<SYSTEM32>\shell.exe'
[<HKLM>\SOFTWARE\Classes\piffile\shell\open\command] '' = '<SYSTEM32>\shell.exe'
[<HKLM>\SOFTWARE\Classes\comfile\shell\open\command] '' = '<SYSTEM32>\shell.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV.exe] 'Debugger' = '%TEMP%\svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\keygen.exe] 'Debugger' = '%TEMP%\svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\the killer.exe] 'Debugger' = '%TEMP%\svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ScanVirus.exe] 'Debugger' = '%TEMP%\svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AntiVirX.exe] 'Debugger' = '%TEMP%\svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NGenFix.exe] 'Debugger' = '%TEMP%\svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NVC581_R8ENG.EXE] 'Debugger' = '%TEMP%\svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\A.N.S.[AV].32.EXE] 'Debugger' = '%TEMP%\svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Fix-Naki-Lightmoon-Mybro.exe] 'Debugger' = '%TEMP%\svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Acrobat.exe] 'Debugger' = '%TEMP%\svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mplayerc.exe] 'Debugger' = '%TEMP%\svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spider.exe] 'Debugger' = '%TEMP%\svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sol.exe] 'Debugger' = '%TEMP%\svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setup.exe] 'Debugger' = '%TEMP%\svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Antiv.exe] 'Debugger' = '%TEMP%\svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ViRemover.exe] 'Debugger' = '%TEMP%\svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\install.exe] 'Debugger' = '%TEMP%\svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\agentsvr.exe] 'Debugger' = '%TEMP%\svchost.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] '3' = '<LS_APPDATA>\smss.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] '2' = '<LS_APPDATA>\lsass.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Notepad.exe] 'Debugger' = '%TEMP%\svchost.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] '4' = '<LS_APPDATA>\csrss.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] '1' = '%WINDIR%\MySharona.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Nenen' = '<LS_APPDATA>\lsass.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Nvidia' = '%WINDIR%\MySharona.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '6 August 86' = '<LS_APPDATA>\csrss.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'MySharona' = '<LS_APPDATA>\smss.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmanager17.exe] 'Debugger' = '%TEMP%\svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cav-0.91.exe] 'Debugger' = '%TEMP%\svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reset_registry_settings.bat] 'Debugger' = '%TEMP%\svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\worm remover.exe] 'Debugger' = '%TEMP%\svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bw.exe] 'Debugger' = '%TEMP%\svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ANSAV32.exe] 'Debugger' = '%TEMP%\svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kill Virus.exe] 'Debugger' = '%TEMP%\svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Kav.exe] 'Debugger' = '%TEMP%\svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\antivir_workstation_win7u_en_h.exe] 'Debugger' = '%TEMP%\svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bckgzm.exe] 'Debugger' = '%TEMP%\svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe] 'Debugger' = '%TEMP%\svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mplay32.exe] 'Debugger' = '%TEMP%\svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe] 'Debugger' = '%TEMP%\svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mspaint.exe] 'Debugger' = '%TEMP%\svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshearts.exe] 'Debugger' = '%TEMP%\svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dfrg.msc] 'Debugger' = '%TEMP%\svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\desktop.ini] 'Debugger' = '%TEMP%\svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe] 'Debugger' = '%TEMP%\svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dxdiag.exe] 'Debugger' = '%TEMP%\svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DF6Ent 6.00.220.1523.exe] 'Debugger' = '%TEMP%\svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\df5std.exe] 'Debugger' = '%TEMP%\svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\qttask.exe] 'Debugger' = '%TEMP%\svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kav6.0.2.614en.exe] 'Debugger' = '%TEMP%\svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DeepFreezeSTDEval.exe] 'Debugger' = '%TEMP%\svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wuauclt.exe] 'Debugger' = '%TEMP%\svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winmine.exe] 'Debugger' = '%TEMP%\svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DeepFreezeSTD.exe] 'Debugger' = '%TEMP%\svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gpedit.msc.exe] 'Debugger' = '%TEMP%\svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RegistryEditor.exe] 'Debugger' = '%TEMP%\svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RegistryDefrag.exe] 'Debugger' = '%TEMP%\svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinStyler.exe] 'Debugger' = '%TEMP%\svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\StartUpManager.exe] 'Debugger' = '%TEMP%\svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RegistryCleaner.exe] 'Debugger' = '%TEMP%\svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Integrator.exe] 'Debugger' = '%TEMP%\svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DiskCleaner.exe] 'Debugger' = '%TEMP%\svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\OneClickMaintenance.exe] 'Debugger' = '%TEMP%\svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MemOptimizer.exe] 'Debugger' = '%TEMP%\svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cleanmgr.exe] 'Debugger' = '%TEMP%\svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\freecell.exe] 'Debugger' = '%TEMP%\svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe] 'Debugger' = '%TEMP%\svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe] 'Debugger' = '%TEMP%\svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winhelp.exe] 'Debugger' = '%TEMP%\svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe] 'Debugger' = '%TEMP%\svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PINBALL.EXE] 'Debugger' = '%TEMP%\svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\uninstall.exe] 'Debugger' = '%TEMP%\svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe] 'Debugger' = '%TEMP%\svchost.exe'

Creates or modifies the following files:

%HOMEPATH%\Start Menu\Programs\Startup\%USERNAME%.jpg.VBS
%HOMEPATH%\Start Menu\Programs\Startup\%USERNAME%.exe
%ALLUSERSPROFILE%\Start Menu\Programs\Startup\default.exe

Creates the following services:

[<HKLM>\SYSTEM\ControlSet002\Services\SHARONA] 'Start' = '00000002'
[<HKLM>\SYSTEM\ControlSet001\Services\SHARONA] 'Start' = '00000002'

Malicious functions:

To complicate detection of its presence in the operating system,

forces the system hide from view:

hidden files
file extensions

blocks the following features:

System Restore (SR)
Windows Security Center

Creates and executes the following:

'<LS_APPDATA>\csrss.exe'
'<LS_APPDATA>\services.exe'
'<LS_APPDATA>\smss.exe'
'%WINDIR%\MySharona.exe'
'<LS_APPDATA>\lsass.exe'

Modifies settings of Windows Explorer:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoStartMenuSubFolders' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoSecurityTab' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoSMHelp' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoCommonGroups' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoFileMenu' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoNetHood' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoManageMyComputerVerb' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoShellSearchButton' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoSMMyPictures' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoTrayItemsDisplay' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoStartMenuMFUprogramsList' = '00000001'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer] 'NoFolderOptions' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoDesktop' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoStartMenuMyMusic' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoSMMyDocs' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoStartMenuPinnedList' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoSimpleStartMenu' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoSetTaskbar' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoSetFolders' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoViewContextMenu' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoTrayContextMenu' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoFind' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoClose' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoControlPanel' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoRun' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoUserNameInStartMenu' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoActiveDesktop' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoStartMenuMorePrograms' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoRecentDocsMenu' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoFavoritesMenu' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoFolderOptions' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoLogoff' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoChangeStartMenu' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoThemesTab' = '00000001'

Modifies file system :

Creates the following files:

<LS_APPDATA>\WINDOWS\MySharona.exe
<LS_APPDATA>\WINDOWS\winlogon.exe
<LS_APPDATA>\WINDOWS\shell.exe
<LS_APPDATA>\lsass.exe
<LS_APPDATA>\smss.exe
<LS_APPDATA>\csrss.exe
<LS_APPDATA>\WINDOWS\csrss.exe
%WINDIR%\msvbvm50.dll
%WINDIR%\msvbvm60.dll
<LS_APPDATA>\WINDOWS\services.exe
<LS_APPDATA>\WINDOWS\lsass.exe
<LS_APPDATA>\WINDOWS\smss.exe
<SYSTEM32>\MySharona.scr
%TEMP%\svchost.exe
<SYSTEM32>\shell.exe
%WINDIR%\MySharona.exe
%WINDIR%\Sharona hate %USERNAME%.exe
<LS_APPDATA>\winlogon.exe
<LS_APPDATA>\shell.exe
<LS_APPDATA>\services.exe
<SYSTEM32>\kernel.sys
C:\Documents and Settings\Default User\Start Menu\Programs\Startup\default.exe
<LS_APPDATA>\MySharona.exe

Sets the 'hidden' attribute to the following files:

<LS_APPDATA>\WINDOWS\csrss.exe
<LS_APPDATA>\WINDOWS\winlogon.exe
<LS_APPDATA>\WINDOWS\smss.exe
<LS_APPDATA>\services.exe
<LS_APPDATA>\WINDOWS\lsass.exe
<LS_APPDATA>\WINDOWS\shell.exe
%WINDIR%\msvbvm50.dll
%WINDIR%\msvbvm60.dll
C:\Documents and Settings\Default User\Start Menu\Programs\Startup\default.exe
<LS_APPDATA>\WINDOWS\services.exe
%ALLUSERSPROFILE%\Start Menu\Programs\Startup\default.exe
<LS_APPDATA>\shell.exe
<SYSTEM32>\MySharona.scr
%TEMP%\svchost.exe
%WINDIR%\Sharona hate %USERNAME%.exe
%HOMEPATH%\Start Menu\Programs\Startup\%USERNAME%.jpg.VBS
%WINDIR%\MySharona.exe
<SYSTEM32>\shell.exe
<LS_APPDATA>\csrss.exe
<LS_APPDATA>\winlogon.exe
<LS_APPDATA>\smss.exe
<SYSTEM32>\kernel.sys
<LS_APPDATA>\lsass.exe

Miscellaneous:

Searches for the following windows:

ClassName: '(null)' WindowName: 'Deep Freeze 5'
ClassName: '(null)' WindowName: 'Deep Freeze 6'
ClassName: '(null)' WindowName: 'System Restore'
ClassName: '(null)' WindowName: 'Select Drive'
ClassName: '(null)' WindowName: 'Kaspersky'
ClassName: '(null)' WindowName: 'Temporary Internet Files'
ClassName: '(null)' WindowName: 'Deep Freeze STD'
ClassName: '(null)' WindowName: 'User Accounts'
ClassName: '(null)' WindowName: 'Local Settings'
ClassName: '(null)' WindowName: 'Luke Filewalker'
ClassName: '(null)' WindowName: 'AntiVir PersonalEdition Classic'
ClassName: '(null)' WindowName: 'CProcess'
ClassName: '(null)' WindowName: 'Antivirus'
ClassName: '(null)' WindowName: 'Display Properties'
ClassName: '(null)' WindowName: 'Application Data'
ClassName: '(null)' WindowName: 'Killer Machine'
ClassName: '(null)' WindowName: 'The Killer Machine'
ClassName: '(null)' WindowName: 'Network Connections'
ClassName: '(null)' WindowName: 'Printers and Faxes'
ClassName: '(null)' WindowName: 'Administrative Tools'
ClassName: '(null)' WindowName: 'Fonts'
ClassName: '(null)' WindowName: 'Open'
ClassName: '(null)' WindowName: 'Run'
ClassName: '(null)' WindowName: 'Scheduled Tasks'
ClassName: '(null)' WindowName: 'Search Results'
ClassName: '(null)' WindowName: 'Jasakom - Mozzila Firefox'
ClassName: '(null)' WindowName: 'Safely Remove Hardware'
ClassName: '(null)' WindowName: 'Power Options Properties'
ClassName: '(null)' WindowName: '<SYSTEM32>\cmd.exe'
ClassName: '(null)' WindowName: 'C:\WINNT\system32\cmd.exe'
ClassName: '(null)' WindowName: 'Save As'
ClassName: '(null)' WindowName: 'Google - Mozzila Firefox'
ClassName: '(null)' WindowName: 'TuneUp StartUp Manager'
ClassName: '(null)' WindowName: 'ViRemoval CRC32'
ClassName: '(null)' WindowName: 'ScanVirus'
ClassName: '(null)' WindowName: 'Command Prompt'
ClassName: '(null)' WindowName: 'Recycle Bin'
ClassName: '(null)' WindowName: 'Group Policy'
ClassName: '(null)' WindowName: 'Text Formatting'
ClassName: '(null)' WindowName: 'Add or Remove Programs'
ClassName: '(null)' WindowName: 'WindowsInstaller'
ClassName: '(null)' WindowName: 'System Configuration Utility'
ClassName: '(null)' WindowName: 'Control Panel'
ClassName: '(null)' WindowName: 'WINNT'
ClassName: '(null)' WindowName: 'Registry Editor'
ClassName: '(null)' WindowName: 'Windows Task Manager'
ClassName: '(null)' WindowName: 'sharonas'
ClassName: 'Indicator' WindowName: '(null)'
ClassName: '(null)' WindowName: 'RECYCLER'
ClassName: '(null)' WindowName: 'Taskbar and Start Menu Properties'
ClassName: '(null)' WindowName: 'Process Viewer'
ClassName: '(null)' WindowName: 'Open With'
ClassName: '(null)' WindowName: 'TuneUp Process Manager'
ClassName: '(null)' WindowName: 'TuneUp Registry Editor'
ClassName: '(null)' WindowName: 'G TaskMan'
ClassName: '(null)' WindowName: 'TuneUp RegistryCleaner'
ClassName: '(null)' WindowName: 'Kaspersky Lab'
ClassName: '(null)' WindowName: 'AntiVirX'
ClassName: '(null)' WindowName: 'VBRezQ'
ClassName: '(null)' WindowName: 'I*n*d*o*prog v_i_rus s*c*a*n*ner'
ClassName: '(null)' WindowName: 'ShowKillProcess'
ClassName: '(null)' WindowName: 'An'
ClassName: '(null)' WindowName: 'Tuneup Utilities'
ClassName: '(null)' WindowName: 'CompactbyteAV'
ClassName: '(null)' WindowName: 'Norman Generic Fix'
ClassName: '(null)' WindowName: 'CurrProcess'
ClassName: '(null)' WindowName: 'Lock Folder 3.0'
ClassName: '(null)' WindowName: 'Pemantau dan Penghapus Proses/File Jahat'
ClassName: '(null)' WindowName: 'Anti...worm - www.gdata.pl/eng'

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial