Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,%ALLUSERSPROFILE%\Application Data\Microsoft\svchost.exe'
Creates the following files on removable media:
- <Drive name for removable media>:\autorun.inf
Modifies file system :
Creates the following files:
- %ALLUSERSPROFILE%\Application Data\Microsoft\autorun.inf
- %ALLUSERSPROFILE%\Application Data\Microsoft\<Virus name>.exe
Miscellaneous:
Searches for the following windows:
- ClassName: '' WindowName: 'VKontakte | Welcome! - Google Chrome'
- ClassName: '' WindowName: '? ???????? | ?????? ???! - Mozilla Firefox'
- ClassName: '' WindowName: 'VKontakte | Welcome! - Microsoft Internet Explorer'
- ClassName: '' WindowName: 'VKontakte | Welcome! - Opera'
- ClassName: '' WindowName: '? ???????? | ?????? ???! - Opera'
- ClassName: '' WindowName: '? ???????? | ?????? ???! - Google Chrome'
- ClassName: '' WindowName: '? ???????? | ?????? ???! - Windows Internet Explorer'
- ClassName: '' WindowName: '? ???????? | ?????? ???! - Microsoft Internet Explorer'
- ClassName: '' WindowName: '? ???????? | ????? ?????????? - Windows Internet Explorer'
- ClassName: '' WindowName: '? ???????? | ????? ?????????? - Microsoft Internet Explorer'
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: '' WindowName: '? ???????? | ????? ?????????? - Mozilla Firefox'
- ClassName: '' WindowName: 'VKontakte | Welcome! - Mozilla Firefox'
- ClassName: '' WindowName: 'VKontakte | Welcome! - Windows Internet Explorer'
- ClassName: '' WindowName: '? ???????? | ????? ?????????? - Opera'
- ClassName: '' WindowName: '? ???????? | ????? ?????????? - Google Chrome'