Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Remote Procedure Call' = '<Full path to virus>'
- <SYSTEM32>\notepad.exe
- MCAGENT.EXE
- mpftray.exe
- NAVAPW32.EXE
- fsavaui.exe
- fsavgui.exe
- GUARD.EXE
- spidernt.exe
- zapro.exe
- ZONEALARM.EXE
- nod32.exe
- outpost.exe
- smc.exe
- AVP.EXE
- AVP32.EXE
- AVPCC.EXE
- AVGCC32.EXE
- AVGCTRL.EXE
- AVP.COM
- Drweb32w.exe
- fsav.exe
- fsav32.exe
- AVPM.EXE
- AVSYNMGR.EXE
- ccapp.exe
- '31.#2.0.223':445
- '31.#2.0.219':139
- '31.#2.0.225':445
- '31.#2.0.222':445
- '31.#2.0.220':139
- '31.#2.0.220':445
- '31.#2.0.219':445
- '31.#2.0.221':445
- '31.#2.0.227':445
- '31.#2.0.226':139
- '31.#2.0.229':445
- '31.#2.0.230':445
- '31.#2.0.224':445
- '31.#2.0.222':139
- '31.#2.0.226':445
- '31.#2.0.224':139
- '31.#2.0.205':445
- '31.#2.0.213':445
- '31.#2.0.211':139
- '31.#2.0.211':445
- '31.#2.0.208':445
- '31.#2.0.210':445
- '31.#2.0.206':445
- '31.#2.0.212':445
- '31.#2.0.217':445
- '31.#2.0.216':139
- '31.#2.0.218':445
- '31.#2.0.9':139
- '31.#2.0.207':445
- '31.#2.0.214':445
- '31.#2.0.216':445
- '31.#2.0.215':445
- '31.#2.0.242':139
- '31.#2.0.241':445
- '31.#2.0.244':445
- '31.#2.0.241':139
- '31.#2.0.240':445
- '31.#2.0.239':139
- '31.#2.0.242':445
- '31.#2.0.240':139
- '31.#2.0.247':445
- '31.#2.0.246':139
- '31.#2.0.249':445
- '31.#2.0.248':445
- '31.#2.0.243':445
- '31.#2.0.245':445
- '31.#2.0.246':445
- '31.#2.0.244':139
- '31.#2.0.232':139
- '31.#2.0.232':445
- '31.#2.0.236':445
- '31.#2.0.235':445
- '31.#2.0.228':445
- '31.#2.0.230':139
- '31.#2.0.234':139
- '31.#2.0.234':445
- '31.#2.0.238':139
- '31.#2.0.237':445
- '31.#2.0.239':445
- '31.#2.0.237':139
- '31.#2.0.233':445
- '31.#2.0.231':445
- '31.#2.0.238':445
- '31.#2.0.233':139
- '31.#2.0.176':445
- '31.#2.0.181':445
- '31.#2.0.180':445
- '31.#2.0.178':445
- '31.#2.0.175':139
- '31.#2.0.175':445
- '31.#2.0.173':139
- '31.#2.0.173':445
- '31.#2.0.182':139
- '31.#2.0.182':445
- '31.#2.0.184':445
- '31.#2.0.196':445
- '31.#2.0.179':139
- '31.#2.0.179':445
- '31.#2.0.177':139
- '31.#2.0.177':445
- '31.#2.0.166':139
- '31.#2.0.166':445
- '31.#2.0.167':139
- '31.#2.0.167':445
- '31.#2.0.162':445
- '31.#2.0.163':139
- '31.#2.0.165':139
- '31.#2.0.165':445
- '31.#2.0.172':445
- '31.#2.0.169':139
- '31.#2.0.171':445
- '31.#2.0.174':445
- '31.#2.0.168':139
- '31.#2.0.168':445
- '31.#2.0.169':445
- '31.#2.0.170':445
- '31.#2.0.201':139
- '31.#2.0.201':445
- '31.#2.0.200':139
- '31.#2.0.200':445
- '31.#2.0.192':139
- '31.#2.0.192':445
- '31.#2.0.195':445
- '31.#2.0.197':445
- '31.#2.0.203':445
- '31.#2.0.202':445
- '31.#2.0.209':445
- '31.#2.0.203':139
- '31.#2.0.198':139
- '31.#2.0.198':445
- '31.#2.0.199':445
- '31.#2.0.204':445
- '31.#2.0.186':445
- '31.#2.0.183':445
- '31.#2.0.186':139
- '31.#2.0.190':445
- '31.#2.0.184':139
- '31.#2.0.185':445
- '31.#2.0.189':445
- '31.#2.0.194':445
- '31.#2.0.191':139
- '31.#2.0.191':445
- '31.#2.0.187':139
- '31.#2.0.187':445
- '31.#2.0.190':139
- '31.#2.0.188':445
- '31.#2.0.193':445
- '31.#2.0.188':139
- '31.#2.0.145':139
- '31.#2.0.116':139
- '31.#2.0.154':139
- '31.#2.0.114':139
- '31.#2.0.51':139
- '31.#2.0.45':139
- '31.#2.0.119':139
- '31.#2.0.73':139
- '31.#2.0.225':139
- '31.#2.0.205':139
- '31.#2.0.247':139
- '31.#2.0.223':139
- '31.#2.0.171':139
- '31.#2.0.160':139
- '31.#2.0.204':139
- '31.#2.0.180':139
- '31.#2.0.236':139
- '31.#2.0.229':139
- '31.#2.0.245':139
- '31.#2.0.235':139
- '31.#2.0.212':139
- '31.#2.0.210':139
- '31.#2.0.227':139
- '31.#2.0.215':139
- '31.#2.0.28':139
- '31.#2.0.20':139
- '31.#2.0.47':139
- '31.#2.0.37':139
- '31.#2.0.3':139
- '31.#2.0.248':139
- '31.#2.0.19':139
- '31.#2.0.2':139
- '31.#2.0.170':139
- '31.#2.0.105':139
- '31.#2.0.174':139
- '31.#2.0.176':139
- '31.#2.0.255':139
- '31.#2.0.228':139
- '31.#2.0.43':139
- '31.#2.0.24':139
- '31.#2.0.231':139
- '31.#2.0.183':139
- '31.#2.0.218':139
- '31.#2.0.124':139
- '31.#2.0.213':139
- '31.#2.0.195':139
- '31.#2.0.32':139
- '31.#2.0.243':139
- '31.#2.0.141':139
- '31.#2.0.140':139
- '31.#2.0.178':139
- '31.#2.0.149':139
- '31.#2.0.87':139
- '31.#2.0.29':139
- '31.#2.0.142':139
- '31.#2.0.96':139
- '31.#2.0.214':139
- '31.#2.0.199':139
- '31.#2.0.221':139
- '31.#2.0.217':139
- '31.#2.0.148':139
- '31.#2.0.153':139
- '31.#2.0.197':139
- '31.#2.0.193':139
- '31.#2.0.30':139
- '31.#2.0.25':139
- '31.#2.0.40':139
- '31.#2.0.38':139
- '31.#2.0.17':139
- '31.#2.0.16':139
- '31.#2.0.21':139
- '31.#2.0.33':139
- '31.#2.0.70':139
- '31.#2.0.54':139
- '31.#2.0.69':139
- '31.#2.0.62':139
- '31.#2.0.48':139
- '31.#2.0.42':139
- '31.#2.0.52':139
- '31.#2.0.49':139
- '31.#2.0.251':445
- '31.#2.0.252':139
- '31.#2.0.253':445
- '31.#2.0.251':139
- '31.#2.0.250':445
- '31.#2.0.249':139
- '31.#2.0.252':445
- '31.#2.0.250':139
- '31.#2.0.0':139
- '31.#2.0.0':445
- '31.#2.0.10':139
- '31.#2.0.6':139
- '31.#2.0.255':445
- '31.#2.0.253':139
- '31.#2.0.254':139
- '31.#2.0.254':445
- '31.#2.0.172':139
- '31.#2.0.162':139
- '31.#2.0.185':139
- '31.#2.0.181':139
- '31.#2.0.157':139
- '31.#2.0.147':139
- '31.#2.0.159':139
- '31.#2.0.156':139
- '31.#2.0.208':139
- '31.#2.0.206':139
- '31.#2.0.209':139
- '31.#2.0.207':139
- '31.#2.0.194':139
- '31.#2.0.189':139
- '31.#2.0.202':139
- '31.#2.0.196':139
- '31.#2.0.99':139
- '31.#2.0.97':139
- '31.#2.0.107':139
- '31.#2.0.102':139
- '31.#2.0.66':139
- '31.#2.0.72':139
- '31.#2.0.91':139
- '31.#2.0.84':139
- '31.#2.0.132':139
- '31.#2.0.130':139
- '31.#2.0.138':139
- '31.#2.0.136':139
- '31.#2.0.111':139
- '31.#2.0.106':139
- '31.#2.0.125':139
- '31.#2.0.112':139
- '31.#2.0.163':445
- '31.#2.0.58':445
- '31.#2.0.59':139
- '31.#2.0.56':445
- '31.#2.0.58':139
- '31.#2.0.59':445
- '31.#2.0.55':139
- '31.#2.0.57':139
- '31.#2.0.57':445
- '31.#2.0.61':139
- '31.#2.0.61':445
- '31.#2.0.63':445
- '31.#2.0.62':445
- '31.#2.0.56':139
- '31.#2.0.42':445
- '31.#2.0.60':139
- '31.#2.0.60':445
- '31.#2.0.48':445
- '31.#2.0.46':139
- '31.#2.0.52':445
- '31.#2.0.51':445
- '31.#2.0.44':139
- '31.#2.0.43':445
- '31.#2.0.46':445
- '31.#2.0.45':445
- '31.#2.0.53':139
- '31.#2.0.53':445
- '31.#2.0.55':445
- '31.#2.0.54':445
- '31.#2.0.50':445
- '31.#2.0.49':445
- '31.#2.0.47':445
- '31.#2.0.50':139
- '31.#2.0.75':139
- '31.#2.0.75':445
- '31.#2.0.76':139
- '31.#2.0.76':445
- '31.#2.0.73':445
- '31.#2.0.72':445
- '31.#2.0.74':139
- '31.#2.0.74':445
- '31.#2.0.79':139
- '31.#2.0.78':139
- '31.#2.0.80':139
- '31.#2.0.80':445
- '31.#2.0.77':139
- '31.#2.0.77':445
- '31.#2.0.79':445
- '31.#2.0.78':445
- '31.#2.0.94':445
- '31.#2.0.65':139
- '31.#2.0.66':445
- '31.#2.0.94':139
- '31.#2.0.64':445
- '31.#2.0.63':139
- '31.#2.0.65':445
- '31.#2.0.64':139
- '31.#2.0.70':445
- '31.#2.0.69':445
- '31.#2.0.71':139
- '31.#2.0.71':445
- '31.#2.0.67':139
- '31.#2.0.67':445
- '31.#2.0.68':139
- '31.#2.0.68':445
- '31.#2.0.13':445
- '31.#2.0.15':445
- '31.#2.0.15':139
- '31.#2.0.13':139
- '31.#2.0.11':445
- '31.#2.0.12':445
- '31.#2.0.11':139
- '31.#2.0.12':139
- '31.#2.0.14':139
- '31.#2.0.14':445
- '31.#2.0.20':445
- '31.#2.0.19':445
- '31.#2.0.17':445
- '31.#2.0.16':445
- '31.#2.0.18':139
- '31.#2.0.18':445
- '31.#2.0.4':445
- '31.#2.0.3':445
- '31.#2.0.8':445
- '31.#2.0.4':139
- '31.#2.0.1':445
- 'localhost':445
- '31.#2.0.2':445
- '31.#2.0.1':139
- '31.#2.0.6':445
- '31.#2.0.7':445
- '31.#2.0.10':445
- '31.#2.0.7':139
- '31.#2.0.5':445
- '31.#2.0.9':445
- '31.#2.0.5':139
- '31.#2.0.8':139
- '31.#2.0.36':445
- '31.#2.0.37':445
- '31.#2.0.38':445
- '31.#2.0.36':139
- '31.#2.0.33':445
- '31.#2.0.30':445
- '31.#2.0.34':139
- '31.#2.0.34':445
- '31.#2.0.41':445
- '31.#2.0.40':445
- '31.#2.0.44':445
- '31.#2.0.41':139
- '31.#2.0.39':139
- '31.#2.0.39':445
- '31.#2.0.35':139
- '31.#2.0.35':445
- '31.#2.0.28':445
- '31.#2.0.24':445
- '31.#2.0.31':139
- '31.#2.0.31':445
- '31.#2.0.23':139
- '31.#2.0.23':445
- '31.#2.0.27':139
- '31.#2.0.27':445
- '31.#2.0.22':139
- '31.#2.0.22':445
- '31.#2.0.25':445
- '31.#2.0.32':445
- '31.#2.0.26':445
- '31.#2.0.29':445
- '31.#2.0.21':445
- '31.#2.0.26':139
- '31.#2.0.131':139
- '31.#2.0.131':445
- '31.#2.0.132':445
- '31.#2.0.160':445
- '31.#2.0.129':445
- '31.#2.0.128':139
- '31.#2.0.130':445
- '31.#2.0.129':139
- '31.#2.0.137':445
- '31.#2.0.136':445
- '31.#2.0.138':445
- '31.#2.0.137':139
- '31.#2.0.134':445
- '31.#2.0.135':445
- '31.#2.0.134':139
- '31.#2.0.135':139
- '31.#2.0.123':445
- '31.#2.0.121':139
- '31.#2.0.152':445
- '31.#2.0.123':139
- '31.#2.0.122':445
- '31.#2.0.120':139
- '31.#2.0.121':445
- '31.#2.0.122':139
- '31.#2.0.127':445
- '31.#2.0.126':139
- '31.#2.0.128':445
- '31.#2.0.127':139
- '31.#2.0.124':445
- '31.#2.0.152':139
- '31.#2.0.126':445
- '31.#2.0.125':445
- '31.#2.0.153':445
- '31.#2.0.150':139
- '31.#2.0.155':445
- '31.#2.0.154':445
- '31.#2.0.151':445
- '31.#2.0.148':445
- '31.#2.0.150':445
- '31.#2.0.151':139
- '31.#2.0.159':445
- '31.#2.0.158':139
- '31.#2.0.161':139
- '31.#2.0.161':445
- '31.#2.0.156':445
- '31.#2.0.155':139
- '31.#2.0.158':445
- '31.#2.0.157':445
- '31.#2.0.164':445
- '31.#2.0.142':445
- '31.#2.0.145':445
- '31.#2.0.144':445
- '31.#2.0.139':139
- '31.#2.0.139':445
- '31.#2.0.140':445
- '31.#2.0.141':445
- '31.#2.0.146':139
- '31.#2.0.146':445
- '31.#2.0.149':445
- '31.#2.0.147':445
- '31.#2.0.144':139
- '31.#2.0.164':139
- '31.#2.0.143':139
- '31.#2.0.143':445
- '31.#2.0.92':139
- '31.#2.0.92':445
- '31.#2.0.93':139
- '31.#2.0.93':445
- '31.#2.0.90':445
- '31.#2.0.97':445
- '31.#2.0.91':445
- '31.#2.0.90':139
- '31.#2.0.100':445
- '31.#2.0.98':139
- '31.#2.0.99':445
- '31.#2.0.100':139
- '31.#2.0.95':139
- '31.#2.0.95':445
- '31.#2.0.98':445
- '31.#2.0.96':445
- '31.#2.0.83':139
- '31.#2.0.83':445
- '31.#2.0.85':445
- '31.#2.0.84':445
- '31.#2.0.81':139
- '31.#2.0.81':445
- '31.#2.0.82':139
- '31.#2.0.82':445
- '31.#2.0.89':139
- '31.#2.0.89':445
- '31.#2.0.88':139
- '31.#2.0.88':445
- '31.#2.0.86':445
- '31.#2.0.85':139
- '31.#2.0.87':445
- '31.#2.0.86':139
- '31.#2.0.112':445
- '31.#2.0.111':445
- '31.#2.0.113':139
- '31.#2.0.113':445
- '31.#2.0.115':139
- '31.#2.0.115':445
- '31.#2.0.133':139
- '31.#2.0.133':445
- '31.#2.0.118':139
- '31.#2.0.118':445
- '31.#2.0.120':445
- '31.#2.0.119':445
- '31.#2.0.116':445
- '31.#2.0.114':445
- '31.#2.0.117':139
- '31.#2.0.117':445
- '31.#2.0.105':445
- '31.#2.0.103':139
- '31.#2.0.104':139
- '31.#2.0.104':445
- '31.#2.0.101':139
- '31.#2.0.101':445
- '31.#2.0.102':445
- '31.#2.0.103':445
- '31.#2.0.109':139
- '31.#2.0.109':445
- '31.#2.0.110':139
- '31.#2.0.110':445
- '31.#2.0.108':445
- '31.#2.0.106':445
- '31.#2.0.108':139
- '31.#2.0.107':445
- ClassName: 'Shell_TrayWnd' WindowName: ''