Technical Information
- [<HKLM>\SOFTWARE\Classes\MSProgramGroup\Shell\Open\Command] '' = '<SYSTEM32>\grpconv.exe %1'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'GrpConv' = 'grpconv -o'
- [<HKLM>\SOFTWARE\Classes\exefile\shell\open\command] '' = '"%1" %*'
- C:\<Virus name>\grep.cfexe -Fqi ".CFEXE;"
- C:\<Virus name>\vfind.cfexe -ltf kmd.dat c.bat
- C:\<Virus name>\sed.cfexe -R "/-/!d;s/.* (\d{4})-(\d\d)-(\d\d) .*/(\1*365+\2*30+\3)/"
- <SYSTEM32>\CF25656.exe /S /D /c" echo..COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH"
- C:\<Virus name>\grep.cfexe -sq "currentversion.* 6.0" osVer00
- <SYSTEM32>\CF25656.exe /c VER
- C:\<Virus name>\grep.cfexe -sq "Microsoft Windows .*\[Version [56]"
- <SYSTEM32>\CF25656.exe /S /D /c" 1>sum.bat ( sed "N;s/\n/-/;s/^/@set \/a sum=&/" )"
- C:\<Virus name>\nircmd.cfexe sysrefresh intl
- <SYSTEM32>\CF25656.exe /S /D /c" ver"
- C:\<Virus name>\grep.cfexe -Fisq "Version 6"
- C:\<Virus name>\swreg.cfexe copy "hku\.default\control panel\international_combofixbackup" "hku\.default\control panel\international" /s
- C:\<Virus name>\sed.cfexe "N;s/\n/-/;s/^/@set \/a sum=&/"
- C:\<Virus name>\nircmd.cfexe Infobox "Current date is Fri 10/12/2012.~n~nThis copy of ComboFix has expired.~nPlease download an updated copy" "Expired - 08-03-13.1"
- C:\<Virus name>\swreg.cfexe copy "hkcu\control panel\international_combofixbackup" "hkcu\control panel\international" /s
- C:\327882R2FWJFW\swxcacls.cfexe "%systemroot%\system32\cmd.exe" /oa /p /ga:f /gs:f /gp:x /gu:x /q
- C:\327882R2FWJFW\swreg.cfexe acl "hklm\software\microsoft\windows nt\currentversion\windows" /de:f /q
- C:\327882R2FWJFW\swreg.cfexe query "hklm\software\microsoft\windows nt\currentversion\windows"
- C:\327882R2FWJFW\swreg.cfexe import 327882R2FWJFW\exe.reg
- C:\327882R2FWJFW\nircmd.com Script 327882R2FWJFW\NirCmd.exe
- C:\327882R2FWJFW\nircmd.com execmd >327882R2FWJFW\env.tmp echo.
- C:\327882R2FWJFW\nircmd.com execmd " set ~qkmd=CF%random%.exe~q && set ~qcfldr=327882R2FWJFW~q && call copy /y "<SYSTEM32>\cmd.exe" "<SYSTEM32>\%kmd%" && call "<SYSTEM32>\%kmd%" /f:off /d /c "Start_.cmd" &&echo. "
- <SYSTEM32>\CF25656.exe /f:off /d /c "Start_.cmd"
- <SYSTEM32>\CF25656.exe /c "C:\<Virus name>\c.bat"
- C:\<Virus name>\nircmd.com execmd del Start_.cmd
- C:\<Virus name>\swreg.cfexe query "hklm\software\microsoft\windows nt\currentversion" /v currentversion
- <SYSTEM32>\CF25656.exe /S /D /c" DIR /AD/B "
- C:\327882R2FWJFW\nircmd.com win close ititle "ComboFix"
- C:\327882R2FWJFW\nircmd.com killprocess cmd.exe
- <SYSTEM32>\CF25656.exe /S /D /c" ver "
- <SYSTEM32>\findstr.exe -IVX ComboFix
- <SYSTEM32>\findstr.exe -LIXC:"<Virus name>" dirname00
- %WINDIR%\regedit.exe /s fin.dat
- <SYSTEM32>\findstr.exe -c:"[Version 6.0"
- <SYSTEM32>\rundll32.exe setupapi.dll,InstallHinfSection DefaultInstall 132 327882R2FWJFW\Nircmd.scr
- <SYSTEM32>\runonce.exe -r
- <SYSTEM32>\grpconv.exe -o
- C:\327882R2FWJFW\region.dat
- C:\327882R2FWJFW\rogues.dat
- C:\327882R2FWJFW\safeboot.dat
- C:\327882R2FWJFW\NetworkService.dat
- C:\327882R2FWJFW\Policies.dat
- C:\327882R2FWJFW\Purity.dat
- C:\327882R2FWJFW\svchost.dat
- C:\327882R2FWJFW\svchost.vista.dat
- C:\327882R2FWJFW\system_ini.dat
- C:\327882R2FWJFW\safeboot.def.dat
- C:\327882R2FWJFW\safeboot.def.vista.dat
- C:\327882R2FWJFW\svc_wht.dat
- C:\327882R2FWJFW\Fin.dat
- C:\327882R2FWJFW\LocalService.dat
- C:\327882R2FWJFW\LocalServiceNetworkRestricted.dat
- C:\327882R2FWJFW\clsid.dat
- C:\327882R2FWJFW\Creg.dat
- C:\327882R2FWJFW\executables.dat
- C:\327882R2FWJFW\netsvc.dat
- C:\327882R2FWJFW\netsvc.vista.dat
- C:\327882R2FWJFW\netsvc.xp.dat
- C:\327882R2FWJFW\LocalSystemNetworkRestricted.dat
- C:\327882R2FWJFW\ndis_combofix.dat
- C:\327882R2FWJFW\netsvc.bad.dat
- C:\327882R2FWJFW\whitedirB.dat
- C:\327882R2FWJFW\SvcDrv.vbs
- C:\327882R2FWJFW\env.tmp
- <SYSTEM32>\CF25656.exe
- C:\327882R2FWJFW\LocalDrive.vbs
- C:\327882R2FWJFW\OSid.vbs
- C:\327882R2FWJFW\restore_pt.vbs
- C:\<Virus name>\kmd.dat
- C:\<Virus name>\erunt.dat
- C:\<Virus name>\sum.bat
- C:\327882R2FWJFW\MWindows.dat
- C:\dirname00
- C:\<Virus name>\osVer00
- C:\327882R2FWJFW\ERDNT.e_e
- C:\327882R2FWJFW\ERDNTDOS.LOC
- C:\327882R2FWJFW\ERDNTWIN.LOC
- C:\327882R2FWJFW\WhiteLegacy.dat
- C:\327882R2FWJFW\zDomain.dat
- C:\327882R2FWJFW\zhsvc.dat
- C:\327882R2FWJFW\FProps.vbs
- C:\327882R2FWJFW\LFN.vbs
- C:\327882R2FWJFW\lnkread.vbs
- C:\327882R2FWJFW\ERUNT.LOC
- C:\327882R2FWJFW\Exe.reg
- C:\327882R2FWJFW\nircmd.scr
- C:\327882R2FWJFW\023v.dat
- C:\327882R2FWJFW\RestoreO4.bat
- C:\327882R2FWJFW\SafeBootRepair.bat
- C:\327882R2FWJFW\SetEnvmt.bat
- C:\327882R2FWJFW\ND_.bat
- C:\327882R2FWJFW\pid.bat
- C:\327882R2FWJFW\Qoo.bat
- C:\327882R2FWJFW\nircmd.com
- C:\327882R2FWJFW\nircmd.exe
- C:\327882R2FWJFW\Combo-Fix.sys
- C:\327882R2FWJFW\Sys.bat
- C:\327882R2FWJFW\upload.bat
- C:\Start_.cmd
- C:\327882R2FWJFW\Comspec.bat
- C:\327882R2FWJFW\DelClsid.bat
- C:\327882R2FWJFW\Disclaimer.bat
- C:\327882R2FWJFW\Boot.bat
- C:\327882R2FWJFW\C.bat
- C:\327882R2FWJFW\Combobatch.bat
- C:\327882R2FWJFW\Lang.bat
- C:\327882R2FWJFW\List-C.bat
- C:\327882R2FWJFW\MoveIt.bat
- C:\327882R2FWJFW\FIND3M.bat
- C:\327882R2FWJFW\FIXLSP.bat
- C:\327882R2FWJFW\history.bat
- C:\327882R2FWJFW\BootSect
- C:\327882R2FWJFW\sed.cfexe
- C:\327882R2FWJFW\setpath.cfexe
- C:\327882R2FWJFW\SF.cfexe
- C:\327882R2FWJFW\mtee.cfexe
- C:\327882R2FWJFW\nircmd.cfexe
- C:\327882R2FWJFW\psexec.cfexe
- C:\327882R2FWJFW\vfind.cfexe
- C:\327882R2FWJFW\zip.cfexe
- C:\327882R2FWJFW\023.dat
- C:\327882R2FWJFW\swreg.cfexe
- C:\327882R2FWJFW\swsc.cfexe
- C:\327882R2FWJFW\swxcacls.cfexe
- C:\327882R2FWJFW\ERUNT.cfexe
- C:\327882R2FWJFW\extract.cfexe
- C:\327882R2FWJFW\fdsv.cfexe
- C:\327882R2FWJFW\catchme.cfexe
- C:\327882R2FWJFW\dd.cfexe
- C:\327882R2FWJFW\dumphive.cfexe
- C:\327882R2FWJFW\ListDlls.cfexe
- C:\327882R2FWJFW\md5deep.cfexe
- C:\327882R2FWJFW\moveex.cfexe
- C:\327882R2FWJFW\grep.cfexe
- C:\327882R2FWJFW\gsar.cfexe
- C:\327882R2FWJFW\handle.cfexe
- C:\Start_.cmd
- C:\<Virus name>\sum.bat
- C:\dirname00
- C:\327882R2FWJFW\nircmd.scr
- C:\327882R2FWJFW\nircmd.exe
- from C:\327882R2FWJFW\Purity.dat to C:\<Virus name>\Purity.dat
- from C:\327882R2FWJFW\Qoo.bat to C:\<Virus name>\Qoo.bat
- from C:\327882R2FWJFW\psexec.cfexe to C:\<Virus name>\psexec.cfexe
- from C:\327882R2FWJFW\pid.bat to C:\<Virus name>\pid.bat
- from C:\327882R2FWJFW\Policies.dat to C:\<Virus name>\Policies.dat
- from C:\327882R2FWJFW\region.dat to C:\<Virus name>\region.dat
- from C:\327882R2FWJFW\safeboot.dat to C:\<Virus name>\safeboot.dat
- from C:\327882R2FWJFW\safeboot.def.dat to C:\<Virus name>\safeboot.def.dat
- from C:\327882R2FWJFW\rogues.dat to C:\<Virus name>\rogues.dat
- from C:\327882R2FWJFW\RestoreO4.bat to C:\<Virus name>\RestoreO4.bat
- from C:\327882R2FWJFW\restore_pt.vbs to C:\<Virus name>\restore_pt.vbs
- from C:\327882R2FWJFW\netsvc.bad.dat to C:\<Virus name>\netsvc.bad.dat
- from C:\327882R2FWJFW\netsvc.dat to C:\<Virus name>\netsvc.dat
- from C:\327882R2FWJFW\ND_.bat to C:\<Virus name>\ND_.bat
- from C:\327882R2FWJFW\MWindows.dat to C:\<Virus name>\MWindows.dat
- from C:\327882R2FWJFW\ndis_combofix.dat to C:\<Virus name>\ndis_combofix.dat
- from C:\327882R2FWJFW\netsvc.vista.dat to C:\<Virus name>\netsvc.vista.dat
- from C:\327882R2FWJFW\nircmd.com to C:\<Virus name>\nircmd.com
- from C:\327882R2FWJFW\OSid.vbs to C:\<Virus name>\OSid.vbs
- from C:\327882R2FWJFW\nircmd.cfexe to C:\<Virus name>\nircmd.cfexe
- from C:\327882R2FWJFW\netsvc.xp.dat to C:\<Virus name>\netsvc.xp.dat
- from C:\327882R2FWJFW\NetworkService.dat to C:\<Virus name>\NetworkService.dat
- from C:\327882R2FWJFW\safeboot.def.vista.dat to C:\<Virus name>\safeboot.def.vista.dat
- from C:\327882R2FWJFW\upload.bat to C:\<Virus name>\upload.bat
- from C:\327882R2FWJFW\vfind.cfexe to C:\<Virus name>\vfind.cfexe
- from C:\327882R2FWJFW\system_ini.dat to C:\<Virus name>\system_ini.dat
- from C:\327882R2FWJFW\swxcacls.cfexe to C:\<Virus name>\swxcacls.cfexe
- from C:\327882R2FWJFW\Sys.bat to C:\<Virus name>\Sys.bat
- from C:\327882R2FWJFW\whitedirB.dat to C:\<Virus name>\whitedirB.dat
- from C:\327882R2FWJFW\zip.cfexe to C:\<Virus name>\zip.cfexe
- from <SYSTEM32>\CF25656.exe to C:\<Virus name>\CF25656.exe
- from C:\327882R2FWJFW\zhsvc.dat to C:\<Virus name>\zhsvc.dat
- from C:\327882R2FWJFW\WhiteLegacy.dat to C:\<Virus name>\WhiteLegacy.dat
- from C:\327882R2FWJFW\zDomain.dat to C:\<Virus name>\zDomain.dat
- from C:\327882R2FWJFW\setpath.cfexe to C:\<Virus name>\setpath.cfexe
- from C:\327882R2FWJFW\SF.cfexe to C:\<Virus name>\SF.cfexe
- from C:\327882R2FWJFW\SetEnvmt.bat to C:\<Virus name>\SetEnvmt.bat
- from C:\327882R2FWJFW\SafeBootRepair.bat to C:\<Virus name>\SafeBootRepair.bat
- from C:\327882R2FWJFW\sed.cfexe to C:\<Virus name>\sed.cfexe
- from C:\327882R2FWJFW\SvcDrv.vbs to C:\<Virus name>\SvcDrv.vbs
- from C:\327882R2FWJFW\swreg.cfexe to C:\<Virus name>\swreg.cfexe
- from C:\327882R2FWJFW\swsc.cfexe to C:\<Virus name>\swsc.cfexe
- from C:\327882R2FWJFW\svc_wht.dat to C:\<Virus name>\svc_wht.dat
- from C:\327882R2FWJFW\svchost.dat to C:\<Virus name>\svchost.dat
- from C:\327882R2FWJFW\svchost.vista.dat to C:\<Virus name>\svchost.vista.dat
- from C:\327882R2FWJFW\mtee.cfexe to C:\<Virus name>\mtee.cfexe
- from C:\327882R2FWJFW\dumphive.cfexe to C:\<Virus name>\dumphive.cfexe
- from C:\327882R2FWJFW\env.tmp to C:\<Virus name>\env.tmp
- from C:\327882R2FWJFW\Disclaimer.bat to C:\<Virus name>\Disclaimer.bat
- from C:\327882R2FWJFW\dd.cfexe to C:\<Virus name>\dd.cfexe
- from C:\327882R2FWJFW\DelClsid.bat to C:\<Virus name>\DelClsid.bat
- from C:\327882R2FWJFW\ERDNT.e_e to C:\<Virus name>\ERDNT.e_e
- from C:\327882R2FWJFW\ERUNT.LOC to C:\<Virus name>\ERUNT.LOC
- from C:\327882R2FWJFW\Exe.reg to C:\<Virus name>\Exe.reg
- from C:\327882R2FWJFW\ERUNT.cfexe to C:\<Virus name>\ERUNT.cfexe
- from C:\327882R2FWJFW\ERDNTDOS.LOC to C:\<Virus name>\ERDNTDOS.LOC
- from C:\327882R2FWJFW\ERDNTWIN.LOC to C:\<Virus name>\ERDNTWIN.LOC
- from C:\327882R2FWJFW\BootSect to C:\<Virus name>\BootSect
- from C:\327882R2FWJFW\C.bat to C:\<Virus name>\C.bat
- from C:\327882R2FWJFW\Boot.bat to C:\<Virus name>\Boot.bat
- from C:\327882R2FWJFW\023.dat to C:\<Virus name>\023.dat
- from C:\327882R2FWJFW\023v.dat to C:\<Virus name>\023v.dat
- from C:\327882R2FWJFW\catchme.cfexe to C:\<Virus name>\catchme.cfexe
- from C:\327882R2FWJFW\Comspec.bat to C:\<Virus name>\Comspec.bat
- from C:\327882R2FWJFW\Creg.dat to C:\<Virus name>\Creg.dat
- from C:\327882R2FWJFW\Combobatch.bat to C:\<Virus name>\Combobatch.bat
- from C:\327882R2FWJFW\clsid.dat to C:\<Virus name>\clsid.dat
- from C:\327882R2FWJFW\Combo-Fix.sys to C:\<Virus name>\Combo-Fix.sys
- from C:\327882R2FWJFW\executables.dat to C:\<Virus name>\executables.dat
- from C:\327882R2FWJFW\lnkread.vbs to C:\<Virus name>\lnkread.vbs
- from C:\327882R2FWJFW\LocalDrive.vbs to C:\<Virus name>\LocalDrive.vbs
- from C:\327882R2FWJFW\ListDlls.cfexe to C:\<Virus name>\ListDlls.cfexe
- from C:\327882R2FWJFW\LFN.vbs to C:\<Virus name>\LFN.vbs
- from C:\327882R2FWJFW\List-C.bat to C:\<Virus name>\List-C.bat
- from C:\327882R2FWJFW\LocalService.dat to C:\<Virus name>\LocalService.dat
- from C:\327882R2FWJFW\moveex.cfexe to C:\<Virus name>\moveex.cfexe
- from C:\327882R2FWJFW\MoveIt.bat to C:\<Virus name>\MoveIt.bat
- from C:\327882R2FWJFW\md5deep.cfexe to C:\<Virus name>\md5deep.cfexe
- from C:\327882R2FWJFW\LocalServiceNetworkRestricted.dat to C:\<Virus name>\LocalServiceNetworkRestricted.dat
- from C:\327882R2FWJFW\LocalSystemNetworkRestricted.dat to C:\<Virus name>\LocalSystemNetworkRestricted.dat
- from C:\327882R2FWJFW\FIND3M.bat to C:\<Virus name>\FIND3M.bat
- from C:\327882R2FWJFW\FIXLSP.bat to C:\<Virus name>\FIXLSP.bat
- from C:\327882R2FWJFW\Fin.dat to C:\<Virus name>\Fin.dat
- from C:\327882R2FWJFW\extract.cfexe to C:\<Virus name>\extract.cfexe
- from C:\327882R2FWJFW\fdsv.cfexe to C:\<Virus name>\fdsv.cfexe
- from C:\327882R2FWJFW\FProps.vbs to C:\<Virus name>\FProps.vbs
- from C:\327882R2FWJFW\history.bat to C:\<Virus name>\history.bat
- from C:\327882R2FWJFW\Lang.bat to C:\<Virus name>\Lang.bat
- from C:\327882R2FWJFW\handle.cfexe to C:\<Virus name>\handle.cfexe
- from C:\327882R2FWJFW\grep.cfexe to C:\<Virus name>\grep.cfexe
- from C:\327882R2FWJFW\gsar.cfexe to C:\<Virus name>\gsar.cfexe
- ClassName: 'RegEdit_RegEdit' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'EDIT' WindowName: ''