Win32.HLLW.Autoruner1.35424

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\prot.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\program.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pview95.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rav.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ras.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PpPpWallRun.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pccmain.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pcciomon.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pccwin98.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PERSFW.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCFWALLICON.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rescue32.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rfw.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\safeboxTray.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rn.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavTask.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rav7win.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RAV7.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMon.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavStub.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMonD.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NAVW.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NAVSCHED.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NAVW32.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nisserv.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navwnt.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navrunr.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navapsvc.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\N32ACAN.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navapw32.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NAVNT.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NAVLU32.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PADMIN.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\OUTPOST.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PAVCL.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCCClient.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pcc.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NVC95.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NMAIN.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nisum.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NORMIST.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NUPGRADE.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\norton.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\safeweb.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vir.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VETTRAY.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VPC32.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vshwin32.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VSECOMR.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VET95.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tmupdito.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tmproxy.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TSC.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vavrunr.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UlibCfg.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wink.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\windowsУЕ»ЇґуК¦.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\XDelbox.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pccguide.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zonealarm.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WFINDV32.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsstat.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VSSCAN40] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WEBSCAN.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\webtrap.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WEBSCANX.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SERV95.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\secu.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sirc32.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\smtpsvc.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SMC.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SCRSCAN.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scan.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scam32.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SCAN32.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scon.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SCANPM.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TDS2-98.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TCA.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TDS2-NT.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TMOAgent.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Tmntsrv.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TBSCAN.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spy.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SPHINX.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sreng.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\symproxysvc.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SWEEP95.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CLAW95.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cfinet32.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CLAW95CT.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CLEANER3.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CLEANER.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cfinet.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CCenter.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BLACKICE.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CFIADMIN.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CFIND.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CFIAUDIT.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EFINET32.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ECENGINE.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ESAFE.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorewclass.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ESPWATCH.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DVP95.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dbg.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DAVPFW.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\debu.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DV95_O.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DV95.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ANTI-TROJAN.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\anti.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\antivir.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AUTODOWN.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\atrack.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ACKWIN32.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Active Setup\Installed Components\{H8I22RB03-AB-B70-7-11d2-9CBD-0O00FS7AH6-9E2121BHJLK}] 'stubpath' = ''
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360safe.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360safebox.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avsynmgr.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVSCHED32.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVWIN95.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BLACKD.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avxonsol.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVPUPD.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVE32.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVCONSOL.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVGCTRL.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVKSERV.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avk.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\F-AGNT95.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVMonXP.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KRF.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVPreScan.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lamapp.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kwatch.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPPMain.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kavstart.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kav32.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kissvc.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kpfwsvc.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPFW32.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\moniker.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mon.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MOOLIVE.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ms.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MPFTRAY.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\microsoft.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\LOOKOUT.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lockdown2000.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\luall.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcafee.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\LUCOMSERVER.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IAMAPP.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\f-stopw.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IAMSERV.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IBMAVSP.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IBMASN.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FRW.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fir.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FINDVIRU.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\F-PROT.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fp-win.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\f-prot95.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iomon98.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iom.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\JED.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Kasmain.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Kabackreport.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ICSSUPPNT.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IceSword.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ice.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ICLOAD95.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ICMOON.exe] 'Debugger' = 'svchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ICLOADNT.exe] 'Debugger' = 'svchost.exe'

Creates or modifies the following files:

%WINDIR%\Tasks\°ІЧ°.bat
%WINDIR%\Tasks\SA.DAT

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\kriaant] 'Start' = '00000000'
[<HKLM>\SYSTEM\ControlSet001\Services\gljh] 'Start' = '00000000'
[<HKCU>\SYSTEM\CurrentControlSet\Services\276AB706] 'ImagePath' = '%WINDIR%\Fonts\B29C2716.EXE -k'
[<HKLM>\SYSTEM\ControlSet001\Services\276AB706] 'Start' = '00000002'
[<HKLM>\SYSTEM\ControlSet001\Services\276AB706] 'ImagePath' = '%WINDIR%\Fonts\B29C2716.EXE -k'

Creates the following files on removable media:

<Drive name for removable media>:\system.dll
<Drive name for removable media>:\recycle.{645FF040-5081-101B-9F08-00AA002F954E}\ini.exe
<Drive name for removable media>:\AUTORUN.INF

Malicious functions:

Creates and executes the following:

'%TEMP%\RarSFX0\bb88.exe'
'%TEMP%\ope1.exe'
'%WINDIR%\ini\ini.exe'
'%TEMP%\ope2.exe'
'%TEMP%\RarSFX0\b2.exe'
'%TEMP%\RarSFX0\q3.exe'
'%TEMP%\RarSFX0\1011.exe'
'%TEMP%\RarSFX0\e2.exe'

Executes the following:

'<SYSTEM32>\cmd.exe' /c <SYSTEM32>\ZiMSR8.bat
'<SYSTEM32>\cmd.exe' /c <SYSTEM32>\98p6z6.bat
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\243828.bat" "
'<SYSTEM32>\ping.exe' -n 3 127.0.0.1
'<SYSTEM32>\rundll32.exe' <SYSTEM32>\ZEVbp.dll,DllUnregisterServer
'<SYSTEM32>\cmd.exe' /c %WINDIR%\Fonts\copy2090000.bat
'<SYSTEM32>\wscript.exe' "%TEMP%\RarSFX0\run.vbs"
'<SYSTEM32>\svchost.exe'
'<SYSTEM32>\rundll32.exe' <SYSTEM32>\ZEVbp.dll,DllRegisterServer

Injects code into

the following system processes:

%WINDIR%\Explorer.EXE
<SYSTEM32>\svchost.exe

Terminates or attempts to terminate

the following user processes:

360tray.exe

Modifies file system :

Creates the following files:

C:\Far2\Plugins\FTP\lib\wsock32.dll
C:\Far2\Plugins\FTP\wsock32.dll
C:\Far2\Plugins\HlfViewer\wsock32.dll
C:\Far2\Plugins\ExtSearch\wsock32.dll
C:\Far2\Plugins\FarCmds\wsock32.dll
C:\Far2\Plugins\FileCase\wsock32.dll
C:\Far2\Plugins\MacroView\wsock32.dll
C:\Far2\Plugins\TmpPanel\wsock32.dll
C:\Far2\Plugins\WinSCP\components\wsock32.dll
C:\Far2\Plugins\WinSCP\console\wsock32.dll
C:\Far2\Plugins\Network\wsock32.dll
C:\Far2\Plugins\ProcList\wsock32.dll
<SYSTEM32>\NsPass1.sys
C:\Far2\Plugins\ExtSearch\sources\wsock32.dll
C:\Far2\Plugins\Compare\wsock32.dll
C:\Far2\Plugins\DrawLine\wsock32.dll
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\down[1].txt
C:\Far2\Plugins\Colorer\hrd\console\wsock32.dll
C:\Far2\Plugins\Colorer\hrd\wsock32.dll
C:\Far2\Plugins\Colorer\wsock32.dll
C:\Far2\Plugins\EditCase\wsock32.dll
C:\Far2\Plugins\ExtSearch\keys\wsock32.dll
<SYSTEM32>\NsPass0.sys
C:\Far2\Plugins\ExtSearch\sources\RegExp\wsock32.dll
%TEMP%\configmon.dat
C:\Far2\Plugins\EMenu\wsock32.dll
C:\Far2\Plugins\ExtSearch\doc\wsock32.dll
C:\Far2\Plugins\WinSCP\packages\wsock32.dll
<SYSTEM32>\NsPass3.sys
C:\Far2\Plugins\WinSCP\putty\charset\wsock32.dll
C:\Far2\Plugins\WinSCP\packages\tb2k\wsock32.dll
C:\Far2\Plugins\WinSCP\packages\tbx\wsock32.dll
C:\Far2\Plugins\WinSCP\packages\theme\wsock32.dll
C:\Far2\Plugins\WinSCP\putty\windows\wsock32.dll
C:\Far2\Plugins\WinSCP\windows\wsock32.dll
C:\Far2\Plugins\WinSCP\wsock32.dll
<SYSTEM32>\NsPass4.sys
C:\Far2\Plugins\WinSCP\putty\wsock32.dll
C:\Far2\Plugins\WinSCP\release\wsock32.dll
C:\Far2\Plugins\WinSCP\resource\wsock32.dll
%TEMP%\287140.txt
C:\Far2\Plugins\WinSCP\fari\wsock32.dll
C:\Far2\Plugins\WinSCP\filezilla\misc\wsock32.dll
C:\Far2\Plugins\WinSCP\filezilla\wsock32.dll
C:\Far2\Plugins\WinSCP\core\wsock32.dll
C:\Far2\Plugins\WinSCP\dragext\wsock32.dll
C:\Far2\Plugins\WinSCP\far\wsock32.dll
C:\Far2\Plugins\WinSCP\forms\wsock32.dll
C:\Far2\Plugins\WinSCP\packages\filemng\wsock32.dll
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\count[1].asp
C:\Far2\Plugins\WinSCP\packages\my\wsock32.dll
<SYSTEM32>\NsPass2.sys
C:\Far2\Plugins\WinSCP\lib\wsock32.dll
C:\Far2\Plugins\WinSCP\packages\dragndrop\wsock32.dll
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\Жф¶Ї Internet Explorer дЇААЖч.lnk
C:\Far2\Addons\Colors\Custom Highlighting\wsock32.dll
%HOMEPATH%\Favorites\НшЦ·µјєЅ.url
<SYSTEM32>\Nskhelper2.sys
%WINDIR%\ini\wsock32.dll
%WINDIR%\ini\shit.vbs
<SYSTEM32>\ZEVbp.dll
C:\Far2\Addons\Macros\wsock32.dll
C:\Far2\Addons\SetUp\wsock32.dll
C:\Far2\Addons\Shell\wsock32.dll
<DRIVERS>\bohthqq.sys
C:\Far2\Addons\Colors\Default Highlighting\wsock32.dll
C:\Far2\Addons\Colors\wsock32.dll
%WINDIR%\Fonts\B29C2716.EXE
%TEMP%\RarSFX0\x3.exe
%TEMP%\RarSFX0\e2.exe
%TEMP%\RarSFX0\q3.exe
%TEMP%\RarSFX0\run.vbs
%TEMP%\RarSFX0\bb88.exe
%TEMP%\RarSFX0\b2.exe
%TEMP%\RarSFX0\1011.exe
%WINDIR%\Fonts\copy2090000.bat
%TEMP%\dll375.dll
%WINDIR%\ini\ini.exe
%TEMP%\ope1.exe
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\drivetable.txt
%TEMP%\ope2.exe
C:\Far2\Plugins\Align\wsock32.dll
C:\system.dll
C:\Far2\Plugins\arclite\wsock32.dll
C:\Far2\Plugins\7-Zip\wsock32.dll
C:\autorun.inf
<SYSTEM32>\appwinproc.dll
C:\Far2\Plugins\AutoWrap\wsock32.dll
C:\Far2\Plugins\Colorer\hrc\auto\wsock32.dll
C:\Far2\Plugins\Colorer\hrc\wsock32.dll
C:\Far2\Plugins\Colorer\hrd\console\contrib\wsock32.dll
C:\Far2\Plugins\Brackets\wsock32.dll
C:\Far2\Plugins\Colorer\bin\wsock32.dll
C:\Far2\Plugins\Colorer\hrc\auto\types\wsock32.dll
<SYSTEM32>\ZiMSR8.bat
<DRIVERS>\banq.sys
%WINDIR%\ini\desktop.ini
C:\Far2\Addons\wsock32.dll
C:\Far2\Addons\XLat\Russian\wsock32.dll
<SYSTEM32>\VHJAm.dll
C:\Far2\Addons\XLat\wsock32.dll
%TEMP%\243828.bat
C:\Far2\Documentation\wsock32.dll
C:\Far2\Encyclopedia\wsock32.dll
C:\Far2\FExcept\wsock32.dll
C:\Far2\Documentation\eng\wsock32.dll
<SYSTEM32>\98p6z6.bat
C:\Far2\Documentation\rus\wsock32.dll

Sets the 'hidden' attribute to the following files:

C:\Far2\Plugins\ProcList\wsock32.dll
C:\Far2\Plugins\TmpPanel\wsock32.dll
C:\Far2\Plugins\MacroView\wsock32.dll
C:\Far2\Plugins\Network\wsock32.dll
C:\Far2\Plugins\WinSCP\components\wsock32.dll
C:\Far2\Plugins\WinSCP\dragext\wsock32.dll
C:\Far2\Plugins\WinSCP\far\wsock32.dll
C:\Far2\Plugins\WinSCP\console\wsock32.dll
C:\Far2\Plugins\WinSCP\core\wsock32.dll
C:\Far2\Plugins\ExtSearch\sources\wsock32.dll
C:\Far2\Plugins\ExtSearch\wsock32.dll
C:\Far2\Plugins\ExtSearch\keys\wsock32.dll
C:\Far2\Plugins\ExtSearch\sources\RegExp\wsock32.dll
C:\Far2\Plugins\FarCmds\wsock32.dll
C:\Far2\Plugins\FTP\wsock32.dll
C:\Far2\Plugins\HlfViewer\wsock32.dll
C:\Far2\Plugins\FileCase\wsock32.dll
C:\Far2\Plugins\FTP\lib\wsock32.dll
C:\Far2\Plugins\WinSCP\fari\wsock32.dll
C:\Far2\Plugins\WinSCP\putty\charset\wsock32.dll
C:\Far2\Plugins\WinSCP\putty\windows\wsock32.dll
C:\Far2\Plugins\WinSCP\packages\theme\wsock32.dll
C:\Far2\Plugins\WinSCP\packages\wsock32.dll
C:\Far2\Plugins\WinSCP\putty\wsock32.dll
C:\Far2\Plugins\WinSCP\windows\wsock32.dll
C:\Far2\Plugins\WinSCP\wsock32.dll
C:\Far2\Plugins\WinSCP\release\wsock32.dll
C:\Far2\Plugins\WinSCP\resource\wsock32.dll
C:\Far2\Plugins\WinSCP\forms\wsock32.dll
C:\Far2\Plugins\WinSCP\lib\wsock32.dll
C:\Far2\Plugins\WinSCP\filezilla\misc\wsock32.dll
C:\Far2\Plugins\WinSCP\filezilla\wsock32.dll
C:\Far2\Plugins\WinSCP\packages\dragndrop\wsock32.dll
C:\Far2\Plugins\WinSCP\packages\tb2k\wsock32.dll
C:\Far2\Plugins\WinSCP\packages\tbx\wsock32.dll
C:\Far2\Plugins\WinSCP\packages\filemng\wsock32.dll
C:\Far2\Plugins\WinSCP\packages\my\wsock32.dll
C:\Far2\Documentation\eng\wsock32.dll
C:\Far2\Documentation\rus\wsock32.dll
%WINDIR%\ini\desktop.ini
C:\Far2\Addons\wsock32.dll
C:\Far2\Documentation\wsock32.dll
C:\Far2\Plugins\7-Zip\wsock32.dll
C:\Far2\Plugins\Align\wsock32.dll
C:\Far2\Encyclopedia\wsock32.dll
C:\Far2\FExcept\wsock32.dll
C:\Far2\Addons\Colors\Default Highlighting\wsock32.dll
C:\Far2\Addons\Colors\wsock32.dll
<Drive name for removable media>:\AUTORUN.INF
C:\Far2\Addons\Colors\Custom Highlighting\wsock32.dll
C:\Far2\Addons\Macros\wsock32.dll
C:\Far2\Addons\XLat\Russian\wsock32.dll
C:\Far2\Addons\XLat\wsock32.dll
C:\Far2\Addons\SetUp\wsock32.dll
C:\Far2\Addons\Shell\wsock32.dll
C:\system.dll
C:\Far2\Plugins\Colorer\hrd\wsock32.dll
C:\Far2\Plugins\Colorer\wsock32.dll
C:\Far2\Plugins\Colorer\hrd\console\contrib\wsock32.dll
C:\Far2\Plugins\Colorer\hrd\console\wsock32.dll
C:\Far2\Plugins\Compare\wsock32.dll
C:\Far2\Plugins\EMenu\wsock32.dll
C:\Far2\Plugins\ExtSearch\doc\wsock32.dll
C:\Far2\Plugins\DrawLine\wsock32.dll
C:\Far2\Plugins\EditCase\wsock32.dll
C:\Far2\Plugins\AutoWrap\wsock32.dll
C:\Far2\Plugins\Brackets\wsock32.dll
C:\Far2\Plugins\arclite\wsock32.dll
<Drive name for removable media>:\system.dll
C:\Far2\Plugins\Colorer\bin\wsock32.dll
C:\Far2\Plugins\Colorer\hrc\auto\wsock32.dll
C:\Far2\Plugins\Colorer\hrc\wsock32.dll
C:\autorun.inf
C:\Far2\Plugins\Colorer\hrc\auto\types\wsock32.dll

Deletes the following files:

%WINDIR%\Help\pinball.chm
%WINDIR%\Help\pinball.hlp
%WINDIR%\Help\plyr_err.chm
%WINDIR%\Help\packager.chm
%WINDIR%\Help\password.chm
%WINDIR%\Help\phowto.chm
%WINDIR%\Help\progman.hlp
%WINDIR%\Help\pwrmn.chm
%WINDIR%\Help\pwrmn.hlp
%WINDIR%\Help\printfnd.chm
%WINDIR%\Help\printing.chm
%WINDIR%\Help\progman.cnt
%WINDIR%\Help\nwdoc.hlp
%WINDIR%\Help\objsel.hlp
%WINDIR%\Help\odbcinst.chm
%WINDIR%\Help\ntshrui.hlp
%WINDIR%\Help\nusrmgr.chm
%WINDIR%\Help\nwdoc.chm
%WINDIR%\Help\omc.chm
%WINDIR%\Help\osk.chm
%WINDIR%\Help\osk.hlp
%WINDIR%\Help\odbcjet.chm
%WINDIR%\Help\oe_msgr.chm
%WINDIR%\Help\offlinefolders.chm
%WINDIR%\Help\qosconcepts.chm
%WINDIR%\Help\rsm.hlp
%WINDIR%\Help\rsmconcepts.chm
%WINDIR%\Help\rsop.chm
%WINDIR%\Help\rktools.chm
%WINDIR%\Help\rrc.chm
%WINDIR%\Help\rsm.chm
%WINDIR%\Help\saferconcepts.chm
%WINDIR%\Help\sapicpl.hlp
%WINDIR%\Help\sc.chm
%WINDIR%\Help\rsopsnp.chm
%WINDIR%\Help\rvse.chm
%WINDIR%\Help\safer.chm
%WINDIR%\Help\rdesktop.chm
%WINDIR%\Help\reader.chm
%WINDIR%\Help\reader.hlp
%WINDIR%\Help\ratings.chm
%WINDIR%\Help\ratings.cnt
%WINDIR%\Help\ratings.hlp
%WINDIR%\Help\regopt.chm
%WINDIR%\Help\remasst.chm
%WINDIR%\Help\reskit.chm
%WINDIR%\Help\recycle.chm
%WINDIR%\Help\regedit.chm
%WINDIR%\Help\regedit.hlp
%WINDIR%\Help\ntshared.chm
%WINDIR%\Help\msoe.hlp
%WINDIR%\Help\msoeacct.hlp
%WINDIR%\Help\msorcl32.chm
%WINDIR%\Help\msnauth.cnt
%WINDIR%\Help\msnauth.hlp
%WINDIR%\Help\msoe.chm
%WINDIR%\Help\mstask.hlp
%WINDIR%\Help\mstsc.chm
%WINDIR%\Help\netcfg.chm
%WINDIR%\Help\mspaint.chm
%WINDIR%\Help\mspaint.hlp
%WINDIR%\Help\mstask.chm
%WINDIR%\Help\mqsnap.hlp
%WINDIR%\Help\msconfig.chm
%WINDIR%\Help\msdasc.chm
%WINDIR%\Help\mplayer2.cnt
%WINDIR%\Help\mplayer2.hlp
%WINDIR%\Help\mpnetwrk.hlp
%WINDIR%\Help\msinfo32.chm
%WINDIR%\Help\msmq.chm
%WINDIR%\Help\msmqconcepts.chm
%WINDIR%\Help\mshearts.chm
%WINDIR%\Help\mshearts.cnt
%WINDIR%\Help\mshearts.hlp
%WINDIR%\Help\netcfg.hlp
%WINDIR%\Help\notepad.chm
%WINDIR%\Help\notepad.hlp
%WINDIR%\Help\ntart.chm
%WINDIR%\Help\nmwhiteb.chm
%WINDIR%\Help\nocontnt.cnt
%WINDIR%\Help\nofts.chm
%WINDIR%\Help\ntcmds.chm
%WINDIR%\Help\ntdef.chm
%WINDIR%\Help\nthelp.chm
%WINDIR%\Help\ntbackup.chm
%WINDIR%\Help\ntbackup.hlp
%WINDIR%\Help\ntchowto.chm
%WINDIR%\Help\newfeat2.chm
%WINDIR%\Help\newfeat2.hlp
%WINDIR%\Help\newfeat3.chm
%WINDIR%\Help\network.chm
%WINDIR%\Help\newfeat1.chm
%WINDIR%\Help\newfeat1.hlp
%WINDIR%\Help\newfeat5.chm
%WINDIR%\Help\newfeat5.hlp
%WINDIR%\Help\nmchat.chm
%WINDIR%\Help\newfeat3.hlp
%WINDIR%\Help\newfeat4.chm
%WINDIR%\Help\newfeat4.hlp
%WINDIR%\Help\utilmgr.chm
%WINDIR%\Help\utilmgr.hlp
%WINDIR%\Help\verifier.hlp
%WINDIR%\Help\update1.chm
%WINDIR%\Help\usercpl.chm
%WINDIR%\Help\users.hlp
%WINDIR%\Help\webpub.chm
%WINDIR%\Help\whatsnew.chm
%WINDIR%\Help\winchat.chm
%WINDIR%\Help\wab.chm
%WINDIR%\Help\wab.hlp
%WINDIR%\Help\wbemtest.chm
%WINDIR%\Help\tcpmon.hlp
%WINDIR%\Help\telnet.chm
%WINDIR%\Help\telnet.hlp
%WINDIR%\Help\taskmgr.chm
%WINDIR%\Help\taskmgr.hlp
%WINDIR%\Help\tcpip.chm
%WINDIR%\Help\twclient.chm
%WINDIR%\Help\twclient.hlp
%WINDIR%\Help\update.cnt
%WINDIR%\Help\timesrv.chm
%WINDIR%\Help\tshoot.chm
%WINDIR%\Help\tshoot.dll
%WINDIR%\Help\winchat.hlp
%WINDIR%\Help\wordpad.hlp
%WINDIR%\Help\wpa.chm
%WINDIR%\Help\wschelp.chm
%WINDIR%\Help\wmplay.chm
%WINDIR%\Help\wmplayer.chm
%WINDIR%\Help\wordpad.chm
%WINDIR%\Help\wshconcepts.chm
%WINDIR%\Help\wuau.chm
%WINDIR%\Help\wuauhelp.chm
%WINDIR%\Help\wscript.chm
%WINDIR%\Help\wscript.hlp
%WINDIR%\Help\wsecedit.hlp
%WINDIR%\Help\windows.hlp
%WINDIR%\Help\winhlp32.cnt
%WINDIR%\Help\winhlp32.hlp
%WINDIR%\Help\windows.chm
%WINDIR%\Help\windows.chq
%WINDIR%\Help\windows.cnt
%WINDIR%\Help\win_dos.chm
%WINDIR%\Help\wmic.chm
%WINDIR%\Help\wmifltr.chm
%WINDIR%\Help\wininstl.chm
%WINDIR%\Help\winmine.chm
%WINDIR%\Help\winmine.hlp
%WINDIR%\Help\taskbar.chm
%WINDIR%\Help\sigverif.hlp
%WINDIR%\Help\smlogcfg.chm
%WINDIR%\Help\sndvol32.chm
%WINDIR%\Help\shell.hlp
%WINDIR%\Help\shvl.chm
%WINDIR%\Help\signin.hlp
%WINDIR%\Help\snmpsnap.hlp
%WINDIR%\Help\sol.chm
%WINDIR%\Help\sol.hlp
%WINDIR%\Help\sndvol32.hlp
%WINDIR%\Help\sniffpol.dll
%WINDIR%\Help\snmpconcepts.chm
%WINDIR%\Help\scm.chm
%WINDIR%\Help\scmconcepts.chm
%WINDIR%\Help\secauth.hlp
%WINDIR%\Help\scarddlg.hlp
%WINDIR%\Help\sce.chm
%WINDIR%\Help\sceconcepts.chm
%WINDIR%\Help\sendcmsg.chm
%WINDIR%\Help\sendcmsg.hlp
%WINDIR%\Help\sfmmgr.hlp
%WINDIR%\Help\secedit.chm
%WINDIR%\Help\secsetconcepts.chm
%WINDIR%\Help\secsettings.chm
%WINDIR%\Help\soundrec.chm
%WINDIR%\Help\sysmon.chm
%WINDIR%\Help\sysmon.hlp
%WINDIR%\Help\sysprop.chm
%WINDIR%\Help\suptools.chm
%WINDIR%\Help\sysdm.chm
%WINDIR%\Help\sysdm.hlp
%WINDIR%\Help\sys_srv.chm
%WINDIR%\Help\tapi.chm
%WINDIR%\Help\tapi.hlp
%WINDIR%\Help\sysrestore.chm
%WINDIR%\Help\sysrestore.hlp
%WINDIR%\Help\system.chm
%WINDIR%\Help\spconcepts.chm
%WINDIR%\Help\speech.chm
%WINDIR%\Help\spider.chm
%WINDIR%\Help\soundrec.hlp
%WINDIR%\Help\sounds.chm
%WINDIR%\Help\spad.chm
%WINDIR%\Help\sr_ui.chm
%WINDIR%\Help\sstub.dll
%WINDIR%\Help\supp_ed.chm
%WINDIR%\Help\spider.hlp
%WINDIR%\Help\splash.chm
%WINDIR%\Help\spolsconcepts.chm
%WINDIR%\Help\mpconcepts.chm
%WINDIR%\Help\colormgt.chm
%WINDIR%\Help\comexp.chm
%WINDIR%\Help\comexp.hlp
%WINDIR%\Help\clipbrd.chm
%WINDIR%\Help\clipbrd.hlp
%WINDIR%\Help\cmconcepts.chm
%WINDIR%\Help\compstui.hlp
%WINDIR%\Help\conf.chm
%WINDIR%\Help\conf.cnt
%WINDIR%\Help\common.chm
%WINDIR%\Help\compfldr.chm
%WINDIR%\Help\compmgmt.chm
%WINDIR%\Help\certmgr.chm
%WINDIR%\Help\certmgr.hlp
%WINDIR%\Help\charmap.chm
%WINDIR%\Help\camera.hlp
%WINDIR%\Help\cdmedia.chm
%WINDIR%\Help\cdmedia.hlp
%WINDIR%\Help\chooser.hlp
%WINDIR%\Help\ciadmin.htm
%WINDIR%\Help\ciquery.htm
%WINDIR%\Help\charmap.hlp
%WINDIR%\Help\chkr.chm
%WINDIR%\Help\chnscsvr.hlp
%WINDIR%\Help\conf.hlp
%WINDIR%\Help\dfs.hlp
%WINDIR%\Help\diagboot.chm
%WINDIR%\Help\dialer.chm
%WINDIR%\Help\defrag.hlp
%WINDIR%\Help\devmgr.chm
%WINDIR%\Help\devmgr.hlp
%WINDIR%\Help\diskmgmt.chm
%WINDIR%\Help\diskmgmt.hlp
%WINDIR%\Help\display.chm
%WINDIR%\Help\dialer.hlp
%WINDIR%\Help\digiras.chm
%WINDIR%\Help\dijoy.hlp
%WINDIR%\Help\cpanel.chm
%WINDIR%\Help\cpanel.chq
%WINDIR%\Help\cscui.hlp
%WINDIR%\Help\conf1.chm
%WINDIR%\Help\connect.cnt
%WINDIR%\Help\connect.hlp
%WINDIR%\Help\ddeshare.chm
%WINDIR%\Help\ddeshare.hlp
%WINDIR%\Help\defrag.chm
%WINDIR%\Help\cyycoins.chm
%WINDIR%\Help\cyzcoins.chm
%WINDIR%\Help\datetime.chm
%WINDIR%\Help\camera.chm
%WINDIR%\Help\agt0405.hlp
%WINDIR%\Help\agt0406.hlp
%WINDIR%\Help\agt0407.hlp
%WINDIR%\Help\ade.hlp
%WINDIR%\Help\admtools.chm
%WINDIR%\Help\adprop.hlp
%WINDIR%\Help\agt040c.hlp
%WINDIR%\Help\agt040e.hlp
%WINDIR%\Help\agt0410.hlp
%WINDIR%\Help\agt0408.hlp
%WINDIR%\Help\agt0409.hlp
%WINDIR%\Help\agt040b.hlp
%TEMP%\ope1.exe
%TEMP%\ope2.exe
%WINDIR%\Help\access.chm
%TEMP%\RarSFX0\1011.exe
%TEMP%\243828.bat
%TEMP%\dll375.dll
%WINDIR%\Help\aclui.chm
%WINDIR%\Help\aclui.hlp
%WINDIR%\Help\addremov.chm
%WINDIR%\Help\access.hlp
%WINDIR%\Help\accessib.chm
%WINDIR%\Help\acc_dis.chm
%WINDIR%\Help\agt0413.hlp
%WINDIR%\Help\bckg.chm
%WINDIR%\Help\blurbs.chm
%WINDIR%\Help\blutooth.chm
%WINDIR%\Help\atm.chm
%WINDIR%\Help\audiocdc.hlp
%WINDIR%\Help\audit.chm
%WINDIR%\Help\brief.chm
%WINDIR%\Help\calc.chm
%WINDIR%\Help\calc.hlp
%WINDIR%\Help\bnts.dll
%WINDIR%\Help\bootcons.chm
%TEMP%\RarSFX0\e2.exe
%WINDIR%\Help\agt0419.hlp
%WINDIR%\Help\agt041d.hlp
%WINDIR%\Help\agt041f.hlp
%WINDIR%\Help\agt0414.hlp
%WINDIR%\Help\agt0415.hlp
%WINDIR%\Help\agt0416.hlp
%WINDIR%\Help\apps.chm
%WINDIR%\Help\apps_sp.chm
%WINDIR%\Help\article.chm
%TEMP%\RarSFX0\bb88.exe
%WINDIR%\Help\agt0816.hlp
%WINDIR%\Help\agt0c0a.hlp
%WINDIR%\Help\ipsecsnp.chm
%WINDIR%\Help\ipsecsnp.hlp
%WINDIR%\Help\Ipv6.chm
%WINDIR%\Help\input.hlp
%WINDIR%\Help\intellimirror.chm
%WINDIR%\Help\ipsecconcepts.chm
%WINDIR%\Help\ixqlang.htm
%WINDIR%\Help\joy.chm
%WINDIR%\Help\key.chm
%WINDIR%\Help\is.chm
%WINDIR%\Help\isconcepts.chm
%WINDIR%\Help\ixhelp.hlp
%WINDIR%\Help\iexplore.chm
%WINDIR%\Help\iexplore.hlp
%WINDIR%\Help\iis.chm
%WINDIR%\Help\ieshared.chm
%WINDIR%\Help\iesupp.chm
%WINDIR%\Help\iewebhlp.chm
%WINDIR%\Help\infrared.chm
%WINDIR%\Help\infrared.hlp
%WINDIR%\Help\input.chm
%WINDIR%\Help\iismmc.chm
%WINDIR%\Help\imgprev.chm
%WINDIR%\Help\inetres.chm
%WINDIR%\Help\keyb.chm
%WINDIR%\Help\mls_trb.chm
%WINDIR%\Help\mmc.chm
%WINDIR%\Help\mmc_dlg.hlp
%WINDIR%\Help\migwiz.htm
%WINDIR%\Help\migwiz2.htm
%WINDIR%\Help\misc.chm
%WINDIR%\Help\modem.hlp
%WINDIR%\Help\mouse.chm
%WINDIR%\Help\mouse.hlp
%WINDIR%\Help\mobsync.chm
%WINDIR%\Help\mobsync.hlp
%WINDIR%\Help\mode.chm
%WINDIR%\Help\license.chm
%WINDIR%\Help\localsec.chm
%WINDIR%\Help\localsec.hlp
%WINDIR%\Help\keyshort.chm
%WINDIR%\Help\lang.chm
%WINDIR%\Help\langbar.chm
%WINDIR%\Help\magnify.hlp
%WINDIR%\Help\mail.chm
%WINDIR%\Help\mfcuix.hlp
%WINDIR%\Help\lpe.chm
%WINDIR%\Help\lpeconcepts.chm
%WINDIR%\Help\magnify.chm
%WINDIR%\Help\ieos.chm
%WINDIR%\Help\evntwin.hlp
%WINDIR%\Help\fde.hlp
%WINDIR%\Help\filefold.chm
%WINDIR%\Help\eudcedit.chm
%WINDIR%\Help\eudcedit.hlp
%WINDIR%\Help\evconcepts.chm
%WINDIR%\Help\find.chm
%WINDIR%\Help\folderop.chm
%WINDIR%\Help\fonts.chm
%WINDIR%\Help\filefold.hlp
%WINDIR%\Help\filemgmt.hlp
%WINDIR%\Help\file_srv.chm
%WINDIR%\Help\drwtsn32.chm
%WINDIR%\Help\drwtsn32.hlp
%WINDIR%\Help\dsclient.hlp
%WINDIR%\Help\display.hlp
%WINDIR%\Help\dkconcepts.chm
%WINDIR%\Help\drvvfp.chm
%WINDIR%\Help\els.chm
%WINDIR%\Help\els.hlp
%WINDIR%\Help\encrypt.chm
%WINDIR%\Help\dskquoui.chm
%WINDIR%\Help\dskquoui.hlp
%WINDIR%\Help\dxdiag.chm
%WINDIR%\Help\fonts.hlp
%WINDIR%\Help\hrtz.chm
%WINDIR%\Help\hs.chm
%WINDIR%\Help\hschelp.chm
%WINDIR%\Help\hardware.chm
%WINDIR%\Help\hardware.hlp
%WINDIR%\Help\howto.chm
%WINDIR%\Help\ident.hlp
%WINDIR%\Help\ieakmmc.chm
%WINDIR%\Help\ieeula.chm
%WINDIR%\Help\hypertrm.chm
%WINDIR%\Help\hypertrm.hlp
%WINDIR%\Help\icwdial.chm
%WINDIR%\Help\fxsclnt.hlp
%WINDIR%\Help\fxscover.chm
%WINDIR%\Help\fxsshare.chm
%WINDIR%\Help\freecell.chm
%WINDIR%\Help\freecell.hlp
%WINDIR%\Help\fxsclnt.chm
%WINDIR%\Help\gpedit.hlp
%WINDIR%\Help\gptext.hlp
%WINDIR%\Help\halftone.hlp
%WINDIR%\Help\gen.chm
%WINDIR%\Help\Glossary.chm
%WINDIR%\Help\gpedit.chm

Modifies the HOSTS file.

Network activity:

Connects to:

'www.en##iok.cn':80
'localhost':1057
'localhost':80
'<Private IP address>':80
'<Private IP address>':445
'<Private IP address>':139
'localhost':1039

TCP:

HTTP GET requests:

localhost/count.asp?ma#################################################################
www.en##iok.cn/down.txt
www.en##iok.cn/tongji/get.asp?ma####################

UDP:

DNS ASK do##.dllqvod.cn
DNS ASK www.bu#####nchang.com.cn
DNS ASK www.en##iok.cn

Miscellaneous:

Searches for the following windows:

ClassName: 'AfxControlBar42s' WindowName: ''
ClassName: '{F03B79CC-5B19-4D71-9EDD-FFDD44B441BF}' WindowName: '{F03B79CC-5B19-4D71-9EDD-FFDD44B441BF}'
ClassName: 'EDIT' WindowName: ''
ClassName: 'Shell_TrayWnd' WindowName: ''

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical Information