Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = '<Full path to virus>'
Miscellaneous:
Searches for the following windows:
- ClassName: '(null)' WindowName: '???????? ???????'
- ClassName: '(null)' WindowName: '????????? ???????'
- ClassName: '(null)' WindowName: '????????? ????? Windows'
- ClassName: '(null)' WindowName: 'Windows Task Manager'
