Trojan.Siggen4.13124

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '20601' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '17865' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '28376' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '31697' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '10589' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '9365' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '32734' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '84' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '23997' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '19844' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '24575' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '116' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '11037' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '12663' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '6268' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '4786' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '26097' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '11543' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '12444' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '20394' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '18434' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '29055' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '23776' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '19817' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '28764' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '6512' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '21360' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '10703' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '27859' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '31872' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '13593' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '29990' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '24721' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '23670' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '25949' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '29988' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '23309' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '29199' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '8825' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '29810' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '1306' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '5645' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '19298' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '4813' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '11377' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '24648' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '11931' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '29237' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '28257' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '21145' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '3739' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '15401' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '6287' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '25227' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '17431' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '12477' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '21762' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '28803' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '8162' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '13518' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '13197' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '23966' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '47' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '18147' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '10960' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '19527' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '30828' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '13414' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '7236' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '18947' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '624' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '28624' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '8245' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '20891' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '31658' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '18182' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '8060' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '31953' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '4673' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '4342' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '11758' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '18949' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '20501' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '25081' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '29280' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '1961' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '25146' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '20494' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '14317' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '14711' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '32550' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '18547' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '5063' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '27692' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '17309' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '29120' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '6510' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '1089' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '8280' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '28332' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '3729' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '18034' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '31904' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '14925' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '21756' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '17021' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '13554' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '8351' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '30788' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '6836' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '7' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '10918' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '7951' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '21937' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '29053' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '10841' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '1742' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '23995' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '32554' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '5391' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '30569' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '17417' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '24642' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '1848' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '5203' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '7407' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '1521' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '10155' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '3650' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '8781' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '17740' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '23520' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '29844' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '10086' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '18612' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '6979' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '20707' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '14855' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '7050' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '24573' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '24100' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '10808' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '22586' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '30751' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '16835' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '8854' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '13051' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '20926' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '9077' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '17242' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '24458' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '26343' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '23526' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '6873' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '20851' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '23564' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '27928' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '24352' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '21860' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '18685' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '23238' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '764' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '8746' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '3327' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '15146' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '1377' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '10161' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '18326' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '24539' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '22190' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '30165' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '5745' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '31760' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '32054' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '1490' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '2351' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '1200' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '24427' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '13445' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '7667' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '1012' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '30571' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '13591' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '13735' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '22010' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '18032' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '9394' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '26852' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '15361' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '22767' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '23778' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '14381' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '23818' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '10326' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '10218' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '28535' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '6569' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '24886' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '24777' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '7580' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '25897' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '25789' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '22248' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '22140' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '7689' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '15349' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '15241' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '789' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '11592' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '11483' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '29800' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '2812' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '21129' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '6677' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '17697' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '17588' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '2920' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '11698' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '11590' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '29907' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '7941' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '26258' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '26149' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '8952' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '27269' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '27161' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '23620' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '23512' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '9061' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '15095' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '14986' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '535' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '11337' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '29654' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '29546' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '4184' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '22501' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '8049' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '18852' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '18743' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '4292' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '30895' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '11811' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '17482' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '5251' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '23568' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '4892' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '6679' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '393' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '2272' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '3031' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '21347' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '6896' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '30830' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '30721' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '16270' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '16906' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '28951' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '12513' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '19919' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '19810' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '5359' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '16162' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '1710' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '1602' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '25946' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '4294' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '4186' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '25249' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '25140' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '18625' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '7835' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '26151' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '26043' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '22503' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '22394' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '7943' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '5921' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '24237' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '9786' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '2163' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '20480' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '6029' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '21600' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '7040' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '6932' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '9569' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '19721' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '3283' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '8718' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '25048' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '8645' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '12584' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '1600' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '6189' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '12586' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '30250' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '23530' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '122' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '20207' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '18180' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '25298' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '25842' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '12475' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '5069' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '15371' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '9627' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '30469' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '806' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '31289' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '29564' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '5647' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '337' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '5284' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '17135' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '9657' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '4671' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '30319' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '979' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '30502' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '7853' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '1565' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '4778' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '5755' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '15799' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '524' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '29708' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '12945' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '20820' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '24108' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '1131' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '8862' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '15069' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '20751' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '7092' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '32562' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '17678' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '29400' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '29291' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '14840' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '25643' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '11191' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '11083' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '18489' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '4038' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '3929' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '14732' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '281' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '18597' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '16467' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '16358' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '1907' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '12709' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '12601' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '30918' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '5556' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '23873' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '31929' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '1799' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '20115' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '20007' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '7995' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '19990' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '17930' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '1677' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '30286' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '12872' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '32748' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '29128' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '22225' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '17382' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '4707' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '23789' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '30415' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '29982' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '3370' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '27417' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '2489' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '20372' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '16118' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '1233' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '18472' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '19375' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '10486' = '<Full path to virus>'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '20855' = '<Full path to virus>'

Malicious functions:

To bypass firewall, removes or modifies the following registry keys:

[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'
[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '<SYSTEM32>\winlogon.exe' = '<SYSTEM32>\winlogon.exe:*:enabled:@shell32.dll,-1'

Creates and executes the following:

C:\lsass.exe exe <Full path to virus>

Injects code into

the following system processes:

<SYSTEM32>\winlogon.exe

Restores hooked functions in System Service Descriptor Table (SSDT).

Modifies file system :

Creates the following files:

C:\lsass.exe

Network activity:

Connects to:

'24.##1.50.157':3128
'24.##6.28.20':3128
'62.##.65.197':3128
'24.##6.134.250':3128
'65.##.101.80':3128
'18#.#2.167.21':3128
'14#.#51.134.72':3128
'24.##.220.189':3128
'94.##.136.185':3128
'18#.#6.81.14':3128
'82.##2.182.2':3128
'20#.#18.148.104':3128
'21#.#98.180.243':3128
'18#.#8.90.243':3128
'66.#5.0.227':3128
'99.##0.125.6':3128
'94.##.167.99':3128
'88.##5.124.142':3128
'59.##3.77.68':3128
'68.#0.10.75':3128
'82.##1.251.69':3128
'68.##.118.115':3128
'99.##8.147.8':3128
'77.##0.1.162':3128
'17#.#3.99.236':3128
'74.##5.35.15':3128
'70.##7.16.20':3128
'12.##9.239.126':3128
'19#.#6.6.176':3128
'71.##8.78.81':3128
'18#.#05.179.72':3128
'18#.#58.232.173':3128
'85.##5.181.33':3128
'69.##4.174.60':3128
'17#.#7.152.230':3128
'89.##8.98.66':3128
'69.##7.124.222':3128
'84.##4.197.145':3128
'21#.#7.122.117':3128
'24.##1.165.156':3128
'67.##.130.224':3128
'12#.#52.252.187':3128
'24.##.99.217':3128
'75.##.31.214':3128
'96.##.244.113':3128
'98.##5.90.217':3128
'17#.#8.121.3':3128
'89.##.217.119':3128
'11#.#8.208.86':3128
'95.##4.105.246':3128
'18#.#8.118.68':3128
'20#.#8.154.200':3128
'67.#4.65.15':3128
'11#.#37.24.57':3128
'84.##.126.15':3128
'68.##.177.21':3128
'98.##.166.52':3128
'18#.#21.68.163':3128
'66.##.101.49':3128
'80.#9.16.26':3128
'65.##4.67.43':3128
'24.##9.246.189':3128
'99.##8.43.79':3128
'19#.#7.44.61':3128
'89.##.241.24':3128
'84.#.239.224':3128
'71.##.222.188':3128
'11#.#93.99.156':3128
'17#.#3.42.110':3128
'68.##.191.230':3128
'21#.#32.149.118':3128
'24.##4.163.140':3128
'24.##.201.111':3128
'21#.#3.91.47':3128
'67.##1.81.62':3128
'79.##5.237.185':3128
'18#.#.195.110':3128
'24.##8.137.165':3128
'98.#02.5.95':3128
'76.##.215.27':3128
'68.##8.221.19':3128
'76.##6.197.103':3128
'20#.#7.241.135':3128
'96.##.91.254':3128
'70.##6.55.65':3128
'19#.#20.109.140':3128
'88.##2.252.122':3128
'66.##1.37.201':3128
'localhost':4
'65.##.46.243':3128
'96.#.109.140':3128
'68.##.130.204':3128
'19#.#7.38.110':3128
'76.##.181.67':3128
'98.##3.127.251':3128
'68.##.220.73':3128
'84.##.126.15':31
'91.##4.198.107':312
'94.##5.172.144':3128
'99.##4.251.102':3128
'18#.#0.127.194':3128
'20#.#36.213.81':31
'<Private IP address>':0
'12#.#52.httst.p':80
'68.http':0
'76.##.169.45':3128
'17#.#0.18.224':3128
'68.##8.147.89':3128
'19#.#13.98.56':3128
'96.##.18.162':3128
'99.##5.93.248':3128
'64.##2.21.235':3128
'75.##9.19.195':3128
'67.##2.196.224':3128
'67.##7.35.236':3128
'68.#9.2.223':3128
'17#.#70.168.179':3128
'89.##0.101.12':3128
'75.##8.112.97':3128
'89.##3.55.18':3128
'21#.#2.186.229':3128
'24.#.238.104':3128
'93.##.167.197':3128
'82.#48.75.2':3128
'67.##3.99.14':3128
'82.##5.210.42':3128
'86.##6.76.206':3128
'80.##9.212.170':3128
'76.##9.175.189':3128
'81.#6.1.76':3128
'67.##.27.200':3128
'18#.#3.111.25':3128
'19#.#00.86.171':3128
'67.##7.119.211':3128
'58.##.236.60':3128
'99.##5.67.100':3128
'localhost':885
'68.##.136.70':3128
'74.#9.1.243':3128
'74.##5.102.9':3128
'86.##7.219.143':3128
'97.##0.144.9':3128
'20#.#7.11.53':3128
'20#.#80.126.174':3128
'18#.#0.201.60':3128
'20#.#23.169.90':3128
'17#.#9.167.7':3128
'69.##4.125.151':3128
'20#.#2.27.128':3128
'78.##.214.156':3128
'82.##.43.159':3128
'19#.#0.108.47':3128
'18#.#8.20.97':3128
'99.##3.208.73':3128
'76.##4.158.21':3128
'71.##.170.54':3128
'20#.#33.147.54':3128
'98.##9.141.137':3128
'20#.#36.213.81':3128
'24.##0.161.226':3128
'19#.#59.16.32':3128
'68.#5.7.125':3128
'20#.#5.28.250':3128
'19#.#4.194.63':3128
'19#.#41.73.20':3128
'17#.#3.144.69':3128
'19#.#88.235.27':3128
'68.##7.98.133':3128
'22#.#55.122.196':3128
'89.##.129.35':3128
'78.##8.73.121':3128
'24.##8.76.244':3128
'19#.#2.157.107':3128
'17#.#8.35.43':3128
'72.##7.136.175':3128
'74.##6.110.229':3128
'71.##5.9.218':3128
'24.##.179.129':3128
'20#.#2.78.168':3128
'69.##4.198.17':3128
'8.##.189.85':3128
'85.##0.183.60':3128
'85.##1.248.229':3128
'85.##1.159.23':3128
'67.##6.62.152':3128
'70.##0.99.84':3128
'19#.#1.248.253':3128
'87.##0.55.68':3128
'13#.#3.47.58':3128
'24.##.127.73':3128
'74.#2.3.50':3128
'98.#4.63.90':3128
'13#.#1.253.4':3128
'67.#3.0.202':3128
'72.##3.138.154':3128
'24.##2.227.147':3128
'21#.#0.236.113':3128
'76.##8.231.13':3128
'98.##6.116.193':3128
'80.##3.159.169':3128
'18#.#4.210.49':3128
'20#.#50.61.166':3128
'69.##2.7.227':3128
'68.##.107.122':3128
'24.##0.226.239':3128
'20#.#0.183.173':3128
'ir#.zief.pl':65520
'84.##1.9.109':3128
'76.##0.151.53':3128
'95.#9.69.97':3128
'72.##4.250.200':3128
'77.##1.151.170':3128
'82.##1.117.87':3128
'58.#.149.218':3128
'71.##6.78.164':3128
'68.#8.98.80':3128
'72.##.110.42':3128
'20#.#93.57.63':3128
'20#.#30.105.180':3128
'20#.#12.184.117':3128
'84.##.83.186':3128
'82.##1.119.31':3128
'75.##0.44.141':3128
'19#.#2.191.207':3128
'20#.#3.217.90':3128
'18#.#.208.50':3128
'86.##5.93.118':3128
'71.##2.142.211':3128
'89.##9.241.114':3128
'78.##.160.202':3128
'20#.#5.57.236':3128
'24.##2.120.68':3128
'72.#87.83.4':3128
'67.##2.16.41':3128
'69.##0.216.41':3128
'20#.#22.192.159':3128
'19#.#55.50.230':3128
'21#.#32.153.245':3128
'75.##.31.100':3128
'98.##5.84.236':3128
'20#.#37.24.91':3128
'70.##1.55.213':3128
'12#.#00.61.136':3128
'20#.#10.108.46':3128
'96.#0.52.44':3128
'68.##.102.58':3128
'19#.#7.60.64':3128
'68.##.236.251':3128
'18#.#1.139.112':3128
'78.##.20.218':3128
'12#.#5.151.233':3128
'76.##7.153.246':3128
'18#.#9.120.117':3128
'74.##.175.57':3128
'76.##.225.102':3128
'83.#.240.246':3128
'20#.#0.55.194':3128
'41.##1.123.62':3128
'83.##6.140.41':3128
'75.##4.74.25':3128
'18#.25.2.99':3128
'68.##6.133.53':3128
'77.#50.6.92':3128
'17#.#0.158.176':3128
'24.##7.211.4':3128
'72.##0.123.189':3128
'21#.#12.15.216':3128
'19#.#54.169.248':3128
'20#.#5.241.160':3128
'67.##.217.167':3128
'78.##8.217.249':3128
'69.##5.17.215':3128
'24.##6.212.57':3128
'76.##0.46.64':3128
'79.##2.22.215':3128
'17#.#7.12.142':3128
'19#.#1.250.47':3128
'68.#.89.93':3128
'68.#6.1.115':3128
'17#.#8.33.102':3128
'86.##6.9.164':3128
'11#.#9.208.11':3128
'17#.#3.160.44':3128
'20#.#5.161.137':3128
'21#.#0.69.240':3128
'17#.#4.229.40':3128
'72.##.217.130':3128
'19#.#05.122.129':3128
'70.##1.177.198':3128
'24.##1.27.53':3128
'68.##4.145.55':3128
'24.##1.236.126':3128
'97.##.127.98':3128
'76.##.94.234':3128
'91.##4.198.107':3128
'82.##.77.184':3128
'19#.#03.192.159':3128
'17#.#0.14.191':3128
'76.##7.169.76':3128
'84.#05.7.15':3128
'78.##2.190.90':3128
'19#.#2.102.12':3128
'68.##4.127.89':3128
'77.##.35.149':3128
'99.##0.115.134':3128
'20#.#0.224.126':3128
'18#.#6.93.138':3128
'19#.#62.19.244':3128
'77.##2.161.101':3128

UDP:

DNS ASK 68.http
DNS ASK 12#.#52.htTSt.p
DNS ASK ir#.zief.pl

Miscellaneous:

Searches for the following windows:

ClassName: 'Indicator' WindowName: ''

技术

术语

教育培训

误区

Technical Information

Curing recommendations

Free trial