Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'ldp' = '"%APPDATA%\Install\DM6LcnBluRTrGreeNW.com" -launch'
Creates the following files on removable media
- <Drive name for removable media>:\ghost.bat
Modifies file system
Creates the following files
- %APPDATA%\install\dm6lcnblurtrgreenw.com
- %APPDATA%\drsp\wincmd.exe
Miscellaneous
Searches for the following windows
- ClassName: 'MS_WINHELP' WindowName: ''
Creates and executes the following
- '%APPDATA%\drsp\wincmd.exe' -reboot
- '%APPDATA%\install\dm6lcnblurtrgreenw.com' -launch
- '%APPDATA%\drsp\wincmd.exe' -spread
Attempts to shut down the Windows operating system.
